►
From YouTube: Dataverse security tips and tricks
Description
Dataverse is a database and a governance tool! Governance includes security. In this 12-minute citizen developer-focused demo, Chris Huntingford lines out his customer’s real-world challenge. We have hundreds of environments, and our makers need to easily figure out where to make! The presenter will have you look at Groups Teams (security for low code), core roles in Dataverse you need to care about, and then build a custom environment picker to address the where to “make” question.
This PnP Community demo is taken from the Microsoft Power Platform community call – June 2023, recorded on June 21, 2023.
Demo Presenter
• Chris Huntingford | @ThatPlatformGuy
Community Call Conversation
• aka.ms/June21-Demo2
Supporting materials
• Documentation - Microsoft Power Platform security and governance documentation | https://learn.microsoft.com/power-platform/admin/security
• Documentation - Configure user security in an environment | https://learn.microsoft.com/power-platform/admin/database-security
• Documentation - Associate a business unit with an Azure AD security group | https://learn.microsoft.com/power-platform/admin/wp-security-cds#associate-a-business-unit-with-an-azure-ad-security-group
• Documentation - Security in Microsoft Dataverse | https://learn.microsoft.com/power-platform/admin/wp-security
• Documentation - Security concepts in Microsoft Dataverse | https://learn.microsoft.com/power-platform/admin/wp-security-cds
Stay connected
• Twitter https://twitter.com/microsoft365dev
• Call attention to your great work by using #PowerAppsCC and #PnPWeekly on Twitter.
Learn more
• Microsoft 365 Unified Sample gallery - https://aka.ms/community/samples
• Microsoft 365 Platform Community in YouTube - https://aka.ms/community/videos
• Microsoft 365 Platform Community - http://aka.ms/community/home
• Microsoft 365 Platform Community Blog - https://aka.ms/community/blog
A
A
Team
at
a
company
called
ANS,
also
I
just
wanted
to
have
more
badges
than
everyone
else
so
like
that
sort
of
dirt,
I
have
a
badger
badge
as
well,
literally
means
nothing
anyway.
So
just
a
quick
one.
You
can
read
all
of
the
stuff
up
on
the
Microsoft
security
side
so
on
the
database
Pages,
it's
all
there,
except
for
the
hackie,
but
at
the
end,
I'm
going
to
show
you
and
probably
get
into
trouble
for
it
yeah.
So
just
keep
me
honest
and
sign.
Please
you'll
get
it!
Thank
you,
sir
Okie
dokes.
A
So
I
worked
with
this
company,
probably
around
a
year
ago
and
they're
about
75
000
people
in
the
business,
and
they
have
a
lot
of
environments.
I
was
like
oh
man.
This
is
this
is
insane
like.
How
do
we
manage
all
the
people
accessing
this
stuff
and
they
said
Chris.
What
we
want
to
do
is
we
have
about
I,
don't
know
40
50
countries
where
people
are
coming
from
at
the
time
database.
Sorry,
the
maker
experience
didn't
have
an
environment
filter
which
was
not
great.
A
So
when
you
log
on
as
a
maker,
you
get
assaulted
with
what
I
would
kind
of
call
this
experience.
Yeah
now
imagine
you
have
75
000
people
accessing
the
maker
experience,
so
this
is
where
this
all
stemmed
from
okay,
so
anywho
we
were
like
okay.
Well,
how
do
we
do
this?
How
do
we?
How
do
we
control
where
people
make
stuff
and
if
you
know,
governance
and
Power
Platform?
There
are
only
three
questions
you
ever
need
to
ask:
who
is
making
stuff?
Where
are
they
making
stuff
and
what
are
they
making?
A
If
you
can
answer
those
three
questions,
congratulations,
you've
done
governance
rights,
Okay,
so
first
things
first,
is
we
found
this
really
cool
piece
of
functionality?
