Understanding the Security Model
- Security model has been defined into the Dynamics CRM that protects data integrity, privacy and provides efficient data access and collaboration.
- Restricts users from unauthorized access and shows what a particular user must see depending on their roles/privileges.
- Does not let a user access records not owned by them.
- Also supports data sharing so that records can be viewed by users though they don’t own it themselves.
Three major areas of security model in CRM are as follows:
- Role Based Security
- Record Based Security
- Field level security
Role Based Security
Role based security defines a set of privileges that can be assigned to a user in a form of a role.
A user must be assigned to at least one such role.
Roles can also be assigned to teams in Dynamics CRM 2013.
Roles
MS Dynamics CRM has 14 predefined roles which are defined to match security best-practice of providing only what’s necessary to a particular type of user in the organization.
Custom roles can, however, be created.
Each role is associated with a set of privileges.
One or more roles can be assigned to a user or team.
Creating a new role with intent to assigning a privilege is recommended than modifying an existing role. Roles at user level can’t be modified.
Privileges
A privilege is a permission to perform an action. There are 580+ privileges predefined during setup. Privileges are built-in to the product.
Privileges cannot be added, modified or deleted. However, new roles can be defined to use the predefined set of privileges.
The platform checks for privileges and rejects any operation on which the required privilege is not found.
Privilege is combined with a depth and access level.
Access Level
Access level defines the depth at which a user can access a particular entity type in the organization.
The access levels defined are as follows:
- Global (Organization)
This level gives a user access to all records. User with this level automatically have all the levels Deep, Local and User as well.
- Deep (Parent: Child Business Unit)
This access level gives a user access to records in user’s business unit and all business units subordinate to the user’s business unit.
- Local (Business Unit)
This access level gives access to records in the user’s business unit. Usually assigned to managers with authority over the business unit.
- Basic (User)
This access level gives a user access to records he/she owns, objects that are shared with them and objects that are shared with the team which a user is a member of.
- None
No access is provided.
Record Based Security
It is the security provided to individual records. It is provided by using access rights.
Access rights are provided after privileges have taken effect. A user may not be able to access a record even if he/she has access granted but does not have Read privileges on that entity the record is in.
Access Rights
The access rights provided are as follows:
Read, Write, Assign, Append, Append To, Share, Delete.
Create Access – Create Access in this does not apply to an individual record. It applies to a class of Entities. Create is handled as privilege. A user who creates a record has all the privileges to that record unless any other access right forbids it.
Sharing Records
Sharing lets user give other users/teams access to a specific record. Useful for sharing information with roles that have only Basic access level.
Sharing capabilities provided are as follows:
- Share
Sharing a record with another user holds providing access rights to another user for the record which is being shared.
GrantAccessRequest is used to share a record with another user/team. When a record is being shared with a user, indicate what access rights you wish to grant to that user.
Records should be shared with users who have privilege for that particular entity type.
- Modify Share
Rights granted to a user after sharing a record can be modified as well. ModifyAccessRequest is used to carry out this task.
- Remove Share
If you share a record with another user/team, you can stop sharing the same. RevokeAccessRequest is used to carry out this operation.
Sharing and Inheritance
If a parent record is created, the sharing properties with the parent record is assigned to the child record.
Child record also maintains its own sharing properties.
Assigning Records
Assign Records means handing over the ownership of a record to another user. The original user then loses ownership of that record.
The system administrator can decide whether or not, should the assigned record be shared with its previous owner.
If ShareWithPreviousOwner is selected, then the previous owner has all access rights to the assigned record.
Dependencies between Access Rights
Security dependencies exist between access rights because a user needs more than one access right to access a particular record.
Create – CREATE & READ are required.
Share – SHARE & READ is required.
Assign – ASSIGN, WRITE & READ is required.
Append – READ & APPEND is required.
AppendTo – READ & APPENDTO is required.
Field Level Security
In field level security, access to high-impact business fields is restricted.
For 2013 release of CRM, field security can be applied to custom fields only.
The following steps are carried out to restrict access to a field:
- Create a field security profile.
- Associate users/ teams with profile.
- Add specific field permissions such as Create, Update or Read to the profile.
System Administrator field security profile gives access to all secured fields. This profile is system managed and cannot be deleted or modified.
There are basically 3 restrictions that can be added in Field Security Profiles once created. They are:
- Allow Read
Specifies if users should be able to read information from this field. - Allow Create
Specifies if a user can add information to this field after it has been created.
- AllowUpdate
Specifies if a user can edit information from this field.
How secured fields behave for Retrieve and RetrieveMultiple
When Retrieve and RetrieveMultiple are used, CRM check user’s access rights for each record and secured fields. If a user doesn’t have access to secured fields, no exception is thrown but null values are retrieved for secured fields.
If the retrieved data has an access field and user is not impersonated to access it, the user is returned null. A null retrieved by the absence of data and a null retrieved due to lack for privilege can’t be distinguished.
Also, if the secured field is in the filter criteria, a null is substituted for the actual value of the filter criteria.
Following is the justification of how secured fields behave in different scenarios:
- Filtered Views
Filtered view will not return data for secured fields if user is not impersonated with proper access rights to the field. - Records are shared
A user can only give access to another user of the access that they themselves have. The user or team members with whom the record was shared now have that type of secured access field only on the shared secured fields on only that particular record, even if the user to whom it was shared does not have field security profiles that give them access.
- Create or Update.
If a user does not have required impersonation on the required secured field while calling Create or Update methods, an exception is thrown.
Hope this was helpful! 🙂
D365 Demystified 