How to Set Up Field-Level Security in Dynamics 365 Step by Step

You must keep private data safe in Dynamics 365. Field-Level Security lets you choose who can see or change key information. Many companies use this tool to follow strict rules. Dynamics 365 uses data encryption for private fields, which helps meet FIPS 140-2 rules. This is a government rule that needs strong ways to protect data. Using field-level security helps keep your company’s data safe and legal. You can set up these rules without being a tech expert.

Key Takeaways

• Turn on field-level security for important fields. This helps control who can see or change private data in Dynamics 365.

• Make security profiles to group permissions together. Give these profiles to users or teams so it is easier to manage.

• Set clear rules for reading, creating, and updating data. This makes sure users only get the data they need.

• Check your security settings often and review them. This keeps data safe and helps you follow the rules.

• Do not secure too many fields. This helps the system run well and stops it from getting slow.

Prerequisites

Roles Needed

You need special permissions before you set up field-level security in Dynamics 365. Only some users can change security settings. You must be a system administrator or a security administrator. These roles let you use security configuration and privilege management. You will find these in the security settings area.

When you change field-level security, you use privileges. Privileges decide what users can do with data. This includes reading, creating, updating, or deleting. Do not change the default roles right away. Make a copy of the privilege and change the copy. This keeps your system safe and makes changes easier to handle. Only users with the right security jobs should see or change these settings.

Tip: Always check who can use security roles. This helps you keep sensitive data safe and stops mistakes.

Supported Fields

Not all fields in Dynamics 365 can use field-level security. You need to know which fields you can protect before you start.

• You can turn on field-level security for most default system fields and custom fields.

• You can protect fields on both standard and custom entities.

• Lookup fields do not work with field-level security.

• Calculated fields and rollup fields cannot be protected.

• Some system fields, like IDs, timestamps, and record tracking, are not included.

• Option Set (Choice) label values cannot be protected, even if the value is protected.

You should decide which fields need more protection. If you try to protect a field that does not support this, Dynamics 365 will not let you. Always check the field type before you start.

Note: Protecting too many fields can slow down your system. Only protect fields with sensitive or important data.

Field-Level Security Setup

Enable on a Field

You can keep important data safe in Dynamics 365 by turning on Field-Level Security for a field. This lets you pick who can see or change special information. Here are the steps to turn on Field-Level Security for a field:

1. Go to Settings and pick Advanced Settings.

2. Open your solution and find the entity with the field you want to protect.

3. Click Fields to see all the fields for that entity.

4. Pick the field you want to keep safe. You can do this for most default and custom fields.

5. In the field’s properties, look for Field-Level Security and set it to Enabled.

6. Save what you changed.

7. Publish your changes so they work.

Tip: System administrators can always see all fields, even if you turn on Field-Level Security. You cannot stop them from seeing fields.

You can use Field-Level Security on both default and custom fields. Default fields show up in security settings, so you can turn on security easily. Custom fields might not show up right away in the security screen. This is a known problem in Dynamics 365. If your custom field is missing, try refreshing or checking for updates. Sometimes, you need extra steps to protect custom fields, but default fields usually work right away.

Note: Some fields, like lookup fields or calculated fields, do not work with Field-Level Security. Always check if your field type works before you start.

Use Advanced Settings

Advanced settings let you control how Field-Level Security works in your system. You can use these settings to decide who can read, create, or change data in protected fields. But there are some things you should know:

• Field-Level Security can be skipped if some triggers are turned off. Only trusted users should use advanced tools.

• Scripting for Field-Level Security was removed to stop security problems. This helps keep your data safe from bad scripts.

• Sometimes, other code in the user interface can change Field-Level Security settings. For example, if you use custom scripts to hide or show fields, these scripts might not follow your security rules.

• Stopping users from saving records through the user interface is hard. Hiding the Save button does not stop all ways to save a record.

• System dialogs, like saving dialogs, do not follow Field-Level Security rules. These dialogs work outside normal security controls.

• If you use multicurrency fields, you may need to protect each related field one by one. Sometimes, you need extra tools to hide fields instead of just using Field-Level Security.

Tip: Always check your advanced settings after you make changes. Test your security setup to make sure users only see what they should.

