How to access user role and permission information?

Question

We need to provide access to the following:

1. A list of all users, their status roles, permissions, and basic info (user name, email, business unit, etc.)
2. A list of all permissions
3. A list of all roles
4. Relation between roles and permissions
5. Relation between users and roles
6. Relation between users and roles (this is relevant due to custom permission options that are out of the scope of the role)

We can use REST API, SOAP API, AMPScript, or SQL quarry. Or whatever is suggested.

I was only able to access the AccountUser object using SOAP API. But it doesn't have all the info I need.

For instance in case of a custom permission I get this: Individual role for XXX Individual role for XXX Individual role for XXX>

Maybe some of the information can be found under PermissionSet object, but it is not retrievable.

Any idea how to gain access to the needed information?

Here are the sources I found related so far but was not enough to solve this conundrum:

1. https://developer.salesforce.com/docs/marketing/marketing-cloud/guide/accountuser.html
2. https://developer.salesforce.com/docs/marketing/marketing-cloud/guide/permissionset.html
3. https://developer.salesforce.com/docs/marketing/marketing-cloud/guide/supported_operations_for_objects_and_methods.html?fireglass_rsn=true.html#fireglass_params&tabid=ac297959fcac2f8e&application_server_address=firegtiep04.hq.corp.phoenix.co.il&popup=true&is_right_side_popup=false&start_with_session_counter=1
4. Retrieving User Details using SOAP API
5. Read AccountUser's assigned to BusinessUnit in Enterprise Account
6. User Permission Access Report
7. https://help.salesforce.com/s/articleView?id=sf.mc_overview_enterprise_user_permissions.htm&type=5

Edit

Following the commenters, I have tried to retrieve AccountUsers from the BusinessUnit Object using SSJS WSProxy. But no I'm getting an error: The Request Property(s) AccountUsers do not match with the fields of BusinessUnit retrieve

This corresponds to the described Object check I did, AccountUsers cannot be retrieved.

Note: This was executed using a cloud page on the top parent BU.

Retrieve code:

var prox = new Script.Util.WSProxy();

try {
    
    var soapObject = "BusinessUnit";
    var colsArr    = ["Name", "IsActive", "ParentName", "AccountUsers"];
    var res   = prox.retrieve(soapObject, colsArr);

    if (res.Status == "OK") {
        Write(Stringify(res));
    }else{
        Write("res.Status = "+ res.Status);
    }
} catch (error) {
    Write(Stringify(error));
}

Answer 1

I've built something similar to what you've described.

I went through all of @charliefay's material on this (and thank you). It didn't provide the custom roles -- as you've found.

I spent more than 2 months enduring lame SF Support responses and the crappy API documentation, but I finally figured out.

Here are a few hints:

• First, do not trust any of the documentation about what SOAP properties are available or retrievable. Do a DESCRIBE on each object using Postman, get all of the property names and do a RETRIEVE on all of them. Let the actual web service endpoint tell you which ones aren't actually retrievable. You'll be surprised at the disparity.
• The BusinessUnit.AccountUsers property from the parent BU is the most accurate source of AccountUser data that I found.
• Mirror the raw from the BusinessUnit and AccountUser SOAP objects into data separate extensions.
• Build an AccountUser_Roles data extension and fill it with Roles from BusinessUnit[x].AccountUsers[y].Roles[z]
• Permissions is a huge and ultimately meaningless data-set that is way to granular to try to audit or manage. I ended up just sticking to BusinessUnit, AccountUser and AccountUser_Roles.
• Write a SQL Query to join and/or denormalize the data into the desired output.

Hope this gets you on the right track.

EDIT

Here's a sample Describe for BusinessUnit:

<s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:a="http://schemas.xmlsoap.org/ws/2004/08/addressing" xmlns:u="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">
    <s:Header>
        <a:Action s:mustUnderstand="1">Create</a:Action>
        <a:To s:mustUnderstand="1">{{soapEndpoint}}</a:To>
        <fueloauth xmlns="http://exacttarget.com">{{accessToken}}</fueloauth>
    </s:Header>
    <s:Body xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema">
        <DefinitionRequestMsg xmlns="http://exacttarget.com/wsdl/partnerAPI">
            <DescribeRequests>
                <ObjectDefinitionRequest>
                    <ObjectType>BusinessUnit</ObjectType>
                </ObjectDefinitionRequest>
            </DescribeRequests>
        </DefinitionRequestMsg>
    </s:Body>
</s:Envelope>