Help with row level security model

[absoluteBeginer]

I am looking for the best way to implement security/data access on my Dataverse table. My scenario is as follows.

Table: Run (Columns : Job No, Run No, Name, Raw data, Last Correction

RTOC user type:

                read       Job No, Run No, Name, Raw data, Last Correction

                write      Job No, Run No, Name, Last Correction

 *for certain records*

MWD User type :

                read       Job No, Run No, Name, Raw data, Last Correction

                write     Col Raw data

 *for certain records*

Field User type:

                read       Job No, Run No, Name, Raw data, Last Correction

RTOC users can only access certain data from the table. More than 1 RTOC user can access the same record, but they need to be in the same group.  RTOC user creates record - assigns access (according to user type) to that record to certain MWD and Field users. At the same time other RTOC users that are in the same group as this RTOC user have the same level of access as that user.  A MWD or Field user can only access 1 Run record at a time. When the job is finished, the access is removed from the user.

RTOC1 and RTOC2 can only access records 1, 2 and 3.

MWD1 can only access record 1

Field 1 can only access record 1

MWD2 can only access record 3

RTOC3 can only access record 4.

MWD3 can only access record 4

So I need to dynamically assign different access to certain records to different users.

I was wondering whether you could model this scenario just using business units - or if there is a better way.

Thanks

[EricRegnier]

Hi @absoluteBeginer,
If I understand your security requirements, there are several security concepts/capabilities you'll need to leverage to satisfy the requirements. Here's are my quick answers and links for further info:

• For Group 1 and Group 2, yes business units (BUs) to segregated the data for RTOC users only can access will work. Have MWD and Field users in another business unit. Another option is to have one BU and all roles set at the user-level instead. So users will only access records they or their teams own. 
• Use Access Teams for MWD and Field users. Access teams are meant for access to specified records managed individually: https://learn.microsoft.com/power-apps/developer/data-platform/use-access-teams-owner-teams-collabor... 
• For access to specific columns/fields are a table, use Field Level Security profiles: https://learn.microsoft.com/power-platform/admin/field-level-security 

 Hope this helps!

[dpoggemann]

Hi @absoluteBeginer 

Overall you have a pretty complicated security model here.  @EricRegnier did a great job articulating many of the key areas you will need to dig into here.  I would suggest keeping all in the same business unit as mentioned in Eric's "Another option..." or I think you will run into challenges.

Access Teams will give you the ability to assign users with specific access team templates to each row in the Run table.  Note you can utilize Workflow and Power Automate to automate the assignment of users to the Access Teams if you have business rules on who gets assigned based on the groups etc.

The field security profiles will give you the ability to control field level security but it is not "record per record" but overall for the table.  This means the user will not have the ability to write to the Raw Data field on some records and not others, just wanted to make you aware of this.

With all this said...  I would really determine if the security environment you are putting in place here is really required?  You might look at enabling auditing of records and reducing the need for the security controls.   Just my 2 cents as many times I am involved in complex projects like this around security and then everything changes because it is too hard to manage and the business needs change 😁.  

[absoluteBeginer]

Thank you for your replies. Can access teams be created on the fly?

For example, a job is created and an access team created just for that job? Then users assigned to that access team. When the job is done, the access team can be deleted (though the RTOC users should still be able to access the job data).

@dpoggemann you also mentioned auditing of records to reduce the need for security controls. Can you expand on that? Anything to make things simpler is always a good idea.

I have also tied with the idea of using filtering to restrict data access within my apps - but then of course users could (but why would they) go directly to the Dataverse table and be able to look at/change data that they perhaps shouldn't. An extra consideration is that while RTOC and MWD users are all within the organisation, then Field users could be either within it or not.

[dpoggemann]

Hi @absoluteBeginer ,

Access Team Templates are created in advance and identity the security permissions for the template tied to a specific table and then you can assign these templates to the records on the fly therefore creating the access team for the specific record.  So the access team would be specific to a job.   Think of this as a list of users that are assigned the access team template for a specific Job, a little different from static Owner Teams or teams you would think of otherwise.

You could remove the members from the Access Team when the job is done through Power Automate, yes.  https://www.mibar.net/blog/how-to-add-users-to-an-access-team-with-power-automate/#:~:text=To%20use%.... 

Here is a quick video on auditing and how to setup:  https://youtu.be/OX5rpRA1ofQ 

[absoluteBeginer]

Could I do something like this.

Have 1 business unit in which all users belong to.

When an RTOC user creates a run, they do the following

1. Create an access team for the run

2. Assign users to that access team

3. These users are given specific security roles which determine what they can do with the record (Field users just read, MWD read + write for specific field, RTOC read and write access)

4. Run is created and ownership is set to the access team just created

5. When run is closed ownership of the run passes to another team (archive team) and the team created in 1 is deleted

so users will only get access to certain records and what they can do with that record is determined by the security role they have been given.

All of the above is driven/done through a canvas app and power automate.

[dpoggemann]

Hi @absoluteBeginer ,

#3 is actually covered by assigning them to the appropriate Access Team Template

#5 this is where it is not exactly a "team" but a list of users that are assigned to the Access Team Template.  You could remove these when the record's ownership changes or status or whatever trigger is applicable.

[absoluteBeginer]

Hi,

Would I be creating a system managed access team? I have created a access template and followed the steps in

Create a team template and add to an entity form - Power Platform | Microsoft Learn

The only thing I'm not sure of is how I can specify users to add to the team in my canvas app when I'm creating the record in my edit form.

Thanks

[EricRegnier]

Hi @absoluteBeginer, that would depend on your logic for MWD and Field users. If it's adhoc than the user owning or managing the record will need to add manually the MWDor Field users. IF there's some kind of pattern or logic, for example based on the user's job title then this is something that you can automate in your flow. Cheers

[absoluteBeginer]

The person creating the run will need to select a number of users (maybe different for different runs). It does not necessarily depend on any characteristic of the user (e.g. job title). So will the creator need to select users and add them to what exactly? I'm a little confused.

Thanks