The building blocks
Access in Dataverse is the union of several mechanisms:
| Mechanism | What it does |
|---|---|
| Privilege | A single right on a table: Create/Read/Write/Delete/Append/Append To/Assign/Share |
| Access level | The scope of a privilege: None → User → Business Unit → Parent:Child BU → Organization |
| Security role | A named bundle of privileges at chosen access levels |
| Business unit | The org-hierarchy node that defines 'local' for BU-scoped access |
| Team | A group (owner/access/Entra-group team) that can own rows and hold roles |
| Field security | Column-level restriction via a field security profile |
A user's effective permission is the union of every role held by them and their teams — permissions add, they never subtract. There is no explicit 'deny'.
Sharing and hierarchy
Individual rows can be shared to grant access beyond a role, and hierarchy security (manager/position) can grant managers access to their reports' rows. Both are additive extensions on top of roles — and both are easy to lose track of.
Failure modes
- Organization-level Read 'to make it work'. The commonest over-privilege: a role granted org-wide read exposes every row in the environment. Least privilege means User/BU scope unless there's a reason.
- No explicit deny. Because permissions only add, you cannot claw back access with another role — you must fix the granting role. People add roles to fix problems and quietly over-grant.
- Broad ad-hoc sharing. Rows shared to individuals/teams accumulate into an invisible access web that no role review catches.
- Field security overlooked. Sensitive columns (salary, national ID) left in a table with only table-level roles are readable by anyone with table Read.
- Entra-group teams inherit membership drift. Access follows group membership managed elsewhere — a group's growth silently widens Dataverse access.
What to watch (proofs)
- Roles and their access levels: the Dataverse
roles/roleprivilegestables (Web API) or admin center → environment → Security roles — Organization-level privileges are the finding. - Who holds each role:
systemuserroles/teamroles— the effective-access map, including team-granted roles. - Ad-hoc row shares: the
principalobjectaccesstable — the sharing web outside the role model. - Field security profiles vs sensitive columns — unprotected sensitive fields.
- Business-unit structure vs access scope:
Get-AdminPowerAppEnvironmentfor the environment, then the BU hierarchy — mismatches that widen 'local' access.