How to – change user’s business unit without removing the security roles in Dynamics 365 / PowerApps (EnableOwnershipAcrossBusinessUnits setting)

When we change the user’s business unit, all the current security roles of the users are removed and we need to assign the roles again to the user. This has always been the default behavior. 

Also check – Modernize Business Units –  https://nishantrana.me/2022/01/04/modernize-business-units-matrix-data-access-structure-record-ownership-across-business-units-preview-in-dynamics-365-dataverse/

For E.g. below user User 2 belongs to Business Unit – BU 1 and has the following security roles assigned.

Now changing the user’s business unit to BU 2

will remove all his security roles assigned.

We can now override this behavior by updating the new option /setting added

EnableOwnershipAcrossBusinessUnits (this property determines if roles are removed when the principal changes business units) through the
Organization Settings Editor tool

After we have installed the managed solution, we can update the setting and set it as true

Let us assign the security roles to User 2 in BU 2.

Let us now change the BU of user 2 back to BU 1.

As expected after updating that setting – DoNotRemoveRolesOnChangeBusinessUnit– as true – we can see the security roles still intact, even on the change of Business Unit for the user.

What happens if user 2 is assigned a security role – BU2 Security Role, which is created in BU 2 Business unit and is not available in BU 1.

Let us change the business unit to BU 1.

As expected BU2 security role is not available in BU 1, so that role is not assigned, only the common security role coming from parent BU remains intact.

Hope it helps..