Assure Row Level Secuity in Dataverse

[WebPortal]

Hello,

I'm sharing an app with users of multiple departments: A, B, C.

What's the best way to assure security?

I assume Business Units assigned to roles A, B, C would be the way to go, since it seems that Dataverse is adding a BusinessUnit column to each record of every table.

But, is it also required (or recommended) to assure the security logic from the Power Fx perspective? For example, by using Filters when accessing the data sources?

Or shall Teams be used or anything else?

Thanks for helping!

[Robu1]

Hi @WebPortal ,

Here are some approaches to assure security include role based access and filters. Using Microsoft Dataverse teams is optional. However, teams provide an easy way to share business objects and let you collaborate with other people across business units. Although a team belongs to one business unit, it can include users from other business units. You can associate a user with more than one team.

Protecting data with Dataverse | Microsoft Power Apps

Security concepts in Microsoft Dataverse - Power Platform | Microsoft Learn

Teams in Dataverse - Power Platform | Microsoft Learn

If this post helps, then Click on the Thumbs Up below and Accept it as the solution to help others.

Thanks,

Robu1.

[dpoggemann]

Hi @WebPortal 

Key areas of security focus in Dataverse / Power Apps you should be aware of...

1. Business Units - Yes, this can be used if needed but most of the time in my projects I have a single business unit for the customer.  Business Units are a way to separate data for different business units / departments where you want to control access to the tables at the business unit level.  Again, most customers I work with we usually have a single business unit
2. Role Based Security - This is probably the primary way to control security within Dataverse.  You can identify multiple security access to the records (create, read, write, delete, share, append, append to, assign).  This is the area I would spend the most time researching as it is the most common to control access to records.  You can have ownership of records in Dataverse at User or Owner Team level for the records.
3. Access Teams - This is less common and can be used to assign ownership of records to a User or Team and be able to have an Access Team that can assign additional users to a specific record in the Access Team.  This is a way to have teams of users that can be different by record.
4. Field Level Security - You can control field level access for specific fields on a table (example an SSN or something) to only users in a specific Field Security Profile.
5. Hierarchical Security - You can have multi-level security so Managers can see their team member's records multi-levels deep.  The security can be hierarchical (manager --> employee) in direct reporting relationship or by Position where Directors may see all Manager records and Managers can see all employees (outside of direct reporting relationship).

Do not use filtering as a "Security" mechanism as it can easily be broken through APIs and much more.  This should only be for usability and filtering of data, not security controls.

[WebPortal]

@Roband @Robu1 

Thanks for helping out, this is a complex topic.

Would you recommend BU if users belong to different companies?

[dpoggemann]

hi @WebPortal ,

If they do, yes, I would usually recommend this as they are really working through different entities, etc.  Also, if they are really independent companies, another option would be completely different environments as well.  This will allow you to extend / customize completely different in the two environments if their business processes are completely different.

[Robu1]

Yes it is a complex topic and there are a lot of things to consider based on your requirements. I would recommend Business Units.

Do check this resource out: 

https://powerusers.microsoft.com/t5/Microsoft-Dataverse/Help-with-row-level-security-model/td-p/1952....