Called
groups
teams
brought
from
you
brought
you
from
the
same
people
that
made
teams
teams
right
and
groups
teams
is
actually
a
really
cool
set
of
security
that
you
can
use
in
low
code
to
do
some
stuff.
The
second
thing
we
did
was
we
built
our
own
custom
environment
pickup,
because
the
maker
experience
wasn't
cutting
the
mustard
for
us,
okay,
I'm,
going
to
show
you
how
to
do
this
today.
A
So
first
things.
First,
if
you
understand
that
the
the
kind
of
security
layers
and
Power
Platform,
it
is
not
limited
to
five
there's
lots
of
stuff
that
happens
in
between,
but
these
are
kind
of
like
the
five
core
things.
One
of
the
key
things
that
I
always
look
at
is
well.
Do
I
need
diverse
or
not,
and
the
answer
is
you
always
need
better
list
and
I'll
tell
you
why?
A
Because
first
of
all,
it
is
not
just
a
database,
it
is
a
governance
tool
that
gives
you
lots
of
really
good
stuff
in
an
environment
to
do
management
of
the
way
in
people
into
sorry
the
way
in
which
people
interact
with
the
environment.
Okay,
so
how's
that
called
their
divorce
study
of
us
work.
If
I
don't
have
database
I,
don't
get
Alm
I,
don't
get
all
the
good
stuff,
but
also
I
don't
get
to
control
as
much
of
the
people
who
are
accessing
things
new
or
not.
A
A
So
all
good
and
well,
why
do
I
have
a
picture
of
a
waterfall?
Let
me
explain
it's
actually
quite
simple:
when
people
ask
me
how
did
how
dataverse
security
works,
it
is
really
around.
You
know
it
looks
a
bit
like
a
waterfall
to
me
and
did
you
know
whenever
you
create
a
database
environments?
Two
things
happen.
The
first
thing
is
you
get
an
organizational
business
unit
and
that
is
the
thing:
the
umbrella
of
the
whole
business
units,
and
then
you
get
given
a
bunch
of
users.
A
You
can
either
do
the
security
at
the
environment
level,
using
a
security
group
as
a
call
or
you
can
leave
it
completely,
have
everyone
in
the
environment
and
then
control
how
they
access
things
through
user
roles.
Everyone
happy
with
that.
So
unless
you
really
wants
to
assign
user
roles
one
by
one
to
a
user
which
is
a
pain
in
the
ass,
you
have
to
use
something
called
groups
teams
or
the
xrm
toolbox,
plug-in
hat
that
works
pretty
well
as
well.
A
So
the
way
I
see
it
is
that
it
is
kind
of
like
standing
on
a
waterfall.
The
people
at
the
top
can
see
everything
down.
The
people
on
the
bottom
can
see
straight
to
that,
but
they
can't
see
up
and
you
can
control
the
way
in
which
they
interact
with
data.
This
model
has
been
in
database
for
years
and
years
since
I've
been
around
the
Syria
in
version
three.
So
obviously,
when
Microsoft
Pride
dataverse
out
of
the
cold
dry
hands
of
the
Dynamics
Team,
but
yeah
we
got
this
now.
A
The
other
cool
thing
is:
you
can
build
your
database
structures
out
from
a
security
perspective
using
these
business
units
and
every
time
you
make
a
business
unit
you
get
given
a
team.
This
is
important.
The
team
has
effectively
the
mechanism
to
house
the
users
and
the
business
units
the
umbrella
that
creates
the
invisible
walls
between
the
data.
A
What's
also
cool
is
you
can
have
sub
business
units
as
well
now
in
tools
like
Dynamics.
This
is
really
useful,
especially
when
you're
dealing
with
things
like
sales
and
customer
service,
because
it
gets
big
right
and,
if
you're
dealing
with
a
global
organization,
you
have
to
segregate
my
country
by
region,
and
you
can
do
this
using
the
business
units.
