Dataverse
How does Dataverse security work?
Quick answer
Dataverse controls access through security roles that grant create, read, update, delete, and share privileges at organization, business-unit, or user-only depth. Records owned by users or teams inherit visibility from ownership plus role depth, while business units partition data along organizational lines. Teams — including Entra ID group teams — and sharing handle exceptions without rewriting roles.
Key takeaways
- Roles grant privileges; access levels scope them to org, unit, or user.
- Ownership plus business units partition records along the org chart.
- Minimum viable roles, tested per persona, beat role sprawl.
Detailed Explanation
Dataverse controls access through security roles that grant create, read, update, delete, and share privileges at organization, business-unit, or user-only depth. Records owned by users or teams inherit visibility from ownership plus role depth, while business units partition data along organizational lines. Teams — including Entra ID group teams — and sharing handle exceptions without rewriting roles.
How it works
Assign each user one or more roles; each privilege carries an access level (organization, parent-child business units, business unit, user). A salesperson with user-level read sees only their records; a manager with business-unit depth sees the team’s. Verify behavior against current documentation when designing hierarchies, as privilege interactions are the classic misconfiguration.
Limitations and considerations
Role sprawl is the failure mode: dozens of near-identical roles become unauditable. Field-level and hierarchy nuances add further depth — model the minimum roles that express the real org, then test as each persona.
This Q&A page is the short-answer layer for “How does Dataverse security work?” Use the related guides below when you need implementation steps, architecture trade-offs, or troubleshooting detail.
For broader context, visit the Dataverse Hub. It connects this topic to surrounding Microsoft 365, Power Platform, SharePoint, Copilot Studio, Dataverse, migration, and Dynamics 365 guidance.
When to use it
Design security when records have different owners, managers need team visibility, or external parties must be fenced out of shared tables.
Practical example
Regional sales teams sit in separate business units with user-depth roles; managers get business-unit depth, so each region sees only its pipeline while leadership rolls everything up.