Microsoft Dynamics 365 | Integration, Dataverse...

Dashboard Access Restriction Failing When Accessed via Direct Link in Model Driven App

(2) Share

Report

Posted on by CU11061751-1

We have a dashboard configured within one of our D365 Model-Driven Apps. Our goal is to restrict user access to this dashboard page. To achieve this, we have removed it from Navigation and also applied security roles restrictions and enabled appropriate access controls on the dashboard.

However, we’ve observed that users who previously had access and have saved the direct link to the dashboard are still able to access it via link, despite the updated security settings. This indicates that the access control is not being enforced when the dashboard is accessed via a direct URL.

We are looking into why the security restrictions are not being applied consistently and would appreciate any guidance or recommendations to ensure the dashboard is fully secured and inaccessible to unauthorized users, even via saved links.

Categories:

Dynamics 365 general

I have the same question (0)

All responses (3)

Answers (0)

Sort by

CU11061751-1 9 on at

Like (1)

Report
Copy link

Link copied!

Anyone please provide any comments on this ?

Was this reply helpful? Yes No
Suggested answer

Tom_Gioielli 3,086 Super User 2026 Season 1 on at

Like (1)

Report
Copy link

Link copied!
Not sure why the permissions are not being applied, but you could always try one of the following:

Create a new copy of the dashboard and all of the settings. This will create a new GUID for the dashboard and should prevent the prior link from working for users

Create a personal dashboard instead, along with a team (and team members) who should have access. Share the Dashboard with this team for "View Only" permission

Was this reply helpful? Yes No
Suggested answer

Sohail Ahmed 11,175 Super User 2026 Season 1 on at

Like (1)

Report
Copy link

Link copied!
Hope this might be helpful:

The "Dashboard Access Restriction Failing" issue, where users access via direct link despite security changes, indicates that underlying security role permissions are not correctly applied or fully propagated, rather than a bypass of the direct link itself.

Key Checks:

Dashboard Security Roles: For System Dashboards, ensure only authorized roles are checked under "Enable Security Roles" on the Dashboard record itself. For Personal Dashboards, verify they are not shared with unauthorized users.

Underlying Entity Permissions: Crucially, check that the unauthorized users do not have Read privileges to any entities, charts, or views whose data is displayed on the dashboard.

Caching: After any security changes, have users clear browser cache/cookies and re-log in to refresh permissions.

The direct URL should not bypass true security role denials.

✅ Mark this answer as verified if it helps you.

Was this reply helpful? Yes No