A
A
This
solves
a
lot
of
problems
in
places
like
Banks
right
or
we
have
organizations
with
large
sales
regions
of
people
and
kind
of
silos.
There's
always
a
use
case
for
firing
through
that
data.
Lane,
I
promise
I'll
get
to
the
point
of
why
this
environment
pick
a
thing
came
up
so
we're
like
okay,
so
number
one.
A
Do
we
make
one
giant
environment
and
do
we
say,
okay,
everyone
put
all
your
data
in
there
and
then
we'll
disagree
it
through
business
units
or
do
we
create
lots
of
environments
and
use
the
localized
data
structures
in
that
way?
And
that's
what
we
did?
We
had
localized
environments.
We
didn't
just
Hammer
everything
into
one
dataverse
environment.
If
you
do
that,
you
will
create
a
massive
data
overhead
for
yourselves,
okay.
A
So
a
couple
other
things
that
came
up
there
are
three
core
roles
in
dataverse
that
you
need
to
care
about.
Those
the
only
three,
the
rest
of
it:
kind
of
just
bolts
onto
the
side
and
the
three-year-olds
are
your
environment
maker
role,
your
assistant,
customize,
the
role
and
your
system,
admin
role,
and
the
whole
idea
is
that
environment
maker
is
supposed
to
give
makers
the
ability
to
make
applications
but
not
straddle
the
database,
whereas
the
customizer
all
bolts
onto
the
bottom
of
the
make
role
to
give
you
dataverse
access,
and
then
you
have
the
system.
A
Admin
which
is
kind
of
most
people
in
the
room
would
be
my
guess.
So
when
you
look
at
the
roles,
it
starts
getting
really
interesting.
So
the
first
thing
is
a
couple
of
gotchas
defaults
environments.
Every
user
in
the
default
environment
is
in
your
business
has
got
an
environment
maker
and
a
basic
user.
When
you
actually
open
up
those
roles,
the
basic
user
has
more
rights
to
dataverse
than
the
environment
maker
right.
So
explain
that
one.
A
So
if
you
want
to
type
default,
environments
has
got
a
database
which
it
likely
will
have,
because
somebody
is
a
running
approval
flow
or
you
know,
file
that
database
up
in
there.
You've
got
a
problem
because
that
basically
means
your
basic
users
are
accessing
this
data
structure.
Anyway,
that's
just
to
buy
the
buy.
A
So
how
does
this
all
work?
Well,
let
me
give
you
a
quick
peek
effectively
inside
dataverse.
You
can
pop
into
your
Power
Platform
admin
sensor.
Select
your
environments
and
you've
got
all
your
goodies
over
here.
Okay,
I'm
not
going
to
go
through
all
of
them,
but
it's
relatively
straightforward.
So
users
be
users.
Users
are
either
added
one
by
one
or
through
ad
groups.
Okay,
the
next
thing
is
you've
got
your
business
unit
structure
and
users
belong
in
business
units.
We
can
all
agree
that
right
and
the
third
thing
is
you've
got
teams.
A
Now
teams
is
where
I'm
really
going
with
this,
because
business
units
are
cool,
but
they
complicate
the
hell
out
of
things.
So
did
you
know
you
can
create
a
thing
called
a
groups
team
where
you
can
actually
connect
to
an
Azure
ID
group
assign
that
group's
team
security
roles
and
users
they're
not
added
to
their
groups,
team
or
removed
to
their
groups
team
from
ad?
It's
a
very,
very,
very
cool
feature
so
effectively.
A
All
that
you're
already
doing
is,
if
I
say,
create
a
team
I'm
going
to
give
it
a
name
whatever
it
doesn't
matter
the
business
unit.
You
can
select
from
your
set
of
business
units,
so
you
can
have
an
entire
data
structure
linking
up
to
aab
security
groups
and
controlling
the
groups
through
aad,
rather
than
directly
a
dataverse
praise
the
Lord
right.
