Dynamics Community Forum Thread Details

DB level encryption in Dynamics CRM 2016 On-premise

Hi Experts,

I am a Dynamics CRM developer working on an implementation. Our CRM 2016 is setup in a way that it is hosted on Azure (IFD) and we have internal users (100) as well as external users (3000) accessing CRM. All external users (3000) have a license of Dynamics CRM and they access it directly and not through a portal.

Now, these external users have some of their data in our CRM system which only they (the particular external user) should be able to access and that none of the internal users including the System Admin, DB owner etc. should not be able to see this information. Theoretically, I believe this can be implemented if we allow each of our external users to generate and keep with them a key which can be used to encrypt and then decrypt the encrypted data on their side. Only the external user will have access to this security key. Now, I have the following questions:

1. How to implement the generation of security key in CRM? Keep in mind that this key should not be stored in CRM because then the internal staff can use the key to see the external user's data.

2. How to then encrypt and decrypt the data in DB using that key?

3. How to provide a way for the external users to recover the key if they lose it somehow since it is not stored anywhere?

I know the above doesn't sound easy but would be great to implement. So any leads would be appreciated.

What if you create plugin that triggers on prevalidation of create/update of these entities and encrypts data. The plugin can check if the user is external or internal

If it's external user encrypt every field and decrypt the field only if it's external user on Retrieve or Retrieve Multiple.

You will have to do the decryption on Retrieve and Retrieve Multiple events. And do the encryption and Create and Update.

This way you as developer get to decide and use best encryption and secure the key.

You can store the key securely on Azure if you want

Sine you may have to do the encryption/decryption for multiple plugins you could move this bit of code into a static method and reuse on all the plugins may be.

Quick Links