Security Groups for a Project Table in Dataverse

[JasonSealy]

Hello!

I am creating a database and I am not sure how I should design the data to manage security. I don't know much about the details of Dataverse so I am going to explain it on a high level. I would also prefer if the solution could be done using just Dataverse/Power Apps to reduce complexity but if there is a much easier way with a plugin I would be happy to hear, thanks.

Here is the challenge:

I want a Project table that will have projects that are in the stages {opportunity, proposal, in-design, completed}.

I want to create security groups such as "Owner", "Manager", "Worker" , etc. 

The Project table will have column names such as projectID, deadline date, client phone number, etc.

The database admin should be able to assign permissions based on the columns and the project stage.

An example would be:

Owner can see all stages and column names.

Worker can see only some of the project stages and only some of the column names.

So far I have 2 options to take:

Option 1: I thought maybe I could create views for each table and then assign groups to the views but it doesn't seem like that is a possibility without 3rd party plugins.

Option 2: My other thought was to create different tables based on the project stage and reference the projectID. Then just assign groups to to the project stages they need, and the columns within the table they need. This second option sounds like more work to maintain but maybe it is better practice, I am not entirely sure.

It would be great hear some advice,

Thanks in advance, all the best!

Jason

[GuidoPreite · Accepted solution]

you got a requirement that is not complex but the options you have inside Dataverse are limited for your scenario.

I know Dataverse is not perfect and probably you got assigned to this task with "you need to use Dataverse", so I tell you some key points about security and after you can try to find out a solution to your scenario.

First thing is that you can assign security roles to a user or a team, this security role block or allow the entire record access. I do an example: You have two accounts, one owned by Bob one by Charlie. Let's imagine you are Bob, if your security role says: you can access all the accounts, you can see both accounts, if your security role says: you can access only your own accounts, you can see the account owned by you (Bob) but not the one owned by Charlie.

The second thing is Field Level Security. You can decide for each column if there is a permission on who can see the value of that record or not.

Let's say inside the account there is a phone number field. With Field Level Security you can say: only Administrator team can see the value, if you (Bob) you are not inside this team, you can still open the record but the phone number field will appear as ***.

Keep in mind that assign security roles is something done at administration level, it is possible to create some logic to dynamically assign security roles but is a path I don't recommend to do, especially if you are starting with Dataverse.

I hope what I wrote can help you to think about the scenario you have.

[JasonSealy]

Thank you, I think I will try to have team security roles and then have column level security based on the team security roles. Thanks again!