Regional visibility and a confidential costing column at Contoso Field Services
Contoso Field Services runs a single Dataverse environment. All 240 users sit in the root business unit and hold one custom role, Field Service – Full Access, which grants Organization-level Read on Work Order and Account. Three regional dispatch teams (North, South, West) must see only their own region's work orders. A six-person escalation team must read every work order in all regions but edit only those assigned to it. The Cost column on Work Order holds vendor pricing that only 12 finance users may see; today technicians open records with Cost populated. Regional managers must also see work orders owned by people who report to them. Filtered views are the only approach the team has tried so far, and it did not help.
1. Design the security model that meets the dispatch, escalation, and manager requirements using the fewest security roles.
Read the worked answer
Do not solve this with views - solve it with the ownership hierarchy.
- Business units: create three child business units (North, South, West) and move each user into their region. Business units define the boundary for business-unit-level privileges.
- Dispatcher role (one role, assigned in each BU): Work Order Read/Write/Append = Business Unit. A BU-level privilege covers records owned by users in the user's own business unit, so North dispatchers see North work orders only - with no per-region role duplication.
- Technician role: Work Order Read/Write = User.
- Escalation role: Work Order Read = Organization (all regions), Write = User. They can read everything but can only update records they own. When the team must edit a specific record they do not own, grant access surgically with an access team on that record rather than raising the role to Organization Write.
- Manager visibility: populate the Manager field on each User record to build the manager hierarchy, then set the manager role's Work Order Read privilege to User with hierarchy. Managers then see their own records plus those owned by everyone beneath them.
Net result: four roles (dispatcher, technician, escalation, manager) plus the BU structure, instead of one role per region.
2. How should the Cost column be protected, and what limitations must you warn the business about?
Read the worked answer
Use field-level security (FLS), not form design.
- Enable Field Security on the Cost column (this is irreversible once enabled).
- Create a field security profile that grants Read (and Update if finance edits it) on Cost, and assign it to the finance team or to finance users.
- Leave all other roles without a profile that grants access. A user with no granting profile sees a blank, read-only field.
Limitations to state up front:
- System administrators bypass FLS, so the field is not hidden from admins.
- Users without permission cannot filter, sort, or build views on a secured column, and it cannot be used inside calculated or rollup column definitions.
- There is a per-table cap on secured columns (175), so this is not a general-purpose redaction mechanism.
- Enable auditing on Cost so you can prove who viewed or changed pricing, since FLS prevents access but does not record intent.
- If the requirement later becomes "finance only, including admins," FLS alone is not enough - that needs a separate environment or a data-sharing pattern.
3. A colleague proposes creating a 'North Only' system view filtered on Region and sharing it with the North dispatchers. Explain why that is insufficient and what it would take to prove the data is actually protected.
Read the worked answer
Views are presentation, not authorization.
- Users can switch to any other view, use Advanced Find, build a personal view, export to Excel, or call the Web API directly. The filter is never consulted on those paths, so the North team still reads South records.
- Views also break down as an access-control story because they must be maintained per region and are trivially bypassed.
How to verify real protection:
- Sign in as a North dispatcher and query the Web API (
/api/data/v9.x/workorders) - the result set must contain only North-owned records. - Use Advanced Find with no filter and confirm the record count matches the BU, not the organization.
- Sign in as a finance user and a non-finance user and confirm Cost renders for one and is blank for the other.
- Re-run as a manager to confirm hierarchy rolls up subordinates' records, and as an escalation member to confirm read-all / write-own.