Dataverse Opportunity Security: User vs Organization Access Levels
Short answer
Sales representatives use User-level access on Opportunity (Create, Read, and Write limited to records they own), while sales managers use Organization-level Read on Opportunity to see every opportunity in the environment.
Question
A company plans to use Microsoft Dataverse to manage sales opportunities. Records will contain confidential financial data that should only be accessible to specific groups of employees.
You have the following requirements:
Sales representatives must only view and update records they create.
Sales managers must have visibility into all opportunities within their organization.
You need to configure security.
Which configuration should you use? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Key Takeaways
The question tests Dataverse access-level scoping—ownership versus organization-wide visibility—and the trap is confusing a manager's organization requirement with business-unit access or overgranting representatives.
This AB-410 scenario tests Dataverse Opportunity security roles: sales representatives need user-level access to owned records, while sales managers need organization-level visibility. The correct configuration pairs User-level access for representatives with Organization-level access for managers.
Common mistake: A common mistake is assigning Business Unit access to sales managers because “organization” sounds local, or giving representatives Organization-level access; both break the least-privilege ownership boundary.
Expert Analysis
The boundary is ownership scope Dataverse security roles combine a privilege, such as Read or Write on the Opportunity table, with an access level that determines which records the privilege reaches. The critical distinction in this scenario is not the user's job title but the ownership scope that the requirement describes. Sales representatives must only view and update records they create, so the role must grant Create, Read, and Write on Opportunity at User level. That level limits access to records the user owns, which is exactly the stated boundary.
Why managers need Organization level Sales managers must see all opportunities within their organization. In Dataverse access-level terms, Organization level covers all records in the environment, whereas Business Unit level would restrict visibility to the manager's business unit. Because the requirement says all opportunities within their organization, the manager role should grant Read on Opportunity at Organization level. The correct configuration is therefore User-level access for sales representatives and Organization-level access for sales managers.
Least privilege and the trap The tempting wrong move is to grant Organization-level access broadly because managers need wide visibility, then let representatives inherit more than their own records. Another trap is treating “organization” as synonymous with “business unit.” The comments on this item describe the first selection as access only to owned records and the second as all records in the table, which matches the Dataverse access-level mapping. Keep the manager privilege to Read unless the business requirement explicitly adds update rights, and scope each role independently so confidential financial data stays limited.
Official Reference
- https://learn.microsoft.com/en-us/power-platform/admin/security-roles-privileges
- https://learn.microsoft.com/en-us/power-platform/admin/wp-security-cds
These links open the official vendor documentation in a new tab.
Exam Strategy
For Dataverse security questions, translate scope words directly into access levels: records the user creates or owns means User, a department or division means Business Unit, and all records in the environment means Organization. Then separate the privilege from the scope—Read for visibility, Write only when updates are required. Do not let a broad job title push you to a broader access level than the wording actually states.
Frequently Asked Questions
Why not give sales managers Business Unit access instead of Organization access?
Should sales representatives receive Organization-level Read if they only need their own records?
Does granting Read at Organization level also allow editing?
Discussion 2 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 2
-
aed747e 👍 31. User-level acces: Only access to owned records 2. Organization-level access: All the records in the table
-
exam_upskill 👍 11. User-level access 2. Organization-level access
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.