Deployment Administrators

To run Deployment Manager, you must have the Deployment Administrator role. Deployment Administrators have unrestricted access to perform Deployment Manager tasks on all organizations and servers in a Dynamics 365 Customer Engagement (on-premises) deployment.

Important

Make sure that at least two or three trusted people have the Deployment Administrator role. This prevents system lockout if the primary deployment administrator is unavailable.

During Dynamics 365 Server Setup, the user running Setup is automatically given the Deployment Administrator role. A Deployment Administrator can give the Deployment Administrator role to other users in Active Directory directory service.

Note

Users who have the Deployment Administrator role do not automatically become Dynamics 365 Customer Engagement (on-premises) users and do not consume a client access license (CAL).

The Deployment Administrator role cannot be managed in the Dynamics 365 Customer Engagement (on-premises) client applications.

Known issue where a deployment administrator has insufficient permission

After a user is added as a deployment administrator, the member of the Deployment Administrators group might receive a message similar to one of the following when executing a deployment administrative task, such as importing an organization database.

Failed to install CustomControlsCoreException: Microsoft.Crm.CrmException: The user Id(s) [00000000-0000-0000-0000-000000000000] is invalid.

or

contextUserId=XXXX-XXXX-XXXX-XXXX-XXXXXXXXXXX has correct privileges but allowImpersonationOfOrganizationSystemUser == false

When an error like this occurs the administrative task doesn't complete successfully. This issue occurs because the user isn't a member of the PrivUserGroup security group. To resolve this issue, Add the deployment administrator to the PrivUserGroup Active Directory security group.

See also

Add a new Deployment Administrator
Remove a Deployment Administrator