Business Unit access for managers

[Julien2]

Hello,

I have the following security requirements that I need to implement in our module.

I created a Business Unit called "IT Department" that has 4 users as follows:

1. User 1: Is a director and has an admin role assigned and he will be able to see all the Team data under this BU. (Business Unit level access)
2. User 2: Is a manager under the director (User 1) and he should not able to see User 1 data as he will be able only to see User 3 & User 4.
3. User 3 and User 4 should only see their own data.

I am still stuck on how can I restrict access for User 2 to not see User 1 data and allow him to see the normal team members' data? (User 3 and User 4)

If I created a custom security role for User 2 and gave him everything at the BU level then he will be able to see User 1's data again.

Note: User 1 cannot be assigned to have access to the Organization level only the BU that he belongs to.

Could you please advise what will be the solution to the above requirements?
I would greatly appreciate it if you could provide an example.

Best regards,

EBMRay

[gowrihalan04]

Hi,

How about you share the records that are created by user2 and user3 via plugin.

Your scenario might not be achievable via security roles even if you create separate team. you can control privileges  only by user level or business unit level. So you can try Sharing approach through which you can control the access as well (read,right,delete). If the number of entity is very limited then you can register a plugin on create event and just share the record to user2. You can control the user details via configuration entity.

https://learn.microsoft.com/en-us/previous-versions/dynamicscrm-2016/developers-guide/hh547423(v=crm... 

[EricRegnier]

Hi @Julien2,

You should be easily able to achieve this with hierarchy security. For more info: https://learn.microsoft.com/power-platform/admin/hierarchy-security 
I would suggest to try to avoid plugins and sharing. Sharing can have performance implications and is typically meant for temporarely access or handle adhoc scenarios. 

Hope this helps!

[Julien2]

Hello  

I think the manager Hierarchy will satisfy my requirements, and as soon as I have some free time I will give it a try and report back.

I will not proceed with the option to go for plugins and sharing.

Thank you,
Julien

@EricRegnier

[Julien2]

Hello  

I think the manager Hierarchy will satisfy my requirements, and as soon as I have some free time I will give it a try and report back.

I will not proceed with the option to go for plugins and sharing.

Thank you,
Julien

@EricRegnier