So
you
don't
have
to
worry.
You
don't
have
to
have
the
Power
Platform
admin
doing
it.
A
A
There
we
are,
and
the
team
type
you've
got
your
AED
Security
Group.
So
all
I
do
is
pop
it
in
there
select
governance,
because
I've
got
an
AED
group
of
governance
and
we're
bam.
What
I'll,
then
do
is
I'll
select
my
security
role.
Now
this
is
where
it
starts
getting
super
weird.
Did
you
know
that
of
those
three
security
roles?
There
are
sorry
there
are
only
three
security
roles
that
allow
users
to
go
to
make.powerapps.com
and
actually
see
the
environments.
You
cannot
see
environments
if
you
have
a
custom
role,
it
will
not
work.
A
You
can
only
use
environment
maker
system,
customizing
system
admin.
Yes
next
thing
who
controls
the
security
rules?
None
of
you
all
do
Microsoft
do
and
what
happens
if
you
change
the
security
role,
yeah
change
will
not
persist.
If
Microsoft
make
an
update
against
that
role,
it
will
likely
break
so
what
now
we
have
a
problem
because
of
Microsoft
control,
all
the
security
rules
and
control
UCS
make
the
powerapps.com
as
admins
you.
We
have
a
bit
of
an
issue,
so
I
found
a
way
around
it,
of
course.
A
So
what
we
did
was
we
said:
okay,
that's
fine.
We've
got:
we've
got
groups
teams
just
by
the
way
to
let
you
know,
groups
teams
is
a
real
thing.
He
has
the
security
page
with
it
on
c
groups.
Teams
right
it
actually
is
a
real
thing
and
they
named
it
that
anyway,
so
what
I
did
was
I
thought:
okay,
I
have
a
bunch
of
users
looking
to
access
makeup,
powerapps.com
they're,
probably
not
going
to
go
to
the
maker
experience.
A
What's
the
best
way
to
do
it,
so
we
make
a
custom
roll
called
Chris
environment
maker,
and
we
save
it
now,
here's
the
thing
they
can't
go
to
the
maker
experience
to
see
that
custom
role
and
because
they
can't
they
have
the
custom
role
that
I'm
controlling
that
will
persist
with
updates.
How
do
we,
how
do
they
get
access
to
make.powerapps.com?
A
This
is
where
the
interesting
book
comes
in.
We
decided
that
using
groups
teams,
we
would
have
a
massive
control
sensor
in
Azure,
making
sure
that
those
users
behave
themselves,
and
then
we
thought.
Actually
you
know
what,
if
you
go
into
the
center
of
excellence,
starter
kit
and
you
look
in
that
model
driven
app.
What
can
you
get
you
get?
A
You
can
obviously
obfuscate
that
if
you
really
want
to
users,
never
have
to
see
that
it's
really
easy
to
do,
and
you
can
do
your
three
screener
create
a
map
right
bam,
it's
going
to
give
it
a
random
name
cool
and
what
will
happen
I'm
going
to
do
what
they
do
in
those
baking
shows.
You
know
I'm
going
to
put
a
chick
that
they
marinated
chicken
put
it
in
the
oven
in
one
second
to
take
it
out.
Yeah
watch
this
boom
right
there.
It
is
so
this
is
a
custom
environment
picker.
A
A
Now
the
one
thing
to
hear
just
as
a
heads
up,
if
you
take
the
approach,
just
be
careful,
you
have
you
risk
business
unit
Armageddon
and
you
also
risk
Azure
ad
group
Armageddon.
Okay,
it's
a
great
way
managing
people
in
the
business,
but
also
it's
going
to
happen
anyway.
Right
people
are
going
to
be
accessing
either
directly
through
dataverse,
so
you
can
control
the
role
there
or
why
not
just
put
it
on
the
backs
of
our
Azure,
for
instance,
to
manage
in
aad
so
that
that's
that
folks,
that
was
fun.