Security Model of Dynamics CRM
Business Unit –- It is a way to group business activities.
- When an organization is created, a Root Business Unit is created by default. This Root BU cannot be deleted.
- Each Business Unit automatically gets a default team, and the team’s name is the same as the Business Unit’s name.
- Every Business Unit has a parent BU. By default, new BUs have the Root BU as their parent, but you can also create a custom BU and set it as the parent.
- Every User is linked to only one BU.
- Teams provide access to records through assigned security roles.
- Security roles assigned to a team are inherited by all its members.
Types of Teams:
- Owner Team
- Security Group Team
- Access Team
Owner Team → Own records + roles
Security Group Team → Same as Owner, but managed via Azure AD
Access Team → No ownership, only shared access
- Define the access levels and privileges that control what a user can view and perform in the system. They can be assigned directly to users or inherited through team membership.
- Privileges include: Create, Read, Write, Append, Append To, Share, Assign, and Delete.
- Access Levels determine the scope of those privileges: None, User, Business Unit (BU), Parent–Child BU, and Organization.
- Additionally, security roles include miscellaneous permissions such as Export to Excel, Run Workflow, and Run Flow.
| Aspect | User/Team Owned | Organization Owned |
|---|---|---|
| Ownership | Record can be owned by a user or a team | Record is owned by the organization |
| Key Fields | owninguser, owningteam | organizationid |
| Access Levels | Supports all: None, User, BU, Parent-Child BU, Organization | Supports only: None, Organization |
| Security | Granular control with record-level access & sharing | Broad access, visible across organization |
| Use Cases | When record-level ownership & sharing is required | When records should be accessible org-wide |
- Used to control access to specific fields (columns) in a table (entity).
- Field security must first be enabled in the column’s properties.
- Access Types available: Create, Read, Update, or Not Assigned.
- Field Security Profiles can be assigned to users or teams to manage access.
- Privileges are assigned directly to the team.
- Once an Access Team is created, it can be added to a form, allowing users to share the record by adding other users to the team.
- This process can also be performed programmatically.
Published on:
Learn more
Related posts
AI Agents in Microsoft Power Platform: Where Custom Agentic CRM Fits in Dynamics 365 Customer Engagement
In many CRM planning conversations right now, AI agent discussions are starting before organizations have fully aligned governance, integratio...
Business Process Flows in Dynamics 365 CE
Let’s look back at an oldie but a goodie in Dynamics 365 CE/CRM: Business Process Flows! These are designed to standardize how records m...
20 Most Commonly Used JavaScript Scenarios with Sample Code Snippets in Form Script – Dataverse / Dynamics 365 CE
JavaScript plays a critical role in Microsoft Dataverse and Dynamics 365 Customer Engagement (CE) applications. While Power Automate and Busin...
Dynamics 365 CE and Power Platform Developer Syllabus
Extensive & Advanced Syllabus for Power Platform & Dynamics 365 CE If you want to become an expert in Microsoft Power Platform and Dyn...
From Campaign Automation to Agentic Marketing: The Next Phase of Microsoft Dynamics 365 Customer Engagement
As organizations evaluate Microsoft Dynamics 365 Customer Insights capabilities, a common question keeps emerging: Are we still designing camp...
Dynamics 365 CE 2026 Release Wave 1 Launch Event Webinar
Western Computer recently hosted a launch event walking through Dynamics 365 CE 2026 Release Wave 1, focused on what's changing across Sales, ...
Microsoft Copilot in Dynamics 365 Customer Engagement: Where Teams See the Most Value
Artificial intelligence, particularly Microsoft Copilot in Dynamics 365 Customer Engagement, is quickly becoming part of everyday work across ...
Microsoft Power Platform 2026 Release Wave 1: What Copilot and Agents Mean for Dynamics 365 Customer Engagement
In conversations with organizations over the past several months, a consistent question has started to surface: how do we actually use these A...
Azure Data Factory Tips for Reliable Microsoft Dynamics 365 CE and Dataverse Integrations
Reliable integrations between Microsoft Dynamics 365 Customer Engagement and external systems can become challenging. This is especially true ...