Field Inspections Without Connectivity

Decision: model-driven app with mobile offline.

• The data shape (25 fields, three photos, 600 records/day) is small enough that either option works on volume alone, so the deciding factor is who owns offline sync logic. Canvas offline means hand-building SaveData/LoadData collections, a queue, and your own conflict resolution - a sync engine that three vendors would each implement differently.
• Mobile offline gives declarative sync profiles with per-user filters, server-side conflict detection, and re-sync on reconnect, and it honours Dataverse security consistently.
• Photo caveat: file and image column content is not downloaded by mobile offline. Inspectors must capture to device storage (camera control in a custom page or canvas component) and upload on reconnect, with an upload-state column so unsent photos are visible.
• Risk to confirm: per-app licensing is unapproved. A model-driven app requires premium access for 350 users; if that is blocked, revisit canvas with a deliberately narrow offline scope rather than assuming parity.

Verify: pilot with ten inspectors, measure first-sync time on the slowest device, and force a conflicting edit from two devices to prove the conflict path works before rollout.

Virtual table is disqualified by the offline requirement, not by performance.

• Virtual tables execute a remote query per request against the provider; they are read-only by design in the common pattern and, critically, are not available in mobile offline. An inspector with no signal gets nothing.
• A 40M-row remote source also makes every lookup latency-bound unless the provider exposes an indexed, parameterised view; a naive SELECT * provider will time out under field conditions.

Recommended: nightly subset sync.

• Use Azure Data Factory (or Synapse Link plus a shortcut) to pull the ~300,000 active accounts into a Dataverse table keyed by an alternate key on account number, with incremental loads driven by a modified-date watermark.
• Then narrow again: the offline profile filter should sync only accounts on the inspector's routes or territory, so a device holds thousands of rows, not 300,000.
• Add a LastVerifiedOn column so the UI can flag stale data older than the nightly window.

Verify: measure the mobile offline download size for the busiest territory before the pilot, and test a lookup against an account deactivated in billing mid-day.

One schema owner, one publisher per partner, managed downstream.

• The client owns a Core solution containing shared tables, choices, and security roles. Partners never create their own copies of a Core table; they declare a dependency on it. Without this rule, two partners will both ship an Account extension or a duplicate choice and the import will conflict or silently layer.
• Each partner gets a unique publisher with its own prefix; their solutions are unmanaged only in their own Dev, and imported as managed into Test and Prod. Unmanaged customisation in Prod is banned and checked in the pipeline.
• Layering order is documented and fixed (Core → Partner A → Partner B → localisation), because managed layering is order-sensitive and an out-of-order import produces behaviour nobody can reproduce in Dev.
• Connection references and environment variables carry every endpoint and secret so the same solution imports cleanly into three environments.
• Solution Checker runs as a pipeline gate; a failed check blocks the release.

Verify: do a full Dev→Test promotion with all three solutions before the first go-live, then delete the Core solution from a scratch environment and confirm dependencies are declared rather than assumed.