Difference in response from RetrievePrincipalAccessRequest & RetrieveSharedPrincipalsAndAccessRequest (CRM 2013 SP1 UR1 on-premise)

Question

Hi all,
I've been fighting this for 2 days now. I'm trying to check if an account is already shared with a team before modifying or granting the access. I noticed at first that when I shared, and then checked at the next run, Sharing and Assign privs where not returned
by RetrievePrincipalAccessRequest. So I mitigated this by not checking for those two.
However for some of my accounts, an already shared record (verified in the UI) is returning "None" when retrieved using RetrievePrincipalAccessRequest but the full set when listed using RetrieveSharedPrincipalsAndAccessRequest. I created the code
below to verify this - the output from this run is:
team 4b7ec141-81f3-e211-940a-00155deab80e
ReadAccess, WriteAccess, AppendAccess, AppendToAccess, ShareAccess, AssignAccess
None
team 4d7ec141-81f3-e211-940a-00155deab80e
ReadAccess, WriteAccess, AppendAccess, AppendToAccess, ShareAccess, AssignAccess
ReadAccess, WriteAccess, AppendAccess, AppendToAccess, ShareAccess, AssignAccess
Is there anybody that can offer an explanation on this behaviour? Retrieving the full list does seem like a waste of ressources but I guess that is what I will have to do for now.
Thank's
Nicolai
EntityReference targetref = new EntityReference("account", new Guid("a2a56119-0501-e311-940e-00155deab80e"));
RetrieveSharedPrincipalsAndAccessRequest req = new RetrieveSharedPrincipalsAndAccessRequest()
Target = targetref
RetrieveSharedPrincipalsAndAccessResponse resp = (RetrieveSharedPrincipalsAndAccessResponse)_orgService.Execute(req);
foreach (PrincipalAccess pa in resp.PrincipalAccesses)
Console.WriteLine(pa.Principal.LogicalName + " " + pa.Principal.Id);
Console.WriteLine(pa.AccessMask.ToString());
RetrievePrincipalAccessRequest req2 = new RetrievePrincipalAccessRequest()
Principal = pa.Principal,
Target = req.Target
RetrievePrincipalAccessResponse resp2 = (RetrievePrincipalAccessResponse)_orgService.Execute(req2);
Console.WriteLine(resp2.AccessRights.ToString());
Console.WriteLine("------------------------------------------------------------------------");
-- Please vote as helpful / mark as answer where appropriate ;)

Answer 1

Hi Chris, thank's for getting back to me.
I needed to check that all the rights where the same as the requested, and if not replace them.
What I found was that quering for the specific team for a specific target (RetrievePrincipalAccessRequest )
gave me sometimes "None" other times "ReadAccess, WriteAccess, AppendAccess, AppendToAccess" when infact the team also had "ShareAccess, AssignAccess" in addition.
But requesting the entire set of princiaps and rights (RetrieveSharedPrincipalsAndAccessRequest) gave me all the info.
I do not believe the performance impact is so huge here since most targets are shared with max 3 principals, so I have implemtented it using
RetrieveSharedPrincipalsAndAccessRequest now.
Did this make the issue more clear? For the benefit of other users that may run into this problem, I would still like to find out what happened.
-- Please vote as helpful / mark as answer where appropriate ;)