agentsclimarketplace

D365 live security role guard

Skill Raishin/vanguard-frontier-agentic/skills/microsoft/d365-live-security-role-guard

Curated marketplace of AI skills, agents, and rules for cloud, zero-trust, and compliance-aware engineering - works with Claude Code, Codex, Cursor, Copilot, and more.

Install
npx -y skills add Raishin/vanguard-frontier-agentic --skill d365-live-security-role-guard

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • 18 stars18 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Live read-only Dataverse security posture discovery — enumerate security roles, team and business-unit assignments, application users, over-privileged System Administrator assignments, and SoD-relevant privilege combinations — then propose least-privilege role design with rollback plan. Phase A read-only-runtime only; no mutation. Operates on the Dataverse data plane via a custom read-only security role, never via the Power Platform management SPN path.

SKILL.md

6.0 KB, 823 tokens by cl100k_base, as published. Nobody here has run it

D365 Live Security Role Guard

Purpose

Act as the live read-only Dataverse security posture guard. Authenticate as an application user bound to a custom read-only security role to discover the current role and privilege posture of the target Dataverse environment, then emit a structured hardening proposal with rollback plan. Never mutate; never request credential values; never use the Power Platform management SPN path.

When to use

  • Dataverse security roles must be audited for over-privileged assignments (System Administrator spread, overly broad table privileges)
  • Team-based and business-unit-based role assignments need to be reviewed for SoD violations
  • Application users must be enumerated to verify each is bound to a least-privilege custom role, not System Administrator
  • SoD-relevant privilege combinations (e.g. Read + Export across sensitive tables) need to be identified
  • A role-design proposal is needed before a formal security review or compliance audit

Live-guard gate

This skill operates at read-only-runtime. It authenticates as a Dataverse application user with a custom read-only security role and performs Dataverse Web API GET/query calls only. Any proposed change must be reviewed and approved by a human operator before Phase-B execution. This skill is never auto-dispatched by a maestro; explicit human confirmation is required.

Critical IAM constraint

The Power Platform management SPN path (pac admin create-service-principal) grants Power Platform Administrator privileges that cannot be scoped down — it is treated as a tenant-wide admin. This skill explicitly forbids that path. The application user must be created manually in the target Dataverse environment and bound to a custom read-only security role with only the table-level Read privileges needed for posture discovery.

Credential posture

  • App registration: use a certificate credential or managed identity — never a long-lived client secret.
  • Credentials are referenced by environment variable name only (DATAVERSE_CLIENT_ID, DATAVERSE_ENV_URL). Never print, echo, or log credential values.
  • The application user must be created in the target Dataverse environment and associated with the custom read-only security role before this skill runs.

Lean operating rules

  • Prefer Microsoft Learn documentation through the configured documentation MCP for Dataverse and Power Platform service behavior.
  • Use sampled read-only Dataverse Web API evidence when available; label it as sampled configured-environment evidence.
  • Do not execute any POST, PATCH, PUT, or DELETE Dataverse Web API call.
  • If the request implies role assignment, role creation, or user modification, push back — that is Phase-B gated work.
  • State what is unknown; documentation proves service behavior, not the environment's deployed state.

Discovery targets

  1. Security roles — all roles in the environment, their privilege matrix (table/scope/access-level)
  2. System Administrator assignments — users and teams with System Administrator; flag permanent assignments for remediation
  3. Application users — enumerate SystemUser rows with ApplicationId set; verify each is NOT bound to System Administrator
  4. Team role assignments — owner teams and access teams with broad roles
  5. Business unit structure — BU hierarchy and which BUs have broad role assignments
  6. SoD-relevant privilege combos — Read + Export on Finance/HR/PII tables; Append-To on sensitive tables

Response minimum

  • confirmed environment URL and application user identity
  • discovery summary per target above
  • hardening proposals: what, why, blast-radius, affected users/teams
  • rollback contract for each proposal (Phase-B)
  • open questions and evidence gaps

Official sources

Keep looking

Skills are one crate of 328,083. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.