Configure Dataverse security roles and column-level security profiles

Introduction

In Microsoft Power Platform development, it is crucial to maintain proper data security within Dataverse. This involves defining security roles and column-level security profiles to restrict access to sensitive information. In this article, we will explore the steps and concepts involved in configuring Dataverse security roles and column-level security profiles.

Understanding Security Roles

Security roles in Dataverse allow system administrators to control users’ access to entities, attributes, and field-level security. By defining security roles, you can determine what actions users can perform on data, such as read, write, delete, or share. Here’s how you can configure them:

1. Navigate to the Power Apps maker portal (https://make.powerapps.com/) and sign in with appropriate credentials.
2. Select the desired environment, and under ‘Settings,’ choose ‘Security.’
3. In the ‘Security’ section, click on ‘Security Roles’ to view and manage existing roles.
4. To create a new security role, click on the ‘New’ button. Provide a name and description for the role.
5. In the ‘Privileges’ tab, select the desired access levels for entities and their attributes. You can choose from a range of options, including ‘None,’ ‘User,’ ‘Business Unit,’ ‘Parent: Child Business Unit,’ or ‘Organization.’
6. Save and publish the security role once you’ve configured the privileges according to your requirements.

Column-Level Security Profiles

Column-Level Security (CLS) extends the security capabilities of Dataverse by allowing fine-grained control over accessing specific data columns based on user roles. This feature ensures that sensitive data remains hidden or can be partially revealed to selected users. The following steps outline how to configure column-level security profiles:

1. Access the Power Apps maker portal and navigate to the desired environment.
2. Under ‘Settings,’ select ‘Data.’
3. Click on ‘Tables’ to view and manage the entities available in the environment.
4. Choose the desired entity, and in the ‘Fields & relationships’ section, click on ‘Add security profile’ next to the column for which you want to configure CLS.
5. In the ‘Security Profile’ dialog box, select ‘Profiles’ and click on the ‘New’ button.
6. Provide a name and description for the security profile.
7. In the ‘Field Level Security’ tab, define the conditions for displaying or hiding data based on the user’s role. You can use various expressions, including ‘Equal,’ ‘Not Equal,’ ‘Contains Data,’ or ‘Does Not Contain Data.’
8. Save the profile and publish your changes.

Note: CLS profiles can be used in combination with security roles to further refine data access permissions.

Assigning Security Roles and Profiles

Once you have configured security roles and column-level security profiles, it is essential to assign them to the appropriate users to enforce data access restrictions. Here’s how you can assign security roles and profiles:

For security roles:

1. Open the desired security role within the Security Roles view.
2. In the ‘Members’ tab, click on the ‘Add’ button to assign users or teams to the role.
3. Search and select the users or teams you want to assign.
4. Save your changes.

For column-level security profiles:

1. Access the desired entity and select the ‘Data’ tab.
2. Click on ‘Security Roles’ to manage the roles associated with column-level security.
3. Open a security role, and in the ‘Security Profiles’ tab, click on ‘Add.’
4. Select the appropriate security profiles and save your changes.

Conclusion

Configuring Dataverse security roles and column-level security profiles is necessary to maintain data integrity and protect sensitive information within Microsoft Power Platform development. By following the steps outlined in this article, you can define access privileges, enforce data restrictions, and ensure that only authorized users can access specific columns. Implementing these security measures is crucial for safeguarding your organization’s data and complying with privacy regulations.