Restrict data entity to current company

(1) Share

Report

Posted on by Pete Alberts

3,546

I have read a lot and wen't through the docs pages on data entities a few times. If I missed the relevant page - please let me know.

After using the open in excel as SysAdmin for a data entity that is created with a per company purpose (meaning the primary company context has been set), I can simply remove the "Company" filter:

Screenshot-2019_2D00_02_2D00_11-at-08.20.03.png

This causes a problem for security. Scenario: Some data from some table is displayed on some form. The menu item for the form exists in a security privilege. The Data Enity for some table is also added to the privilege so that the user can also open in Excel. The privilege is assigned to a user, but the user is restricted to certain companies. The user can then bypass this restriction by removing the filter in excel. In other words he is restricted in AX, but not in Excel.

Is there a way to restrict this? Or does it come down to that giving a user access to a data entity means the user has access to data in all companies?

I am not sure whether I am only capable of doing this because of my SysAdmin role - I tried to check with another (restricted) user, but I couldn't get the add-in to work without my SysAdmin role (I didn't try very hard).
XDS will be a bit overkill in my opinion
I noticed new properties Operational Domain and Subscriber Access Level (for a data entity). I could not find any documentation on what they do, so I tested it with a few combinations - I didn't notice any differences.

Please let me know if I am unclear

Thanks for reading

Categories:

Security

Data Integration

Development / Customization / SDK

All responses (6)

Answers (2)

Sort by

Verified answer

nmaenpaa 101,172 Moderator on at

Like (0)

Report
Copy link

Link copied!

The System Administrator role bypasses all security. Please test with non-admin role. Non-admins have access only to data (and companies) where they have been granted access.

The filter in Excel is not part of the security layer. It justs filters the result that you receive from the system. And the system doesn't provide data that your role doesn't have access to.
André Arnaud de Cal... 307,427 Super User 2026 Season 2 on at

Like (0)

Report
Copy link

Link copied!

Hi Pete,

Nikolaos is correct here. When you have at least the system user role and a role with access to the entity, you should be able to use it in the Excel add-in. Then you should be able to test it. Let us know if you are or are not able to perform your test.
Pete Alberts 3,546 on at

Like (0)

Report
Copy link

Link copied!
Thanks Ievgen and Andre. Much appreciated.

Andre you guessed correctly - I am struggling with the test. I thought I'd write down the whole process (hopefully you can correct me):

I first struggled with creating a new user with my personal email. I kept getting the "you are not authorized to log in with your current credentials" thing. Which is probably a subject on it's own - I don't know anything about user setup, I've never needed to. But I sorted that out - I'm not sure what I changed that did the trick.

The second problem was that I'm logged in to Excel with my SysAdmin user. So when I open in excel from InPrivate browsing (with my other user that has limited access) excel still sees me as SysAdmin. So I logged out of Excel and in again with the limited user.

Third issue is this:

I Googled it but no success. One of the "solutions" that didn't work for me: https://gfeaxblog.wordpress.com/2018/06/19/d365-loading-applets-issue-while-connecting-to-microsoft-dynamics-365-for-operations-through-excel-add-in/

Then I thought it might help to open another session on the VM (maybe something is stuck or there is some conflict because of the two accounts). So I did some network internet stuff (of which I know nothing) so that I can remote desktop to my VM and then sign in with another user (Domain user), but it didn't help.
Pete Alberts 3,546 on at

Like (0)

Report
Copy link

Link copied!

I followed the advice on docs:

And the app is configured:
Verified answer

nmaenpaa 101,172 Moderator on at

Like (0)

Report
Copy link

Link copied!

1. By default, you can only add users from the same O365/AAD domain that your environment is deployed from. If you add users from different identity providers, you must put the identity provider name in the "Provider" field, after the "https://sts.windows.net/" that already exists there. For example if you add myUser@myDomain.com, you must put sts.windows.net/myDomain.com in the Provider field.

You can even add Microsoft / personal accounts. if you put sts.windows.net/live.com in the Provider field.

3. Does your test user have System User role? All users need to have that role.
Pete Alberts 3,546 on at

Like (1)

Report
Copy link

Link copied!

1. Thanks

3. Yes it does...

I used a colleague's details - which fixed the "Load applets" problem.

Then I was able to test the while thing at last :)

You are correct. The entity honours the companies assigned to the user in that context. You can still remove the "Company" filter in Excel, but it will not retrieve records from companies that are not allowed.

Thank you very much for the help