Exercise - Configure a Dataverse security model

  • 45 minutes

Dataverse security controls who can see, edit, and share data within an environment. For regulated workloads such as Zava Pay, where compliance requires strict data boundaries, a well-designed security model combines business units for organizational isolation, custom security roles for least-privilege access, Entra ID group teams for scalable role assignment, and column-level security for protecting sensitive fields such as account numbers. In this exercise, you configure each of these layers and verify they work together.

This exercise should take approximately 45 minutes to complete.

Prerequisites

  • Access to a Power Platform environment with System Administrator role
  • At least one custom Dataverse table with sample data (representing Zava Pay transactions)
  • One or more Entra ID security groups available for team creation
  • A second user account for testing access restrictions

Note

If you don't have a custom Transactions table, create a simple table with columns such as Transaction ID (text), Amount (currency), Account Number (text), and Status (choice) before starting this exercise.

Create business units

Business units define data access boundaries in Dataverse. Users in one business unit can't see records owned by users in another business unit unless their security role grants broader access. Create two business units that represent Zava Pay's operational and compliance functions.

  1. Open the Power Platform admin center and select your environment.

  2. Select Settings > Users + permissions > Business units.

  3. Select + New business unit.

  4. Enter the following values:

    Setting Value
    Name Pay Operations
    Parent business unit (root business unit)

  5. Select Save.

  6. Select + New business unit again and create a second business unit:

    Setting Value
    Name Pay Compliance
    Parent business unit (root business unit)

  7. Select Save.

  8. Verify both Pay Operations and Pay Compliance appear in the business unit hierarchy below the root.

Create a custom security role

Security roles define which tables a user can access and at what privilege level. Privilege levels control scope: User (own records only), Business Unit (records in the same BU), Parent: Child Business Units (own BU plus child BUs), and Organization (all records). Create a least-privilege role for transaction analysts.

  1. In the Power Apps maker portal, select the desired solution and select New > Security > Security Role.

  2. Enter the name Zava Pay - Transaction Analyst.

  3. Set the Business unit to Pay Operations.

  4. On the Custom Entities tab (or Custom tables in the modern experience), locate your Transactions table and set the following privilege levels:

    Privilege Level
    Read Business Unit
    Write User
    Create User
    Delete None
    Append Business Unit
    Append To Business Unit
    Assign None
    Share None

    Tip

    In the modern security role editor, select the circle icons to cycle through privilege levels: None → User → Business Unit → Parent: Child BU → Organization. Each filled circle represents a broader scope.

  5. On the Core Records tab, locate the Account table and set:

    Privilege Level
    Read Business Unit
    All other privileges None

  6. In the Miscellaneous Privileges section, confirm the role includes basic user privileges such as prvReadOrganization and prvReadUser. These privileges are required for users to sign in and navigate the app.

  7. Select Save and Close.

Create an Entra group team

Entra group teams automatically grant security roles to all members of an Entra ID security group. When you add or remove users from the group, their Dataverse access updates accordingly, so you don't need to assign roles manually.

  1. On the Access card, select Teams > See all.

  2. Select + Create team.

  3. Configure the team with the following settings:

    Setting Value
    Team name SG-PP-ZavaPay-Analysts
    Business unit Pay Operations
    Team type AAD Security Group
    AAD Group (select your test Entra security group)

  4. Select Create.

  5. After the team is created, select it from the teams list.

  6. Select Manage security roles.

  7. Check the box next to Zava Pay - Transaction Analyst.

  8. Select Save.

You should now see the security role listed under the team's assigned roles.

Configure column-level security

Column-level security adds a second layer of protection for sensitive fields. Even if a user's security role grants Read access to a table, they cannot see a secured column's value unless a column security profile explicitly permits it. You enable column security on a sensitive field and configure masking so analysts see partial values while administrators see full data.

Enable column security on the table

  1. Open Power Apps and select your environment.
  2. Open the solution containing your Transactions table.
  3. Select Tables and open the Transactions table.
  4. Select the Account Number column (or your equivalent sensitive column).
  5. Expand Advanced options.
  6. Set Enable column security to On.
  7. Select Save.
  8. Select Publish all customizations to apply the change.

Note

Once column security is enabled on a column, all users lose access to that column's values by default, including administrators, until a column security profile explicitly grants it. Complete the next steps promptly to restore your own access.

Create a masked-view column security profile

  1. In Power Apps, open the target solution.

  2. Navigate to New > Security > Column security profile.

  3. Enter the name Pay Analysts - Masked View and select Save.

  4. On the profile record, select the Column Permission tab.

  5. Select + New Column Permission.

  6. Configure the permission:

    Setting Value
    Column Account Number (or your secured column)
    Read Allowed
    Read Unmasked Not Allowed
    Update Not Allowed
    Create Not Allowed

  7. Select Save and Close.

  8. Select the Teams tab on the profile.

  9. Select + Add teams and add SG-PP-ZavaPay-Analysts.

  10. Select Save.

Create a full-access column security profile

  1. In Power Apps, open the target solution

  2. Navigate to New > Security > Column security profile.

  3. Enter the name Pay Operations - Full Access and select Save.

  4. On the Column Permission tab, select + New Column Permission.

  5. Configure the permission:

    Setting Value
    Column Account Number (or your secured column)
    Read Allowed
    Read Unmasked Allowed
    Update Allowed
    Create Allowed

  6. Select Save and Close.

  7. Select the Users tab on the profile.

  8. Select + Add users and add your administrator account.

  9. Select Save.

Test and verify access

Validation confirms your security layers work as intended. You test from two perspectives: a restricted analyst and a full-access administrator.

Verify analyst access

  1. Open a private/incognito browser window.
  2. Sign in to Power Apps as a user who is a member of the Entra security group linked to your team.
  3. Open a model-driven app that displays the Transactions table (or navigate to the table directly via Dataverse > Tables).
  4. Confirm the user can:
    • View transaction records owned by users in the Pay Operations business unit
    • Create a new transaction record
    • See masked values (partial or hidden) for the Account Number column
  5. Confirm the user cannot:
    • Delete any records (the delete option should be unavailable)
    • View records owned by users in the Pay Compliance business unit
    • See the full unmasked value of the Account Number column

Tip

If the analyst user sees no records at all, confirm they have been synchronized into the environment and that sample records are owned by a user in the Pay Operations business unit.

Verify administrator access

  1. In your original browser window (signed in as your administrator account), navigate to the same Transactions table.
  2. Confirm you can see the full unmasked value of the Account Number column.
  3. Confirm you have full read, write, create, and delete access to all records.

Success criteria

  • Two business units created (Pay Operations, Pay Compliance)
  • Custom security role configured with explicit privilege levels per table
  • Entra group team created and linked to security group
  • Security role assigned to the team
  • Column-level security enabled on a sensitive column
  • Two column security profiles created (masked and full access)
  • Access verified: team members have correct restricted access
  • Masking verified: analysts see masked values, admins see full values