Now that all of our data is in the Dataverse and validated, it's time to talk security. The Dataverse offers robust tools for securing your data, but understanding how to effectively use these tools is key. In this article, we'll explore the essential security measures and best practices for safeguarding your data in Dataverse.
Understanding Dataverse Security
At its core, the Dataverse security model is designed to provide granular control over access to data. It's based on a combination of business units, roles, and record-level security, enabling admins to define precisely who can see and modify data.
Business Units: These are organizational containers within Dataverse, allowing for data segmentation across different areas of your organization.
Security Roles: Roles define permissions on various data operations like create, read, write, delete, and share. These roles can be assigned at different levels - organizational, business unit, or user.
Record-Level Security: This involves applying security at the individual record level, ensuring that only authorized users have access to specific data records.
Implementing Role-Based Security
Implementing role-based security involves creating security roles and assigning them to users or teams. Each role encompasses a set of privileges and access levels to different entities in Dataverse. Here's how to set it up:
Create Security Roles I recommend adding custom security roles to your solution. While in your solution, select New > Security > Security role
This will take you to the classic configuration editor. Give your role a name
Then notice all of the tabs across the top. This is how the different tables and features are partitioned. Click on the Custom entities tab to find your custom table(s).
Dataverse provides detailed security permissions that allow administrators to fine-tune access control at a very granular level. These permissions include:
Create: Determines whether a user can create new records in an entity.
Read: Controls the ability to view records in an entity.
Write: Allows users to make changes to existing records.
Delete: Gives the authority to remove records from an entity.
Append: Enables a user to associate records with another entity.
Append To: Allows a user to be the target of an append operation, essentially deciding which entities can be linked to.
Assign: Controls the ability to assign ownership of a record to another user.
Share: Permits users to share records with other users or teams.
These permissions are further refined by access levels such as None (default), User (only my records), Business Unit (only records owned by my business unit), Parent: Child Business Unit (my business unit and all business units underneath it), and Organization (all records), which define the scope within which the user can exercise these permissions.
For instance, a user with "Read" permission at the "Business Unit" level can view all records in their business unit, but not in other business units.
While setting these up, note that clicking the table name will increment the scope for all permissions
and hovering over an indicator will tell you what you're selecting (since the header for the permissions goes away as you scroll)
You can do this for both custom and standard tables as well as other miscellaneous permissions
Once you've made all your necessary selections click Save and close.
There is a lot of granularity here, but don't get overwhelmed. As mentioned before, coming from SharePoint a lot of these options were not available. You may be able to simply give users read/write permissions to all the data for launch and tighten that down as you have time to work in this new system.
However, I would highly recommend getting familiar with this now and making permissions more strict so that as time goes on you have rigid security and can relax it as needed.
Assign Roles
There are many roles available out of the box. To assign those to users, navigate to make.powerapps.com, click the gear icon in the top right, and click Advanced settings
Then, expand the settings pane and click Security under System
Select Users
Select a user record and click Manage roles
This opens a pop-up with all the active security roles available to users. You may give or take away any roles here on the individual user level. Once done, there is no need to click save as roles are applied after clicking Ok in the pop-up.
Regular Audits: I recommend periodically reviewing and adjusting roles and assignments to accommodate changes in your organization or in data access policies.
Leveraging Record-Level Security
For finer control, Dataverse allows administrators to set up record-level security. This includes:
Ownership: Records can be owned by users or teams, with access defined based on ownership.
Sharing: Users with appropriate permissions can share records with others, providing flexible and controlled access.
Access Teams: Create dynamic teams for specific records, allowing for temporary, flexible access control without changing the broader security architecture.
Advanced Security with Field-Level Security
Field-level security in Dataverse enables administrators to restrict access to specific fields within an entity. This is crucial for protecting sensitive information like personal identification numbers or financial details. To implement this:
Define Field Security Profiles: Create profiles that specify read, write, and update permissions on specific fields.
Assign to Users/Teams: Apply these profiles to appropriate users or teams to ensure that sensitive data is only visible to authorized personnel.
To create a field (or column) level security profile, go back to the Security section in Advanced settings and select Field Security Profiles.
Then select New
Give your profile a name and click Save
Then, under the Members section, select the Teams or Users you'd like this profile to apply to.
(note that you must click Select after selecting the Teams/Users/ you'd like to add)
Then, finally, select the Field Permissions section. Select the column you want to assign permissions to, then click Edit.
(If you do not see the column you want to assign a profile to, make sure the column is configured for column-level security in the column's Advanced settings)
Select what permissions you'd like this profile to assign to the Teams/Users you selected and click Ok
Your column is now secured!
Best Practices for Dataverse Security
Least Privilege Principle: Always assign the minimum necessary level of access to users.
Regular Security Training: Ensure your team is aware of security protocols and the importance of data protection.
Audit and Monitor: Regularly audit security settings and monitor access logs to identify and respond to any unauthorized access attempts.
Data Classification: Classify your data based on sensitivity and regulate access accordingly.
Compliance Checks: Regularly review your security setup to ensure compliance with industry standards and regulations.
Securing your data in Dataverse requires a careful balance of role-based security, record-level controls, and field-level restrictions, underpinned by a culture of security awareness. By implementing these strategies and adhering to best practices, you can ensure that your Dataverse environment is not only powerful and flexible but also secure and compliant.