---
title: "Check effective user rights within a record"
url: "https://help.altus.pro/nl/article/check-effective-user-rights-within-a-record"
language: "nl"
last_updated: "2026-05-28T06:40:43.971Z"
---

# Check effective user rights within a record

Effective user rights in Altus determine what a user can **actually see and do** within a specific record (e.g. project, risk, issue, or financial item).

These rights are not defined by a single setting—they are the result of multiple factors combined, including:

-   Security roles
-   Business Unit scope
-   Team membership
-   Record ownership and sharing

Understanding how to check effective user rights is essential for **troubleshooting access issues and validating governance configuration**.

* * *

## Important: Platform & Permissions

Effective access is governed by:

-   Power Platform / Dataverse security roles
-   Business Units (scope)
-   Teams and sharing

These are configured in:

-   Power Platform Admin Centre
-   Power Apps / Dataverse

* * *

## How to Check Effective User Rights in Altus

Altus provides a built-in function to review effective access directly from within a record.

### Method: Use “Check Effective Rights”

1.  Open the relevant **Altus record** (e.g. Project, Risk, Issue)
2.  Locate the **Command Bar (ribbon)** at the top of the record
3.  Select **Check Effective Rights**
4.  Choose the user you want to review (if prompted)

This will display the user’s **effective permissions for that specific record**, including:

-   Whether they can **read (view)** the record
-   Whether they can **write (edit)** the record
-   Whether they can perform actions such as **delete, assign, or share**

👉 This provides the most accurate view of a user’s **actual system access**

* * *

## Additional Validation (Optional)

You can also validate access by observing behaviour:

-   Can the user **open the record**?
-   Are fields **editable or read-only**?
-   Can they perform actions (update, assign, approve)?

This complements the **Check Effective Rights** function with real-world validation.

* * *

## What Determines Effective Access

Effective rights are determined by a combination of:

### 1\. Security Roles

-   Define what actions are allowed (Create, Read, Update, Delete, etc.)

* * *

### 2\. Business Unit Scope

-   Defines the **data boundary** (which records are accessible)

* * *

### 3\. Team Membership

-   Users inherit access from teams
-   Teams may:
-   -   Have roles assigned
    -   Own records

* * *

### 4\. Record Ownership

-   Records owned by:
-   -   The user
    -   A team the user belongs to

* * *

### 5\. Record Sharing

-   Records can be shared directly with users or teams
-   Can extend access beyond role-based permissions

* * *

## Common Access Scenarios

### Scenario 1: User Cannot See a Record

Possible causes:

-   Business Unit restriction
-   No role-based read access
-   Not part of the owning team

* * *

### Scenario 2: User Can See but Cannot Edit

Possible causes:

-   Read-only permissions in role
-   Limited privilege scope

* * *

### Scenario 3: Different Access Between Users

Possible causes:

-   Different role combinations
-   Team membership differences
-   Record ownership differences

* * *

## How This Impacts Altus

Effective access determines:

-   Which projects and work items users can access
-   What actions users can perform (edit, approve, manage)
-   Visibility across portfolios and reporting
-   Governance and compliance enforcement

* * *

## Additional Reference

For detailed Microsoft guidance on how roles and permissions combine to determine access, refer to:  
[https://learn.microsoft.com/en-us/power-platform/admin/assign-security-roles](https://learn.microsoft.com/en-us/power-platform/admin/assign-security-roles)

* * *

## Key Considerations

-   Effective access is **cumulative across roles and teams**
-   Business Units define **visibility boundaries**
-   Teams and sharing can extend access beyond roles
-   The **Check Effective Rights** function is the most accurate way to validate access

* * *

## Tips

-   Always use **Check Effective Rights first** when troubleshooting access
-   Validate using real user scenarios where needed
-   Compare users to identify differences in configuration
-   Trace access back through:
-   -   Role → BU → Team → Ownership