Unanswered

Is there a relation between the business units hierarchy and the security roles

(0) Share

Report

Posted on by johnjohn123

3,514

Let say we have this business unit hierarchy, where we set Manager BU to have the its parent = root BU. and we defined Region-A & Region-B to have their parent BU = Managers:-

and we granted Region-A business unit team read and write on all the records owned by region-A and same applies to region-B.. then will users inside the Managers business unit have automatically access to Region-A and Region-B records? or we need to explicitly set this?

Categories:

Microsoft Dataverse with Power Apps

I have the same question (0)

All responses (11)

Answers (0)

Sort by

Drew Poggemann 9,287 Most Valuable Professional on at

Like (0)

Report
Copy link

Link copied!

Hi @johnjohn123 ,

You don't really need to have a Manager's business unit in place if you are doing this type of setup just for manager level security to work with records of their employees. Dataverse has hierarchical security built in that can tie to Manager hierarchy or Position hierarchy that you can utilize for an individual to view records for their subordinates.

https://learn.microsoft.com/en-us/power-platform/admin/hierarchy-security

Note: You will need to look at Modern business units for this setup as well if the manager has employees across two different business units.

Was this reply helpful? Yes No
johnjohn123 3,514 on at

Like (0)

Report
Copy link

Link copied!

@dpoggemann ok if i got your point correctly, you mean instead of defining parent BU for the Region-A and Region-B, i can simply add the Manager team to be assigned to the Region-A and Region-B BU using the modernized BU feature? is this what you mean? if this is the case, then under which BU the Manager team need to be defined?

Was this reply helpful? Yes No
Drew Poggemann 9,287 Most Valuable Professional on at

Like (0)

Report
Copy link

Link copied!

Hi @johnjohn123 ,

You don't need a Manager Team per se. You can have the Managers belong to the root business unit or they could even belong to the appropriate child business unit if "geography based" or the like. You utilize the management hierarchy and modern business unit structure to provide the ability for the managers to view their employee records across the business units.

Was this reply helpful? Yes No
johnjohn123 3,514 on at

Like (0)

Report
Copy link

Link copied!

@dpoggemann ok so you re saying that the users who are managers, do not need to have their own BU,, we can simply add them to the Region-A and Region-B BU's teams?? is this what you mean?

Was this reply helpful? Yes No
Drew Poggemann 9,287 Most Valuable Professional on at

Like (0)

Report
Copy link

Link copied!
Hi @johnjohn123 ,

See the following paragraph under this link that discusses this capability: https://learn.microsoft.com/en-us/power-platform/admin/hierarchy-security#manager-hierarchy

Note With the Manager hierarchy security model, a manager has access to the records owned by the user or by the team that a user is a member of, and to the records that are directly shared with the user or the team that a user is a member of. When a record is shared by a user who is outside of the management chain to a direct report user with Read-only access, the direct report's manager only has Read-only access to the shared record. When you enabled the Record ownership across business units, manager can have direct reports from different business units. You can use the following environment database settings to remove the business unit restriction. ManagersMustBeInSameOrParentBusinessUnitAsReports default = false You can set it to true, and the manager's business unit does not need to be the same as the direct report's business unit. In addition to the Manager hierarchy security model, a manager must have at least the user level Read privilege on a table, to see the reports’ data. For example, if a manager doesn’t have the Read access to the Case table, the manager won’t be able to see the cases that their reports have access to. In order for the manager to see all the direct report's records, the direct report user must have an 'enabled' user status. The manager will not be able to see 'disabled' user's records.

Was this reply helpful? Yes No
johnjohn123 3,514 on at

Like (0)

Report
Copy link

Link copied!

@dpoggemann i am getting lost, so if the Managers does not have their own BU or Team, then who we can determine that a user is actually a mamager?

Was this reply helpful? Yes No
Drew Poggemann 9,287 Most Valuable Professional on at

Like (1)

Report
Copy link

Link copied!

Hi @johnjohn123 ,

It will utilize the management hierarchy in Azure AD. The Manager field will be populated if it is populated in Azure AD on the User table in Dataverse and then this will be utilized to track multiple levels of management.

Was this reply helpful? Yes No
johnjohn123 3,514 on at

Like (0)

Report
Copy link

Link copied!

@dpoggemann so you mean in dataverse the manager in AD is understandable and will be taken into consideration? i attended many training courses never heard of such a thing, i mean dataverse consider a user as a manager based on the BU hierarchy inside data-verse and not the manager hierarchy inside AD.. not sure if i am correct? or dataverse works differently ?

Was this reply helpful? Yes No
Drew Poggemann 9,287 Most Valuable Professional on at

Like (0)

Report
Copy link

Link copied!

Hi @johnjohn123 ,

If you enable hierarchical security then yes, it will utilize the manager setup in Azure AD that is mapped to the manager field in Dataverse. The BU hierarchy is different than a Manager setup, this is used for overall security of records at the User, BU, BU child, Organization levels. This has nothing to do with Management or Position hierarchy. To utilize this you need to utilize the Hierarchical security.

Was this reply helpful? Yes No
johnjohn123 3,514 on at

Like (0)

Report
Copy link

Link copied!

@dpoggemann ok thanks again for you detailed reply. but can you provide a simple example of when to use hierarchical security?

Was this reply helpful? Yes No