How to restrict access to records based on the field values in the records?

[timl]

I have a requirement to restrict access to Dataverse records based on the field values in the records. Could someone advise the best approach for this?

The use case scenario is that I have a table of participants for an event, managed by a school/college. This table stores the personal details of people, including a date of birth.

To comply with data protection and safeguarding rules, the requirement is that only teachers/employees with correct vetting should be able to access records in the table that pertain to people that are less than 18 years of age. All app users in the organisation must be able to access records in the table that relate to adults who are 18 years or older.

My initial thought is to set up a child business unit for app users with restricted access. The users with full access would belong to the parent business unit. Whenever an app user adds or edits a record, I would run a Power Automate flow to modify the owner of the record to an arbitrary user in the appropriate business unit. I would also run a daily flow to modify the owner of records where the participant reaches 18 years of age. Alternatively, I could apply the same methodology, but using a teams structure instead.

The thing that concerns me is the level of automation that this would involve. Am I completely missing an obvious or more easy approach to do this? Is there a way to do this without calling flows, or could someone suggest alternate strategies to fulfil this requirement? Many thanks!

[dpoggemann · Accepted solution]

Hi @timl ,

You aren't completely missing anything.  There is not a simple approach that I know of here to accomplish this.  I would actually go down the same path you are on and maybe investigate Access Teams as well but since this is a hard requirement I would lean to the business unit approach personally.

Hope this helps.  Please accept if this answers your question or Like if helps in any way.

Thanks,

Drew

[rampprakash · Accepted solution]

Hi @timl,

Please try using PLUGIN to achieve this,

When a Page gets loaded (Home Page Grid) system will trigger Retrieve Multiple Message, so we can use this message to show the records based on your requirement.

Link for your reference https://carldesouza.com/dynamics-365-retrievemultiple-plugin/

[timl]

@dpoggemann - Thanks for verifying that this isn't a simple requirment and that you would agree with the Business Unit/Flow method.

Thanks also @rampprakash for suggesting the plugin approach which would also be viable.

I'll see if anyone else has any further suggestions and I'll mark your posts as answers.

[Prakash4691 · Accepted solution]

Hi @timl ,

I prefer OOB using business unit. Since, it involves restricting access depends on field value my suggestion would be,

Create two custom owner teams, one for age below 18 years another for above 18 years. Add teams members to the respective teams.

Using update/create plugin, change owner of the field to the respective team.

Regards,

Prakash

[timl]

Thanks everyone for your input

@Prakash4691 - yes, that's a good point about using plugins to change the ownership, which will reduce the number of Flow runs.

[felipeabajo]

Very interesting scenario. I am facing something similar regarding tasks of projects, in which the records should only be seen by the project manager and the user assigned to the task (consultants). 

I am thinking of creating a different application for consultants and creating a custom page for them. Any feedback about this approach? 

Thanks,

Regards