A security role granted to a business unit default team

Business unit default team holds a security role.

Every user in a business unit is an unremovable member of its default team, so a role there grants to the whole unit and widens automatically as people are added. Easy to do by accident.

List teams that hold roles and check the team type. Default teams are created automatically per business unit and their membership is not something you control, so any role on one grants to everyone in that unit both now and as it grows.

Move the role onto an owner team or an explicit assignment naming only the users who need it.

These mappings are indicative. Pathix detects a condition relevant to a control. It does not certify your compliance, and a finding is not an audit opinion. You stay responsible for your control environment.

This condition produces evidence for AC.L1-3.1.1 (Level 1: limit system access to authorized users, processes and devices), for the Dataverse system in your assessment scope. A role on a business unit default team is held by every user in that business unit, including everyone added later. The set of authorized users grows without anyone choosing to grant access.

Pathix is not a CMMC compliance platform. It does not assess the rest of your environment, mappings are indicative, and assessment outcomes rest with your assessor.

• A security role assigned to both people and integrations
• An integration account holding System Administrator
• An integration account that can grant itself privileges
• A non-admin role that can grant itself administrator