web
You’re offline. This is a read only version of the page.
close
Skip to main content

Announcements

News and Announcements icon
Community site session details

Community site session details

Session Id :
Customer experience | Sales, Customer Insights,...
Answered

Column Security Profiles: field not usable in Journey branching (Customer Insights – Journeys)

(2) ShareShare
ReportReport
Posted on by 41

Hi everyone,

I’m experiencing an issue with Customer Insights – Journeys (Real-time) when using a field protected by Column Security Profiles.

Scenario:
- A custom field on Contact (Privacy choices)
- Column security enabled
- A Column Security Profile configured with: Read = Allowed, Assigned to users (including All Users)
 
I want to use this field in a journey condition (Attribute branching)
Field = "Marketing Consent Control"
Condition = equals YES / NO
 
The field is visible and populated in Dataverse, but inside the journey condition always evaluates to Other / default branch.
 
Checks already completed:
- Field correctly populated
- Logic in journey is correct
- Column Security Profile configured with Read access
- Test users can read the field
- Feature switches Use protected fields enabled
 
Does anyone know which user executes the journey and reads this field in Customer Insights – Journeys?
 
Thank you for your help.
 
KR
S.I.
 
I have the same question (0)
  • Suggested answer
    11manish Profile Picture
    842 on at
    The journey is not executed under the context of the users assigned to the Column Security Profile. It runs under a Microsoft-managed backend service identity,
     
    and that service may not be able to evaluate secured Dataverse columns even when end users can read them.
     
    Given that:
    • The field is populated,
    • Users can read it,
    • Column security is enabled,
    • "Use protected fields" is enabled,
    • All contacts route to the Other branch,
    the most likely cause is that the journey engine cannot access the secured column value during execution.
     
    The recommended approach is to maintain the secured field for operational use and synchronize its value to a separate non-secured field that is used exclusively for
     
    Customer Insights segmentation and journey logic.
  • Nagaraju_Matta Profile Picture
    178 on at

    Hey Silvia,

    we faced the exact same issue in one of our projects — journey silently routing everyone to the Other branch, no errors, field was populated and readable by users. Took a while to figure out.

    Root cause: Customer Insights – Journeys runs under its own backend service user context, not the logged-in user. So even with Column Security allowing all human users to read the field, the journey engine sees null and falls to the default branch every time.

    Fix: Add the Marketing service application users to your Field Security Profile with Read = Allowed. The ones you need for journey execution specifically:


    • D365 Workflow — handles customer journey execution

    • Customer Experience Platform PROD — covers all general areas

    • D365 Dataverse Data — if field is used in personalization tokens

    • D365 Native Segments — if field is used in a segment feeding the journe

    •  

    How to find them:
    Go to Settings → Security → Users — by default it opens the Custom Users view which only shows licensed interactive users. Switch the view to Application Users and search for these accounts there and make sure you selected Platform instead of custom on top filter

    Enabling the "Use protected fields" feature switch alone is not enough — service users must be explicitly added to the FLS profile first, otherwise the field evaluates as null internally regardless of the switch.

    Microsoft docs on this: https://learn.microsoft.com/en-us/dynamics365/customer-insights/journeys/overriding-fls-attributes

     

    Hope that unblocks you!

    If this helped, please mark it as verified — makes it easier for others hitting the same issue to find the answer quickly.

    Nagaraju Matta
     

  • Verified answer
    Hamza H Profile Picture
    1,997 Super User 2026 Season 1 on at

    In Customer Insights – Journeys (Real-time), journey execution doesn't use the interactive user's permissions. Conditions are typically evaluated by the application's backend/service identity.

    Even if users have Read access through a Column Security Profile, the journey engine may not be able to read a column secured field unless the service account/application identity also has access.

    Since you've already enabled Use protected fields, the next things to verify are:

    • The secured field is supported for real-time journey evaluation.
    • The Customer Insights – Journeys application/service principal has access to the secured column.
    • Check Microsoft documentation or open a support ticket, as column security with attribute branching has known limitations in some scenarios.

    If the condition always falls into the Other branch despite the value being populated, it strongly suggests the journey runtime cannot read the secured field rather than a problem with the branching logic itself.

Under review

Thank you for your reply! To ensure a great experience for everyone, your content is awaiting approval by our Community Managers. Please check back later.

Helpful resources

Quick Links

Season of Sharing Community Challenge Launch!

Jump in, show your community spirit, and win prizes!

Women in Power Builds Momentum

Expanding mentorship, skilling, and AI innovation

Congratulations to the May Top 10 Community Leaders

These are the community rock stars!

Leaderboard > Customer experience | Sales, Customer Insights, CRM

#1
Hamza H Profile Picture

Hamza H 140 Super User 2026 Season 1

#2
Nagaraju_Matta Profile Picture

Nagaraju_Matta 128

#3
Abhilash Warrier Profile Picture

Abhilash Warrier 70 Super User 2026 Season 1

Last 30 days Overall leaderboard

Product updates

Dynamics 365 release plans