What it does

Controls who can see and do what in Customer Insights - Journeys, using ordinary Dataverse security roles plus a large set of application users and internal roles that the service itself runs under. The marketing-facing part is small; the part you must not break is large.

Key facts

• The four roles you actually assign to people: Marketing Professional - Business (marketers, no settings), Marketing Manager - Business (adds full Settings access), and the two BU-scoped variants, Marketing Professional (BU level) - Business and Marketing Manager (BU level) - Business, for multi-business-unit organisations.
• Event work has its own roles: Event Administrator (all event entities plus event settings, organisation scope) and Event Planner (create/read/write/share in own business unit, delete and assign only own records).
• Lead scoring adds Lead Score Modeler and Lead Score Viewer, and LinkedIn Lead Gen adds LinkedIn Lead Gen Forms Administrator and LinkedIn Lead Gen Forms Salesperson. All four are additive — they get layered on top of a core marketing role, not used alone.
• Roles named for internal use — Marketing, Business App Access, Marketing Services User, EventManagement S2S Inbound, LinkedIn LeadGen S2SInbound, and the whole Cxp ... family — belong to service accounts. Do not assign them to people and do not modify them.
• The D365 Marketing application user must keep EventManagement S2SInbound, LinkedIn LeadGen S2SInbound, Marketing Services User, Marketing Business App Access, the Marketing service user extensible role and the Marketing service user real-time role. Strip any of those and functionality breaks in ways that are hard to diagnose.
• Behind the scenes there is a long list of Microsoft-owned application users — segmentation, SMS channel, workflow, personalisation, consent, forms, frequency capping and more — each with its own Entra ID application ID and Cxp role. Field security profiles for mobile app secrets and shared SMS channels also have to stay in place, or SMS and push flows fail.
• Licensing is capacity-based, not per seat. Any tenant user who can reach the environment URL can use the app; access is restricted with security groups on the environment, not by withholding licences.
• Users without a Dynamics 365 licence get the free Dynamics 365 Customer Insights - Journeys User License in the Microsoft 365 admin centre. It grants Journeys only, not Sales or Customer Service.
• Out-of-the-box roles are updated automatically with each monthly release. Custom roles are not — new tables and privileges from new features have to be added by hand.
• Microsoft publishes per-release permission-change pages (role-permissions and the dated variants) so you can diff what changed in a given version against the pre-March-2026 baseline.

When to use / skip

You need a role model on every project, but resist building a bespoke one. The out-of-the-box marketing roles cover the realistic split — people who make content and people who configure the system — and they get maintained for free every month. A custom role is a standing maintenance liability that someone has to reconcile after every release.

Go BU-scoped only when the client genuinely has separate brands or regions that must not see each other's contacts and journeys. Modernised business units in Journeys are a substantial design commitment and they interact with compliance profiles and domain ownership. If the requirement is really just "the France team shouldn't accidentally email the UK list", solve that with segments and process first.

Where a custom role is unavoidable, copy an out-of-the-box role rather than editing it, and write down which release it was copied from.

Configuration decisions

• Which of the four core marketing roles each user group gets, and whether anyone genuinely needs Marketing Manager - Business — full Settings access includes compliance profiles and domain authentication.
• Whether to enable business unit scoping at all, and if so whether modernised business units are in scope. This is a structural decision, not a permissions tweak.
• Whether a security group is attached to the environment. Without one, capacity licensing means the whole tenant can walk in.
• How event and lead-scoring roles are layered on top of the core roles, and who holds Event Administrator given it carries organisation-wide privileges.
• Whether marketers get access to the underlying contact and lead records at organisation scope, or whether the existing Sales role model constrains them.
• How custom roles will be reviewed after each monthly release, and who owns that.

Gotchas

• Auto-provisioning from Entra ID: a user who opens the environment URL is created automatically and given a default role. Your carefully designed role model silently acquires users you didn't plan for.
• Someone tidying up "unused" security roles or disabling "unused" application users is the classic cause of a marketing environment that stops sending. The Cxp roles look like clutter and are not.
• Custom roles drift. A feature ships, the out-of-the-box roles pick up the new table, the custom role doesn't, and marketers get a permission error on a screen that worked yesterday.
• The free Journeys user licence is not a general Dynamics licence. Assigning it to a salesperson who also needs Sales will not work, and the failure looks like a role problem.
• Business unit scoping affects more than record visibility — domains and compliance profiles are also scoped, so a BU rollout can leave a team unable to send from the domain they expect.
• Marketing Manager - Business gives access to consent configuration. On a regulated client that is a governance question, not just a convenience one.

Consultant notes

• Give the client the list of do-not-touch service accounts and roles as a written artefact and get their platform team to acknowledge it. It prevents the most expensive incident in this area.
• Attach a security group to the environment before user acceptance testing, or you'll spend a week explaining why forty people appeared in the user list.
• If the client insists on custom roles, agree in the design who checks the per-release permission-change pages each month and budget the time.
• Demo what a Marketing Professional actually sees versus a Marketing Manager. Clients routinely ask for everyone to be a manager until they see that it includes compliance settings.
• Before go-live, confirm the D365 Marketing application user still has its full role set — particularly after any solution import or environment copy.

---

Worth revisiting after a release that changes the out-of-the-box role definitions, or if the client moves to modernised business units.