Entering to xRM World Part 5 – Depth Knowledge for Security Model

If you had read these previous posts, you have a basic knowledge about Microsoft Dynamic CRM Security model in this post and this. In fact, it is the most important for understanding about it to enter xRM world, and help you deploy successful CRM system.

We will find out more detail about it in this article.

What is truth about Security model Microsoft Dynamic CRM?

In fact, the technology is not new to LoB application, it has been used for many product of Microsoft, such as Microsoft Dynamic AX…and it has been became the patterns for developing other security system of software application. It was called role-based security.

Microsoft has been used this patterns for Microsoft Dynamic CRM, it contains these following factors.

• Privileges
• Access levels
• Security roles
• Hierarchy security

All these factors has been developed to control all security in Microsoft Dynamic CRM as following table.

Purpose of Security model	Notes
Control access to record	Define all the actions that user can perform (CRUD operations), depend on who the user is and the ownership of record.
Control access  to UI element	Entity forms Business process flow Dashboard Entity views Field on form.
Control to access CRM functions	Mobility Exporting data Printing Importing data …
UX Experience	Hide/Show entities base on user’s priviledges. Hide/Show records, commands base on user;s priviledges.

 

Priviledges

A privilege is a permission to perform an action in Microsoft Dynamics CRM. It is the core for security checking and has been built-in Microsoft Dynamics CRM, there are more than 500 priviledges as default and will be added for each new version releases.

Priviledge sample

• Create record
• Update record
• Assign record
• Delete record
• …

They are call priviledge in xRM world. You can see in following table.

Priviledges in MS CRM

Access levels

Access level is the concept to allow user interact with your business in the hierarchy of organization, the following image is the chart for access level description that Microsoft has been used for structuring & virtualize your business in Microsoft Dynamic CRM system.

Access Level structure & virtualize your business

As the image, you will see that there are 4 Access Levels in Microsoft Dynamic CRM.

None No access is allowed for this level.

Access Level	Description
User Access Level	Providing access only for records: Records were owned by that user/team. Records hav been share with user/team.
Business Access Level	Providing access only for records: Records owned/shared with users/team in the unique business unit.
Parent: Child Business Unit	Providing access only for records: Business Unit Records owned/shared with any business unit under your business unit
Organization	Providing access only for records: Entire Organization

 

Security roles

Security role is combining of business unit to control  actions of user in Microsoft Dynamic CRM system.  Security role cannot be separated with access level & privileges. We can create roles within Microsoft Dynamics CRM and modify or remove these custom roles to fit your business needs. The roles you create for your business unit are inherited by all the business units in the hierarchy. (from MSDN).

There are relationship between role with business unit and role with team. The following table describe for these relation.

Security role	Description
Security role with Business Unit	Each role must be assign to specific business unit. Roles created in business unit will be inherited by each of its child business unit. New roles can be added to any business uit. Business unit may contain roles with the same name, but permission and access level maybe different. A user/team can only be assigned roles that is belong to the same business unit.
Security role with Team	Team can be assigned security role. It is required for team if you want team own the record. Team must belong to only one business unit But the team member can come from any business unit. Team and User will be combined security roles

Security roles will be combined together if user/team was assigned many roles

Hierarchy security

It is a new update of Microsoft for offering more granular access to records for an organization and helps to bring the maintenance costs down. You can see more scenarios for it at link and link.

It helps you to more flexible for accessing records in MS CRM, the following are characteristic of it.

• Extended the existing security model
• Can be used conjunction with existing security model.
• Access through Settings – Security – Hierarchy.

Taking advantage of hierarchy security will help you virtualize your security roles with position in your business unit as below image.

Virtualize security roles via Hierarchy security

Hope it will be useful for someone.