I ran into an issue recently at a customer of mine when I was trying to save a business rule I just deactivated and modified. The error was quite cryptic;
Access to Microsoft Dynamics CRM has not yet been fully configured for this user. The user needs at least one security role before you can continue.
I was quite stumped and didn’t find any solution to this strange behavior. I was ready to submit a ticket at the Dynamics CRM Support Team as even Google didn’t solve my rising concerns surrounding this error. But planning on not loosing to much time I was first going to do my other customizations at this client of mine.
One of this customizations concerned the ribbon in the Dynamics CRM organization, for which I use the Ribbon Workbench by Scott Durrow, on of my CRM Giants. Be it by random coincidence or whatever, but the solution I used for the Ribbon Workbench contained the same entity with the business rule that gave me the error. After my Ribbon modification I tried to publish my changes but received an error:
SecLib::RetrievePrivilegeForUser failed – no roles are assigned to user.
Following this error landed me on the blogpost by Scott. Slowly things started to fall in place in my mind and I discovered what was going on.
The owner of the business rule, which was giving this error in the Ribbon workbench, had been stripped or roles and licenses earlier. His records were reassigned by the handy option on a user record that allows you to ‘Reassign Records’, but clearly his business rules didn’t. Heck, I didn’t even know until then that business rules also have owners. So the business rule was loaded inside it’s parent entity into the ribbon workbench, while having an deactivated user as owner.
Long story made short, querying all business rules (Advanced find for Processes of Type ‘Definition’ and Category ‘Business Rule’) and assigning the ones being owned by the deactivated user to myself solved the error in the Ribbon workbench. Furthermore, it also solved my initial error
Its not clear to me whether or not this is default behavior or a bug in the system. Finally, this adds one more thing to keep in mind when you deactivate a user in the system as pressing “reassign records” will not be enough!