How to find D365 System Administrators

The Dynamics 365 System Administrator Role has to be granted individually to Users or given indirectly via a Dataverse Team. Below are a few useful FetchXML queries to help figure out who has the Role and what Dataverse Teams grant the role.

Which Team(s) Grant System Admin?

Note that if an azureactivedirectoryobjectid is returned you would need to perform a separate MS Graph lookup to get the Entra group name. Alternately, you can open the Team in PPAC and it will do the resolution for you.

<fetch distinct="true" count="500">
  <entity name="team">
    <attribute name="name"/>
    <attribute name="teamtype"/>
    <attribute name="businessunitid"/>
    <attribute name="azureactivedirectoryobjectid"/>
    <attribute name="emailaddress"/>
    <attribute name="description"/>
    <order attribute="name"/>
    <link-entity name="teamroles" from="teamid" to="teamid" link-type="inner" />
      <link-entity name="role" from="roleid" to="roleid" link-type="inner" />
        <filter>
          <condition attribute="name" operator="eq" value="System Administrator"/>
        </filter>
      </link-entity>
    </link-entity>
  </entity>
</fetch>

What User(s) have System Admin?

If you want to get a listing of all the Users that have the System Administrator Role granted either directly or indirectly via a Team, you can run this FetchXML. Note that just gives you a list of users with the Role. If you want to see if the Role is granted directly or via a Team you will need to see the queries below this one.

<fetch distinct="true" count="500">
  <entity name="systemuser">
    <attribute name="systemuserid"/>
    <attribute name="fullname"/>
    <attribute name="internalemailaddress"/>
    <attribute name="domainname"/>
    <attribute name="isdisabled"/>
    <order attribute="fullname"/>
    <filter type="or">
      <condition entityname="direct" attribute="systemuserid" operator="not-null"/>
      <condition entityname="team_member" attribute="systemuserid" operator="not-null"/>
    </filter>
    {/* Direct role assignment */}
    <link-entity name="systemuserroles" from="systemuserid" to="systemuserid" link-type="outer" alias="direct" />
      <link-entity name="role" from="roleid" to="roleid" link-type="inner" />
        <filter>
          <condition attribute="name" operator="eq" value="System Administrator"/>
        </filter>
      </link-entity>
    </link-entity>
    {/* Role via team membership */}
    <link-entity name="teammembership" from="systemuserid" to="systemuserid" link-type="outer" alias="team_member" />
      <link-entity name="teamroles" from="teamid" to="teamid" link-type="inner" />
        <link-entity name="role" from="roleid" to="roleid" link-type="inner" />
          <filter>
            <condition attribute="name" operator="eq" value="System Administrator"/>
          </filter>
        </link-entity>
      </link-entity>
    </link-entity>
  </entity>
</fetch>

Which User(s) have System Admin assigned directly?

<fetch distinct="true" count="500">
  <entity name="systemuser">
    <attribute name="systemuserid"/>
    <attribute name="fullname"/>
    <attribute name="internalemailaddress"/>
    <attribute name="isdisabled"/>
    <order attribute="fullname"/>
    <link-entity name="systemuserroles" from="systemuserid" to="systemuserid" link-type="inner" />
      <link-entity name="role" from="roleid" to="roleid" link-type="inner" />
        <filter>
          <condition attribute="name" operator="eq" value="System Administrator"/>
        </filter>
      </link-entity>
    </link-entity>
  </entity>
</fetch>

Which User(s) have System Admin assigned via Team?

Note that this query may return more than 1 row per users which would indicate they are granted the Role via multiple Teams.

<fetch distinct="true" count="500">
  <entity name="systemuser">
    <attribute name="systemuserid"/>
    <attribute name="fullname"/>
    <attribute name="internalemailaddress"/>
    <attribute name="isdisabled"/>
    <order attribute="fullname"/>
    <link-entity name="teammembership" from="systemuserid" to="systemuserid" link-type="inner" />
      <link-entity name="team" from="teamid" to="teamid" link-type="inner" />
        <attribute name="name" alias="team_name"/>
        <attribute name="teamtype" alias="team_type"/>
        <attribute name="azureactivedirectoryobjectid" alias="entra_group_id"/>
        <link-entity name="teamroles" from="teamid" to="teamid" link-type="inner" />
          <link-entity name="role" from="roleid" to="roleid" link-type="inner" />
            <filter>
              <condition attribute="name" operator="eq" value="System Administrator"/>
            </filter>
          </link-entity>
        </link-entity>
      </link-entity>
    </link-entity>
  </entity>
</fetch>

Wrapping up

Hopefully this is useful. Note also that while this example is around the System Administrator Role you could use the same queries for other Roles as well. Sure beats clicking into a million screens in the PPAC.