An integration account holding System Administrator

Integration account holds a Microsoft system role.

A service account with System Administrator or System Customizer bypasses nearly every access check. A compromised key can read everything, rewrite security, and cover its tracks. Pentesters find this in the first fifteen minutes.

Query systemuser for rows where applicationid is not null, link through systemuserroles to role, and read the role names. Anything called System Administrator or System Customizer is the finding. Check custom roles in the same list too: the second most common version is a role copied from System Administrator years ago and never trimmed.

Replace the system role with a custom least-privilege role scoped to what the integration actually touches.

These mappings are indicative. Pathix detects a condition relevant to a control. It does not certify your compliance, and a finding is not an audit opinion. You stay responsible for your control environment.

This condition produces evidence for AC.L2-3.1.5 (Level 2: employ least privilege, including for privileged accounts and security functions), for the Dataverse system in your assessment scope. Least privilege is the practice an assessor can test fastest, because a service account holding System Administrator is a single row that settles it without argument.

Pathix is not a CMMC compliance platform. It does not assess the rest of your environment, mappings are indicative, and assessment outcomes rest with your assessor.

• A security role assigned to both people and integrations
• An integration account that can grant itself privileges
• A non-admin role that can grant itself administrator
• A role-holding team with both people and service accounts in it