Control Dataverse Data Access To System Administrator

(0) Share

Report

Posted on by khadija

Hi all,

May I know if there is any way to control custom entities access on System Administrator role in environment?

I've built Model Driven App for HR solution, and it contains a lot of sensitive data. Now, for all users I can control access with custom security roles, but for our system administrators, they are able to access all the Model Driven Apps and all the custom entities that contains sensitive data. I can't seem to remove the access of System Administrator on my MDA and custom entities, since it is the all-powerful profile.

Since all the data is owned by department users, is there a way to control and block the access to Dataverse on data level?

Appreciate your advice.

Categories:

Governance & administering

All responses (6)

Answers (1)

Sort by

Verified answer

ChrisPiasecki 6,428 Most Valuable Professional on at

Like
a
(1)

Report
Copy link

Link copied!

Hi @khadija,

The system administrator role has full access to the environment and this cannot be changed.

My recommendation is to limit administrative access to a small subset of individuals, and enable Auditing and Activity Logging for all of your sensitive tables/columns. You can view reports for activity logs in the M365 Security & Compliance center. You should make this part of your security modelling and processes to do regular security reviews.

There should also be capability in M365 to Automate alerts for security events, so I imagine you could monitor and alert when those system administrator accounts access certain tables /columns (I have not had a chance to explore these M365 security features in depth so I am a bit limited on knowledge in that area).

---
Please click Accept as Solution if my post answered your question. This will help others find solutions to similar questions. If you like my post and/or find it helpful, please consider giving it a Thumbs Up.
khadija 5 on at

Like
a
(0)

Report
Copy link

Link copied!

Hi @ChrisPiasecki ,

Many thanks for your advice. I suspected as much, as we definitely need 1 people that can modify the table or application, and we cannot ask HR user to do it themselves. Guess the option now is to implement a process of access governance based on the Auditing and Activity Logging feature.
pgsm007 15 on at

Like
a
(0)

Report
Copy link

Link copied!

@ChrisPiasecki, in my case, I'm not part of the IT department in my company. As such, they control the access that I have and I need to store data that nobody in the company, and even they cannot see. Do you know if asking them to create an environment for my team, putting me in the role of System Administrator of this environment would prevent them (and anyone else other than my team and I) from seeing this data ?
CU07120604-0 on at

Like
a
(0)

Report
Copy link

Link copied!

Hi @pgsm007 ,

Yes, You can ask your IT Team to create a separate Environment for your team, In which you have the System Administration Role. After that you can assign the role to your team members as per the requirement.

But remember one thing the person with these roles - Microsoft 365 Global Admin, Power Platform Admin, Dynamics 365 admin(If a security group is assigned to the environment and the user with this role added to the security group) in your tenant still see the data of your environment.

Thanks.
------------------------------------------------------------------------------------------------------------------------------
If you like my response, please give it a Thumbs Up.
pgsm007 15 on at

Like
a
(0)

Report
Copy link

Link copied!

@harshdeol73 Do you know if there is any way that could be done, a different data source maybe, or assign some kind of password ?
CU07120604-0 on at

Like
a
(0)

Report
Copy link

Link copied!

Hi @pgsm007 ,

I guess, There is no way to lock a global admin role.You can disable their permission or restrict access temporarily to the data from the environment, but they will always have the ability as a global admin to reset the permission.
Thanks.
------------------------------------------------------------------------------------------------------------------------------
If you like my response, please give it a Thumbs Up.