Security set-up for users belonging to multiple teams/BUs

(0) Share

Report

Posted on by totoro84

Hi guys

I'm wondering what is the best way to set-up security for the below case.

My business operates in multiple countries. Let's say for example UK, Germany, and France.

In each country there are Clients, assigned to the country (1-to-n, one client belongs to a single country, one country has many clients).

There are multiple other records having 1-to-n relationship with a client (offers, opportunities, comments, etc.)

Then, there are Users, who can belong to one or more countries (n-to-n).

Then, a user needs to have a specific access to each of the records related to clients within the countries the user belongs to, e.g. one can only view clients and nothing else, other can view clients and create offers, other can view and edit everything etc.)

So for example

User A is assigned to France and has got a viewer access for clients and comments, so they can only read clients and comments related to the clients from France)

User B is assigned to UK and Germany and has got creator access for clients and offers, so they can create clients and offers related to the clients from UK and Germany (they should be able to specify which country the client should be assigned to when creating the client)

Initially I thought about using Business Units, each country being a BU, and when a user creates a client, the client is automatically tied to the country (BU) via owning BU. However, this won't work, since a user needs to be able to create clients assigned to various countries, and with BUs the country will always be assigned to the user's default BU.

Any ideas on how to solve this?

I know I can use filters in Power Apps and hide buttons based on currently logged in user's team association, however this doesn't seem like proper security. I would like to achieve this at dataverse level, so that when a user accesses dataverse via power query for example, they still can see only what they should see.

Categories:

Microsoft Dataverse with Power Apps

All responses (3)

Answers (1)

Sort by

Verified answer

ivan_apps 2,189 Moderator on at

Like
a
(1)

Report
Copy link

Link copied!

Business Units are basically containers of different users that may not necessarily need to share data. There is a new modern business units implementation that may work for your scenario, this video by Scott Durow explains it better than I can: https://www.youtube.com/watch?v=dVGklfmVr6s

Your use case may be better suited to teams or even record level access teams. Take a look at this doc article:
https://learn.microsoft.com/en-us/dynamics365/customerengagement/on-premises/developer/use-access-teams-owner-teams-collaborate-share-information?view=op-9-1

If you have very specific access criteria you can also use 'sharing' for records to limit the scope of who can see what. Know that GrantAccess can be fired from Power Automate so it can be easily managed versus code -
https://learn.microsoft.com/en-us/power-apps/developer/data-platform/security-sharing-assigning?tabs=sdk
totoro84 on at

Like
a
(1)

Report
Copy link

Link copied!

thank you, @ivan_apps

Looks like the GrantAccess way is the only option

I've found a nice topic on this:
https://powerusers.microsoft.com/t5/Microsoft-Dataverse/Sharing-records-with-a-set-of-users-automatically/td-p/1836062

So basically, for each country I create an Access Team.
Users are assigned to one or more access teams.

Additionally, I create security roles for each table involved - read clients, write clients, read offers, write offers, etc. These will be assigned directly to users.

Then I create an automated cloud flow that runs when a client is created and uses GrantAccess to give full (read, write and delete) access to the client's record to the access team indicated by the client's country. Individual user's access is therefore determined by a combination of their security role and access team membership.

(optionally) I may not want the records to be owned by users (the access should only rely on their access team membership), the creation of records (clients and other records) is performed by another flow from a service account's connection, so only the service account is the owner.

This seems totally crazy, I can't imagine large-scale projects running this way 😄
totoro84 on at

Like
a
(0)

Report
Copy link

Link copied!

and also - whenever a record is modified, I need to check if the country changed, in which case I need to revoke current access, and grant new one 🙂