Dynamics Community Forum Thread Details

Record Based Data Secure - D365 Data Security Model

Dear People,

I have requirement to secure data on Account entity sensitive attributes like Contact Number, Email etc.. From the above image you can understand, in User & Account Entity we got 2 Business Unit Lookups - Agency & Division, if the logged in user Agency & Division matches the record (Account) Agency & Division then Sensitive Information is visible to him, if not then vice versa. I cannot use FIELD SECURITY PROFILE, because here the security is not entity or role based, it is record based.

Any help would mean great to me.

Feel free to ask question, if you were unclear with the above.

Thanks,

Pradesh Dhayalan

Hi partner,

In Dynamics 365, there is an OOB function named "security field" which could hide the field value based on the usrs' security roles. But in your case, it is not sutiable, for example, I set set a security field on "account name" field as only account Manager role could see the value. So No matter what business unit your account is, you can’t see the data as long as the user is not the account manager.

So as far as I konw, the best way for you is using js code to control the fields' visibility by the uses' BU and accounts' BU.

Here is the sample code. Just add the function in the accout "onLoad" form and replace the real field name in your account form.

function compareBusinessUnit(executionContext) {
    var formContext = executionContext.getFormContext();
    //get current userid
    var useridOrg = Xrm.Page.context.getUserId();
    var userid = useridOrg.substring(1, useridOrg.length - 1);
    //get current user's businessunit id
    Xrm.WebApi.retrieveRecord("systemusers", userid, "?$select=_businessunitid_value").then(
        function success(result) {
            var _businessunitid_value = result._businessunitid_value;
            //get the businessunit id from account form
            var accountBU=formContext.getAttribute("BUfieldname").getValue();
            var accountBUID=accountBU[0].id;
            //if the two BU do not match
            if(accountBUID!=_businessunitid_value){
                //set field value as ******
                formContext.getAttribute("fieldname").setVisible(false);
            }

        },
        function (error) {
            alert(error.message);
        }
    );
}

But there are some weakness, the field value is also available in the account views, so you need to remove the fields from all the views for security.

Hope it helps.

Best Regards,

Leo

Quick Links

Leaderboard