Dataverse: the platform's database

What Dataverse actually is

Dataverse is a managed, cloud-hosted relational store built into an environment. It is not 'a database you administer' — Microsoft runs the engine; you model tables (the current name for entities), columns, relationships (one-to-many, many-to-many), keys, and choices (option sets). On top of raw storage it layers business logic that fires server-side regardless of which app touches the row: business rules, calculated/rollup columns, and plug-ins. That server-side enforcement is the point — the rules travel with the data, not with the UI.

The security model in one paragraph

Access is role-based and privilege-granular. A security role grants Create/ Read/Write/Delete/Append/Assign/Share per table, and each privilege has an access level — None, User (own rows), Business Unit (local), Parent:Child BU (deep), or Organization (global). Users, and teams, are assigned roles; the effective permission is the union of every role they hold. This is far more granular than SharePoint or list permissions — and far easier to get subtly wrong (see the dedicated Dataverse security concept).

Where it bites — failure modes

• Premium by default. Any app or flow that reads or writes Dataverse requires a premium Power Apps / Power Automate licence for every user. The 'why did this suddenly cost money' surprise is usually a table added to a previously SharePoint-only app.
• Storage capacity is metered and billed. Dataverse database, file and log capacity is a tenant-pooled entitlement; runaway audit logging or a bulk import can push you over and block provisioning.
• Over-broad roles. Granting Organization-level Read 'to make it work' quietly exposes every row in the environment — the classic least-privilege miss.
• The default environment has a Dataverse too (once someone provisions it), and it inherits the everyone-is-a-maker problem — ungoverned business data in the least-governed place.

What to watch (proofs)

• Which environments have a Dataverse database: Get-AdminPowerAppEnvironment exposes the CommonDataServiceDatabaseType / provisioning state per environment — a new Dataverse in an ungoverned env is a governance signal.
• Storage consumption: Power Platform admin center → Resources → Capacity, per environment — the metered spend and the runaway-log tripwire.
• Role assignments: the Dataverse security roles and their access levels (admin center → environment → Settings → Security roles, or the Web API roles/systemuserroles tables) — Organization-level grants are the finding.
• Premium exposure: apps/flows touching Dataverse vs licensed users (Get-MgUserLicenseDetail against the app inventory) — cost risk or breakage.