Question 160
A Microsoft Power Platform deployment team observes: A cross-regional case task force needs access to selected records, but the maker assigns a broad organization-wide security role. Which TWO complementary steps are appropriate: the recommended configuration action and its most direct independent verification evidence? Select TWO answers.
Explanation
Correct Answers
The required configuration response is: Choose an owner team, access team or Entra group team as appropriate, and apply column security profiles on eligible sensitive fields in addition to row access. In this scenario: A cross-regional case task force needs access to selected records, but the maker assigns a broad organization-wide security role. The relevant technical behavior is: Owner teams can own records and carry roles, access teams grant shared record access, and column security adds protection only after underlying record access exists. The appropriate implementation is: Choose an owner team, access team or Entra group team as appropriate, and apply column security profiles on eligible sensitive fields in addition to row access. Independent validation: Compare team type and membership, record sharing, role privileges, column security enablement and controlled employee-field access attempts. Accept only when: Team access and sensitive-column visibility match least-privilege test personas even as authorized group memberships change.
The most direct evidence is: Compare team type and membership, record sharing, role privileges, column security enablement and controlled employee-field access attempts. In this scenario: A cross-regional case task force needs access to selected records, but the maker assigns a broad organization-wide security role. The relevant technical behavior is: Owner teams can own records and carry roles, access teams grant shared record access, and column security adds protection only after underlying record access exists. The appropriate implementation is: Choose an owner team, access team or Entra group team as appropriate, and apply column security profiles on eligible sensitive fields in addition to row access. Independent validation: Compare team type and membership, record sharing, role privileges, column security enablement and controlled employee-field access attempts. Accept only when: Team access and sensitive-column visibility match least-privilege test personas even as authorized group memberships change.
Incorrect Answers
This is an unsafe or unsupported shortcut: Assume an access team owns rows and receives its own security role, or that column security alone grants permission to otherwise inaccessible records. It fails to address Dataverse owner teams access teams and column protection. In this scenario: A cross-regional case task force needs access to selected records, but the maker assigns a broad organization-wide security role. The relevant technical behavior is: Owner teams can own records and carry roles, access teams grant shared record access, and column security adds protection only after underlying record access exists. The appropriate implementation is: Choose an owner team, access team or Entra group team as appropriate, and apply column security profiles on eligible sensitive fields in addition to row access. Independent validation: Compare team type and membership, record sharing, role privileges, column security enablement and controlled employee-field access attempts. Accept only when: Team access and sensitive-column visibility match least-privilege test personas even as authorized group memberships change.
This response applies to the different subject of Dataverse activity tables and timeline records, rather than directly to Dataverse owner teams access teams and column protection: Choose supported activity tables and activity relationships for time-based interactions, and configure the timeline to surface relevant activities.. In this scenario: A cross-regional case task force needs access to selected records, but the maker assigns a broad organization-wide security role. The relevant technical behavior is: Owner teams can own records and carry roles, access teams grant shared record access, and column security adds protection only after underlying record access exists. The appropriate implementation is: Choose an owner team, access team or Entra group team as appropriate, and apply column security profiles on eligible sensitive fields in addition to row access. Independent validation: Compare team type and membership, record sharing, role privileges, column security enablement and controlled employee-field access attempts. Accept only when: Team access and sensitive-column visibility match least-privilege test personas even as authorized group memberships change.
This response applies to the different subject of Dataverse search scope and indexing, rather than directly to Dataverse owner teams access teams and column protection: Inspect search availability, table search settings, searchable field configuration and query outcomes after indexing has caught up.. In this scenario: A cross-regional case task force needs access to selected records, but the maker assigns a broad organization-wide security role. The relevant technical behavior is: Owner teams can own records and carry roles, access teams grant shared record access, and column security adds protection only after underlying record access exists. The appropriate implementation is: Choose an owner team, access team or Entra group team as appropriate, and apply column security profiles on eligible sensitive fields in addition to row access. Independent validation: Compare team type and membership, record sharing, role privileges, column security enablement and controlled employee-field access attempts. Accept only when: Team access and sensitive-column visibility match least-privilege test personas even as authorized group memberships change.


