Logic Composer

Preconditions

Control who can run a logic block or logic flow and under which conditions it may run.

A precondition protects a logic block or logic flow at its own front door. It says who can run it and when it may run, and it is checked on every run, however the logic is called: from a recipe, another flow, a business process, the Run dialog, a Dataverse action or an AI agent through MCP. Put a rule here once instead of repeating the same check in every caller.

Leave the Precondition tab empty and anyone can run the logic at any time.

Add a precondition

Open the logic block or logic flow and select the Precondition tab.
Under Who can run, select Add rule and choose a rule. Who can run holds one rule.
To check more than one thing, choose All of (every rule must pass) or Any of (one is enough) as the rule, then use its own Add rule to add the rules inside it.
Under Run only when, build a Yes/No Condition over the inputs, the data and the current user.
Under If not, fail with, enter an Error code and Error message for when the condition is not met.
Save the form.

Who can run

Checked for the user running the logic, before any data is read. With no rules the tab reads “Anyone can run it.”

Rule	Settings	Passes when
Has security role	Security role; Include roles the user has through a team	The user has this security role.
In team	Team	The user is a member of this team.
In Entra group	Entra group object ID (a GUID); Name (shown in the designer)	The user is in this Entra group, through its Dataverse group team.
Has permission	Can: Create, Read, Write, Delete, Append, Append To, Assign or Share; Table	The user can do this on the table, through any of their security roles.
In business unit	Business unit; Include child business units	The user belongs to this business unit.
Queue member	Queue	The user is a member of this queue.
All of	A group of the rules above	Every rule in the group passes.
Any of	A group of the rules above	At least one rule in the group passes.

Groups go one level deep: a group holds rules, not other groups. To change a rule, pick another kind in its Rule box; switching between All of and Any of keeps the rules inside.

Dataverse (cloud)In Entra groupApplies to the other edition

In Entra group is available only in Dataverse. Dataverse learns about a user’s group membership through the group team when the user accesses the environment, so a change in Entra is not seen immediately.

Dynamics 365 CE on-premisesHas permissionApplies to the other edition

On-premises the Has permission rule asks for an Entity instead of a Table. In Entra group is not offered.

Run only when

A Yes/No condition over the inputs, the data and the current user, checked after the data on the Data tab is read. Use it for business rules that depend on values, such as “the quote is still a draft” or “the amount is within the user’s approval limit”. You build it in the expression editor like any other condition.

If the condition is No, the run fails with the Error code and Error message you entered under If not, fail with.

How it behaves

Who can run rules are checked first, for the Dataverse user who runs the logic, before any data is read.
The inputs and data are loaded.
The Run only when condition is checked.
Only then does the logic itself run.

What failed	Default error code	Default message
Who can run	`UNAUTHORIZED_ACCESS`	The user is not authorized to run this logic.
Run only when	`CONDITION_VIOLATION`	The logic’s precondition is not satisfied.

Your own Error code and Error message replace the defaults for Run only when.

A failed precondition on a logic block cancels the run with “CODE: message”.
A failed precondition on a logic flow returns an application error, the same way a Raise Error step does. Callers can handle it as described in Error handling.
Nested logic is checked too. If a flow calls a block that the user may not run, the block’s precondition fails inside the flow.
The Run dialog runs as you, so you see exactly what a user with your roles would see.

Example

The Approve Discount flow may only be run by sales managers, and only for quotes that are still drafts.

Who can run: Has security role = Sales Manager, with Include roles the user has through a team on.
Data: the quote, read with Add Entity from the QuoteId input.
Run only when: Quote.statecode = Draft
If not, fail with: Error code QUOTE_NOT_DRAFT, Error message Only draft quotes can be approved.

A salesperson who triggers the flow gets UNAUTHORIZED_ACCESS. A sales manager who triggers it on an active quote gets QUOTE_NOT_DRAFT: Only draft quotes can be approved.