# Security Roles

:::info
The Dynamics 365 App is in preview. It is not yet listed on Microsoft AppSource. To try it, contact your Fours account team for the install package.
:::

The Dynamics 365 App takes the access of each user from the Dynamics 365 security roles of that user. The Fours for Dynamics 365 solution adds four security roles. Three roles are for people, and one role is for the Fours application user.

---

## Overview

The app reads the roles of the user who opens the pane or a dialog. A role counts when you assign it to the user directly or through a team. The app applies these roles inside Dynamics 365, on every request to Fours. A user without a Fours role cannot use the app.

| Role | Assign to | What it allows |
| --- | --- | --- |
| No Fours role | Users who do not work with Fours | Nothing. The pane shows "You don't have access to Fours". |
| Fours User | Everyone who works with offers and co-sells | See the co-sells, offers and agreements of an opportunity. Create offers and save drafts. Use the actions on offers. Opt out of auto-renewal and adjust the renewal uplift of agreements. Share co-sells with AWS. |
| Fours Admin | The people who manage the Fours configuration of your organization | Everything that Fours User allows, plus the admin-only actions. A Fours Admin can save and delete the discount rules of your organization. A Fours Admin can also request the cancellation of an agreement, withdraw a pending request, and make a billing adjustment. |
| System Administrator | Dynamics 365 administrators | The same access as Fours Admin, with no Fours role. |
| Fours Approver | The people who approve offers, when offer approval is on | Approve, request a change to, or decline a submitted offer. See the **Approvals** tab. When offer approval is on, only a Fours Approver can create offers and offer sets. |
| Fours Integration | The Fours application user only | Lets Fours write the Fours Configuration row when an admin connects Dynamics 365 in the Fours Console. Do not assign it to people. |

---

## How the roles combine

- A user gets the highest access of all the Fours roles that the user has.
- Fours Approver works beside Fours User or Fours Admin. A user with only Fours Approver also gets the access of Fours User.
- An administrator is not an approver. A user with Fours Admin or System Administrator approves offers only with the Fours Approver role too.
- In an organization that holds co-sell referrals for approval in Fours, a co-sell that a Fours User shares waits for approval in Fours. A co-sell that a Fours Admin shares or resubmits does not wait.

:::note
Fours User, Fours Admin and Fours Approver grant no Dynamics 365 privileges of their own. Keep the Sales roles of each user next to the Fours roles. For a co-sell, the app also requires that the user can read the opportunity in Dynamics 365.
:::

:::note
If a Fours Admin saves a discount rule and gets the message "the user role in org is not ADMIN", contact your Fours account team. The role in Dynamics 365 is correct. The fix is on the Fours side.
:::

---

## Assign a role to a user

Do these steps as a System Administrator. Repeat them for each user.

1. Go to the [Power Platform admin center](https://admin.powerplatform.microsoft.com/environments).
2. Select your environment, and then select **Settings**.
3. Select **Users + permissions** > **Users**.
4. Select the user, and then select **Manage security roles**.
5. Select the Fours role for that user. Do not clear the Sales roles that the user already has.
6. Select **Save**.

To give a role to many users at one time, assign it to a Dynamics 365 team. In step 3, select **Users + permissions** > **Teams** instead, and then select the team. The app counts the roles that a user gets through a team.

---

## Make sure that the role works

Ask the user to reload the opportunity page and select **Fours** on the command bar. The pane shows what the role allows:

- A user without a Fours role sees "You don't have access to Fours". The pane then asks the user to get the Fours User role from an administrator.
- A user with Fours User sees the tabs of the opportunity, and can create offers and save drafts.
- A Fours User who tries to save a discount rule sees "Saving or deleting rules needs the Fours Admin security role in Dynamics."
- When offer approval is on, a Fours Approver sees the **Approvals** tab on every opportunity.

For the setup steps around the roles, see [Install the Dynamics 365 App](/dynamics365-app/dynamics365-app-install/). For offer approval, see [Offer Approval](/dynamics365-app/dynamics365-app-offer-approval/).