Hey! Whenever a user is added to Dynamics, they’re added to a Business unit and a team associated to that BU. If the Team associated to the BU has a Security role, the user inherits the security role. This is one possibility. Another possibility is that you have a plugin/workflow assigning/updating the security roles. Also, there’s a setting that if enabled, it can generate security roles to be automatically assigned depending on user license. This is documented on docs.microsoft.com/…/assign-security-roles Finally, if you still have some doubts for this particular user, you should definitively open a support request to Microsoft with this concern