Field-Level Security helps keep important data safe, but you must use it the right way. If you do not set permissions clearly, users might see too much data. Too many or too few permissions can slow down work or cause confusion. Always plan your security settings and check them often.

Security Profiles

Field-Level Security in Dynamics 365 uses security profiles to control who can see or change protected fields. You use these profiles to group permissions and assign them to users or teams. Each profile lets you decide who can read, update, or create data in specific fields. This section will guide you through creating a profile, adding fields, and assigning users or teams.

Create Profile

You start by making a new security profile. This profile will hold the permissions for your protected fields. Follow these steps:

1. Make sure you have the System Administrator role or similar permissions.

2. Go to the Settings icon and choose Advanced Settings.

3. Open Security and select Field Security Profiles.

4. Click New to create a profile.

5. Enter a name and a short description for the profile.

6. Save your changes.

Tip: Use clear names and descriptions. This helps you and your team remember what each profile controls.

Add Fields

After you create a profile, you need to add the fields you want to protect. You can add both default and custom fields that support Field-Level Security. Here is how you do it:

1. In your new profile, find the Field Permissions section.

2. See a list of fields that support Field-Level Security.

3. Select a field you want to secure.

4. Click Edit to open the permissions window.

5. Set the access rights for this field. You can allow or block Read, Update, or Create actions.

6. Click OK to save your choices.

7. Repeat these steps for each field you want to protect.

You control exactly what users can do with each field. For example, you might let some users read a field but not change it. You might let others update or create data in that field.

Note: Always review which fields you add. Protect only the fields that need extra security. Too many protected fields can slow down your system.

Assign Users or Teams

Now you need to give access to the right people. You do this by adding users or teams to your security profile. Here is how:

1. In the profile, go to the Members section.

2. Choose whether you want to add Users or Teams.

3. Click Add and search for the users or teams you want.

4. Select them and click Add again to confirm.

You can add as many users or teams as you need. Each person or group you add will get the permissions you set in the profile. If you need to remove someone, you can do that from the same screen.

Tip: Assign profiles to teams when possible. This makes it easier to manage permissions as your organization grows.

Summary Table: Security Profile Steps

Field-Level Security profiles give you strong control over sensitive data. You decide who can see, change, or add information to each protected field. This helps you keep your data safe and follow company rules.

Permissions Management

Managing permissions for secured fields in Dynamics 365 helps you control who can see or change important data. You use Field-Level Security profiles to set these permissions. You should review and update permissions often, especially when user roles change.

Set Read Rights

You can decide who can view a secured field by setting read rights. Follow these steps to set read access for a field:

1. Go to Settings and select Security.

2. Open Field Security Profiles.

3. Choose an existing profile or create a new one.

4. Add users or teams to the profile.

5. In the profile, find the field you want to secure.

6. Click Edit next to the field.

7. Turn on the Allow Read permission.

8. Save your changes.

When you set read rights, only users or teams in the profile can see the field’s data. Others will not see the field at all. You can use this to protect sensitive information, like social security numbers or salaries.

Tip: Always test your settings by logging in as a user with the profile. Make sure only the right people can see the field.

Set Create and Update

You can also control who can add or change data in a secured field. To set create and update permissions, follow these steps:

1. Make sure field-level security is enabled for the field.

2. Open the right Field Security Profile.

3. Find the field and click Edit.

4. Turn on Allow Create if you want users to add data.

5. Turn on Allow Update if you want users to change data.

6. Save your changes.

You can give different permissions to different users or teams. For example, some users may only read the field, while others can update it.

Note: Users must have access to the main record to use these permissions. If you remove create or update rights, users can still see the field if they have read rights, but they cannot change it.

Reviewing and Updating Permissions

As your team grows or changes, you should review permissions often. Use this process:

1. Check which security roles each user has.

2. Decide what access each user needs for their job.

3. Use tools like Security Diagnostics to find the right privileges.

4. Update roles or profiles as needed.

5. Test permissions by simulating user access.

6. Audit permissions regularly to keep your data safe.

Tip: Always follow the principle of least privilege. Give users only the access they need. This keeps your system secure and helps you meet compliance rules.

