Hello Community,
I am trying to solve the following security requirements for users in Dynamics 365 (Customer Engagement), and would appreciate some pointers:
Background:
- Team A is in Business Unit A
- Team B is in Business Unit B
- User 1 is in Business Unit A
- User 2 is in Business Unit A
- Both User 1 and User 2 has individual security role that has BU Read/Write access on the Account entity. It needs to stay as BU level access, and cannot be changed to organization (global) level access.
Needs:
- We want to allow User 1 and User 2 to be able to access Account records owned by Team B
Approach:
- Create a security role (called Test Role), with the member's privilege inheritance set to "Direct User (Basic) access level and Team privileges", and assign this role to Team B
- This Test Role has BU Read/Write access on the Account entity
- Add both User 1 and User 2 as members of Team B
Results:
- Now both User 1 and User 2 can access Account records owned by Team B
Problem:
However, what if we want User 1 to only have READ access on Account records owned by Team B, but no WRITE access, and at the same time, we want User 2 to have both READ/Write access on Account records owned by Team B
Any ideas what changes I would need to make, given the set up above, to achieve this? (Note: let's assume the out of the box Share feature is not an option)
Thank you!
