D365 PortalThere are three roles and they are hierarchical: a role also satisfies every lower-ranked one. Owner includes everything an administrator can do, and administrator includes everything a viewer can do.
| Action | Viewer | Administrator | Owner |
|---|---|---|---|
| Read dashboards and telemetry | Yes | Yes | Yes |
| Export to CSV (Pro plan) | Yes | Yes | Yes |
| See the masked string | Yes | Yes | Yes |
| Reveal the full string | No | Yes | Yes |
| Create the telemetry destination | No | Yes | Yes |
| Rotate the string | No | Yes | Yes |
| Register or remove environments | No | Yes | Yes |
| Invite users and change roles | No | Yes | Yes |
| Manage alerts and destinations | No | Yes | Yes |
| Change organization name and logo | No | Yes | Yes |
| Read the audit log | No | Yes | Yes |
| Manage the subscription | No | No | Yes |
Rules worth knowing
- The last owner cannot be removed or demoted. With no owner, nobody could administer the organization.
- Revealing the connection string is always recorded in the Audit log, even when an owner does it.
- The role is assigned at invitation time and can be changed later from Settings → Users.