Is there a relation between the business units hierarchy and the security roles

[johnjohn123]

Let say we have this business unit hierarchy, where we set Manager BU to have the its parent = root BU. and we defined Region-A & Region-B to have their parent BU = Managers:-

and we granted Region-A business unit team read and write on all the records owned by region-A and same applies to region-B.. then will users inside the Managers business unit have automatically access to Region-A and Region-B records? or we need to explicitly set this?

[dpoggemann]

Hi @johnjohn123 ,

You don't really need to have a Manager's business unit in place if you are doing this type of setup just for manager level security to work with records of their employees.  Dataverse has hierarchical security built in that can tie to Manager hierarchy or Position hierarchy that you can utilize for an individual to view records for their subordinates.

https://learn.microsoft.com/en-us/power-platform/admin/hierarchy-security 

Note: You will need to look at Modern business units for this setup as well if the manager has employees across two different business units.

[johnjohn123]

@dpoggemann ok if i got your point correctly, you mean instead of defining parent BU for the Region-A and Region-B, i can simply add the Manager team to be assigned to the Region-A and Region-B BU using the modernized BU feature? is this what you mean? if this is the case, then under which BU the Manager team need to be defined?

[dpoggemann]

Hi @johnjohn123 ,

You don't need a Manager Team per se.  You can have the Managers belong to the root business unit or they could even belong to the appropriate child business unit if "geography based" or the like.  You utilize the management hierarchy and modern business unit structure to provide the ability for the managers to view their employee records across the business units.

[johnjohn123]

@dpoggemann ok so you re saying that the users who are managers, do not need to have their own BU,, we can simply add them to the Region-A and Region-B BU's teams?? is this what you mean?

[dpoggemann]

Hi @johnjohn123 ,

See the following paragraph under this link that discusses this capability:   https://learn.microsoft.com/en-us/power-platform/admin/hierarchy-security#manager-hierarchy

Note

With the Manager hierarchy security model, a manager has access to the records owned by the user or by the team that a user is a member of, and to the records that are directly shared with the user or the team that a user is a member of. When a record is shared by a user who is outside of the management chain to a direct report user with Read-only access, the direct report's manager only has Read-only access to the shared record.

When you enabled the Record ownership across business units, manager can have direct reports from different business units. You can use the following environment database settings to remove the business unit restriction.

ManagersMustBeInSameOrParentBusinessUnitAsReports

default = false

You can set it to true, and the manager's business unit does not need to be the same as the direct report's business unit.

In addition to the Manager hierarchy security model, a manager must have at least the user level Read privilege on a table, to see the reports’ data. For example, if a manager doesn’t have the Read access to the Case table, the manager won’t be able to see the cases that their reports have access to.

In order for the manager to see all the direct report's records, the direct report user must have an 'enabled' user status. The manager will not be able to see 'disabled' user's records.

[johnjohn123]

@dpoggemann i am getting lost, so if the Managers does not have their own BU or Team, then who we can determine that a user is actually a mamager?

[dpoggemann]

Hi @johnjohn123 ,

It will utilize the management hierarchy in Azure AD.  The Manager field will be populated if it is populated in Azure AD on the User table in Dataverse and then this will be utilized to track multiple levels of management.    

[johnjohn123]

@dpoggemann so you mean in dataverse the manager in AD is understandable and will be taken into consideration? i attended many training courses never heard of such a thing, i mean dataverse consider a user as a manager based on the BU hierarchy inside data-verse and not the manager hierarchy inside AD.. not sure if i am correct? or dataverse works differently ?

[dpoggemann]

Hi @johnjohn123 ,

If you enable hierarchical security then yes, it will utilize the manager setup in Azure AD that is mapped to the manager field in Dataverse.  The BU hierarchy is different than a Manager setup, this is used for overall security of records at the User, BU, BU child, Organization levels.  This has nothing to do with Management or Position hierarchy.  To utilize this you need to utilize the Hierarchical security.