Security controls in Dynamics 365 Business Central

Dynamics 365 Business Central runs on Azure as a multitenant service. The same physical hardware stores multiple customers' deployments, virtual machines, and data. Azure uses logical controls to provide the scale and economic benefits of multitenant services and prevents customers from accessing each other's data. Data Handling and Encryption controls make sure customer data in Business Central environments stays in its original source.

Dynamics 365 Business Central uses Azure SQL Database for data persistence. Azure SQL Database encrypts customer data by using Transparent Data Encryption (TDE) technology. All persisted data is encrypted by default with Microsoft-managed keys, but Dynamics 365 Business Central customers can encrypt their environment database with customer-managed encryption keys (CMK).

For an overview of security controls that help you protect your data and prevent unauthorized access to Dynamics 365 Business Central, see aka.ms/bcsecurity.

Tenant data isolation

Each Dynamics 365 Business Central environment stores data in a dedicated, isolated database. Customer data stays separate and isn't combined with data from other tenants. This isolation is a key security and sovereignty feature that keeps an organization's data separate and protected from others.

Encryption and key management

Dynamics 365 Business Central encrypts data at rest in real time by using SQL Server Transparent Data Encryption (TDE) with strong keys that Microsoft manages. Power Platform managed environment customers with the right licenses and subscriptions can use customer-managed Keys to encrypt data in their Dynamics 365 Business Central environment database with their own key. They can:

  • Rotate encryption keys on demand for compliance or security policy reasons.
  • Revoke Microsoft's access to the key to make the Dynamics 365 Business Central database undecipherable by Microsoft's service. This option gives them more control. To revoke Microsoft's access to encryption keys, use Azure Key Vault Managed HSM.

All network communication involving Dynamics 365 Business Central uses industry-standard encryption in transit. The encryption ensures that data sent between the client, the service, and any integrated services can't be intercepted or read by unauthorized parties.

Service integration security

Dynamics 365 Business Central can integrate with other services, such as Microsoft 365, Power Platform, and various third-party applications. When integrating with Dynamics 365 Business Central, you can set up a firewall or network security group to limit traffic to and from Business Central by using the Dynamics365BusinessCentral service tag. The service tag defines the IP address range used by Dynamics 365 Business Central services and is updated automatically when those IP addresses change.

Operational security, monitoring, and auditing

The cloud infrastructure that supports Dynamics 365 Business Central adheres to rigorous security practices, including just-in-time access for engineers, extensive monitoring, and audits. All access by Microsoft personnel to customer data is logged and monitored. For instance, anytime a Microsoft engineer elevates access to the production environment, the action is tracked in a tamper-evident system. This option gives assurance that any operator access is tightly controlled.

Datacenter security describes how Azure regional data centers physically protect your data from external and internal threats.

See also

  • Last updated on