Manage Dynamics 365 model-driven app settings and security

Introduction

 Proper controls on access to data are a vital part of any business. When you understand the security architecture of Dynamics 365 model-driven applications, you can more easily customize security to fit the requirements of your business.

Security in Dynamics 365 is based on security roles, which are created within business units.

A Business unit is all or part of an organization.

A security role is a collection of privileges and access levels defined by entity.

Privileges allow users in a role to take actions on records in an entity.

Access levels determine the scope of entities and records a user can take actions on, from most restrictive to least restrictive.

Every user must:

Be assigned to just one business unit.

Have at least one security role to be able to log in.

Privileges

A privilege is a permission to perform an action in Dynamics 365. Power Apps and model-driven apps use different record-level privileges that determine the level of access a user has to a specific record or record type.

Privilege Description

Create Required to make a new record.

Read Required to open a record to view the contents.

Write Required to make changes to a record.

Delete Required to permanently remove a record.

Append Required to associate the current record with another record. For example, a note can be attached to an opportunity if the user has Append rights on the note. In case of many-to-many relationships, you must have Append privilege for both entities being associated or disassociated.

Append To Required to associate a record with the current record. For example, if a user has Append To rights on an opportunity, the user can add a note to the opportunity.

Assign Required to give ownership of a record to another user.

Share Required to give access to a record to another user while keeping your own access.

The owner of a record or a person who has the Share privilege on a record can share a record with other users or teams. Sharing can add Read, Write, Delete, Append, Assign, and Share privileges for specific records.

Configure a security role

A user’s experience in the application is the combined result of their defined security roles and team memberships as well as app licenses. Using security roles to limit a user’s access to records can improve their in-app experience by removing clutter that is not part of their requirements.

The following graphic shows the security roles for a Salesperson. Clicking each individual circle in the column of privileges will change the access level.

Access levels

The access level determines, for a given entity type, at which levels within the organization hierarchy a user can act on that type of entity.

The following lists the levels of access in Dynamics 365 model-driven apps, starting with the most access.

ACCESS LEVELS

Global: This access level gives a user access to all records in the organization, regardless of the business unit hierarchical level that the instance or the user belongs to. Users who have Global access automatically have Deep, Local, and Basic access, also. Because this access level gives access to information throughout the organization, it should be restricted to match the organization's data security plan. This level of access is usually reserved for managers with authority over the organization. The application refers to this access level as Organization.

Deep: This access level gives a user access to records in the user's business unit and all business units subordinate to the user's business unit. Users who have Deep access automatically have Local and Basic access, also. Because this access level gives access to information throughout the business unit and subordinate business units, it should be restricted to match the organization's data security plan. This level of access is usually reserved for managers with authority over the business units. The application refers to this access level as Parent: Child Business Units.

Local: This access level gives a user access to records in the user's business unit. Users who have Local access automatically have Basic access, also. Because this access level gives access to information throughout the business unit, it should be restricted to match the organization's data security plan. This level of access is usually reserved for managers with authority over the business unit. The application refers to this access level as Business Unit.

Basic: This access level gives a user access to records that the user owns, objects that are shared with the user, and objects that are shared with a team that the user is a member of. This is the typical level of access for sales and service representatives. The application refers to this access level as User.

None: No access is allowed.

Users can have more than one security role. If they do, the role with the broadest permissions will override roles with lesser permissions.

Users with higher permissions (like System Administrators) will have access to the Settings sections of the Power Platform admin center and the model-driven apps. Familiarizing yourself with the settings sections are important to ensuring that you can effectively manage the administration of your environment.