Best Practices

Audit and Review

You need to check your field-level security settings often. Doing regular checks helps you find problems early. First, sign in to the Power Platform admin center with the right permissions. Go to Security, then Compliance, and click the Auditing tile. Pick the environment you want to check. Turn on auditing and choose what data to track. Decide how long to keep audit logs. These logs go to the Microsoft Purview compliance portal. You can watch user activity there.

Here is an easy way to audit field-level security:

1. Match user roles to their job tasks.

2. Only give users the access they need.

3. Turn on multi-factor authentication for everyone.

4. Check audit logs for any strange access.

5. Change security rules as your business grows.

6. Teach workers about security risks.

Tip: Check your field-level security settings every three to six months. This keeps your system safe and current.

Performance Tips

Field-level security adds extra checks each time a page loads. Too many protected fields can slow things down. You can keep your system fast by using these tips:

• Keep fewer than 75 fields on a form.

• Use Business Process Flows to show more fields only when needed.

• Use five or fewer tabs on a form.

• Collapse all tabs except the first one when the form opens.

• Use read-only controls instead of editable fields if you can.

• Remove controls you do not use, like Social Pane or Bing maps.

Note: Test your forms after you make changes. Testing early helps you find and fix slow pages.

Compliance

Field-level security helps you follow rules like GDPR and HIPAA. You can control who sees or edits private data, like money or personal details. Use role-based access and field-level security together to limit who sees data. Keep audit logs to track who looked at or changed data. Set up Segregation of Duties to stop conflicts of interest.

Remember: Regular checks, strong access rules, and clear user roles help you keep data private and follow the rules.

Troubleshooting

Common Issues

You might have trouble when setting up field-level security in Dynamics 365. Knowing about these problems helps you fix them faster. Here are some things that can go wrong:

• Fields do not show up in the security profile: Sometimes, your custom field is missing from the secured fields list.

• Users see fields they should not: Users might see or change fields even if you set limits.

• Permissions do not update: Security profile changes might not work right away.

• Performance slows down: Too many secured fields can make forms load slowly.

• Audit logs miss changes: Some field changes might not show up in your audit logs.

• Error messages appear: Users might get errors when saving records with secured fields.

Tip: Write down what you did before the problem started. This helps you find out what went wrong faster.

Solutions

You can fix most field-level security problems with a few easy steps. Try these ideas:

1. Refresh the Security Profile List:
   If your custom field is missing, refresh the page or clear your browser cache. You might need to publish all your changes again.

2. Check User Roles and Profile Assignments:
   Make sure the right security profile is given to the user or team. Double-check that the profile has the correct fields and permissions.

3. Test with a Different User Account:
   Log in as another user with the same role to see if the problem happens for them too. This helps you know if the issue is with the user or the profile.

4. Review Field Settings:
   Open the field’s settings and check if field-level security is turned on. Save and publish your changes again if you need to.

5. Monitor System Performance:
   Use fewer secured fields on each form. Take out fields you do not use to help forms load faster.

6. Check Audit Settings:
   Go to the auditing area and make sure field-level auditing is turned on for the fields you want to track.

Note: If you still have trouble, ask your system administrator or look at Microsoft’s support pages for more help.

You can keep your system working well by following these steps. Always test your changes before letting everyone use them.

---

To set up Field-Level Security in Dynamics 365, first pick the fields you want to protect. Next, set strict permissions for those fields. Then, make security profiles and add users or teams to them. Using best practices helps you keep important data safe and follow the rules.

Check your security settings and audit logs often to protect your data.
Keep learning by using Microsoft Learn and watch for new security updates.

FAQ

What happens if you remove a user from a security profile?

If you take a user out of a security profile, they lose access to protected fields right away. You do not have to restart the system. Always check who can see fields after you make changes.

Can you use field-level security with business rules or workflows?

Field-level security works with business rules and workflows. But system processes might not follow field-level security. Test your setup to make sure only the right users can see or change data.

How do you know if a field is secured?

You can look at the field’s properties in entity settings. Find the Field-Level Security setting. If it says "Enabled," the field is protected. You can also check the Field Security Profiles area to see secured fields.

Do field-level security settings affect reports?

Field-level security does not hide data in reports. People with report access can see all data, even protected fields. Only give report access to users who should see sensitive information.

Can you bulk assign users to a security profile?

Yes, you can add many users to a security profile at once. In the Members section, pick several users and add them together. This helps you save time and keeps your security setup neat.