Introduction
Governance controls determine who can access environments and what connectors they can use. But once a user enters an environment, the Dataverse security model determines exactly which records and columns they can read, create, update, delete and more. Configuring this model correctly is the difference between broad data exposure and true least-privilege access.
Scenario: Overprivileged access at Zava
Zava Pay's Dataverse environment holds customer financial records, transaction history, and compliance audit trails. After the initial deployment, every user received the System Administrator role - "just to get things working." Six months later, a store associate accidentally deleted payment reconciliation records. A contractor accessed customer social security numbers they never needed to see. And when the compliance team audited access, they couldn't explain why 47 users had permission to export all financial data.
The admin team needs to replace the all-or-nothing approach with a precise security model that:
- Grants each user only the access required for their specific job function
- Aligns data boundaries with organizational structure (stores, corporate, Zava Pay)
- Protects sensitive columns (like ID numbers, payment details) even from users who can access the records containing them
What you learn in this module
This module teaches you to configure and maintain the Dataverse security model for enterprise environments:
- Understanding how security roles, business units, and teams work together to control data access
- Configuring and assigning security roles with appropriate privilege levels
- Structuring business units and teams to match organizational boundaries
- Applying column-level security and data masking for sensitive fields
By the end of this module, you can implement a least-privilege Dataverse access model that protects sensitive data while enabling users to perform their roles effectively.