Core Security Concepts in Dataverse

 

Core Security Concepts in Dataverse

• Authentication:

  • Handled through Microsoft Entra ID (Azure AD).

  • Supports conditional access and multi‑factor authentication (MFA) for stronger identity protection.

• Authorization:

  • Controlled by security roles and privileges.

  • Roles define what actions a user can perform (read, write, delete, append).

  • Privileges can be applied at table, row, and column level for fine‑grained control.

• Business Units & Teams:

  • Dataverse allows grouping users into business units and teams.

  • Teams can share records, enabling collaboration while maintaining ownership boundaries.

🛡️ Security Layers

1. Environment Security

   • Environments act as security boundaries.

   • Access is controlled by environment roles (Admin, Maker).

2. Role‑Based Access Control (RBAC)

   • Assigns permissions based on organizational roles.

   • Ensures least privilege access principle.

3. Record‑Level Security

   • Users can access records they own or those shared with them.

   • Supports hierarchical access (e.g., managers can access subordinates’ records).

4. Field‑Level Security

   • Specific columns can be restricted.

   • Example: HR staff may see employee names but not salary fields.

5. Data Encryption

   • All data stored in Azure SQL Database is encrypted using Transparent Data Encryption (TDE).

   • Supports customer‑managed keys via Azure Key Vault for compliance.

6. Auditing & Compliance

   • Dataverse provides audit logs for record changes, user actions, and access attempts.

   • Helps meet internal and external compliance requirements.

📊 Example Security Role Breakdown

Role	Access Scope	Typical Use Case
System Administrator	Full access	IT admins managing environments
Environment Admin	Environment setup, DLP policies	Governance teams
Environment Maker	Create apps, flows, connections	Citizen developers
Custom Business Role	Limited table/record access	HR, Finance, Sales teams

⚠️ Risks & Best Practices

• Risk of Over‑Permissioning: Avoid giving System Admin role broadly; use least privilege.

• Scope Creep: Regularly review roles and privileges to prevent unauthorized access.

• Data Loss Prevention (DLP): Configure policies to block risky connectors and prevent data leakage.

• Audit Monitoring: Enable auditing to detect unusual activity.

• Segregation of Duties: Separate admin and user roles to reduce insider threats.

✅ Actionable Recommendations

• Use Entra ID conditional access for stronger authentication.

• Apply RBAC with field‑level security for sensitive data.

• Enable auditing and monitoring for compliance.

• Regularly review security roles and privileges to align with business changes.

• Implement DLP policies to control data movement across connectors.