Record and column level security for owner vs non-owner (MDA)

[MattB_Motive]

Hi

We have a requirement to allow the owner of a record to edit all columns, and all other users to be able to edit one column and read all others. It's like a mix of record-level and column-level security.

Is this possible? What options are there?

(I know JavaScript could be used to make fields read-only/editable based on the logged-in user, but this is only client-side - are there any server-side or more secure solutions?)

Thanks

Matt

[dpoggemann]

Hi @MattB_Motive 

You can utilize field level security profiles to accomplish this in Dataverse.  This is true security that will control access from everything to the front-end, apis, etc. controlling who can have access to the data within the fields.  

Column-level security - Power Platform | Microsoft Learn

[MattB_Motive]

Thanks Drew.

I'm not sure that column-level security can differentiate between an owner of a record and non-owner.

Using record-level security we can set it so only the creator/owner of the record can edit the full record (read-only for everyone else). Applying column-level security so that members of the security profile can update a column doesn't override the record-level security (i.e. if the record is read-only, column-level security allowing updates doesn't work).

Am I missing something?

[dpoggemann]

Hi @MattB_Motive ,

Ahhh, understand your predicament.  

Field Level Security will apply to all records, not the owner / non-owner situation so agreed.  I don't think you can accomplish what you are trying to do with standard functionality.  I would probably do the following:

1. Create a table with all the fields that you need to secure to only the owner of the records. 
2. Setup this table as a relationship to the table with the standard fields that all users can utilize.  1:N relationship from the standard table (with fields everyone can see) to the one that is secured to only the owner.
3. Setup security on the secured one is User level to view, edit, etc. so only owners can view the records.
4. Setup security on the other table so it might be business unit or organization level.

This will hopefully cover your needs.  If you want to have other people collaborate on the specific records that are "Secured" down to the user level then you can actually use Access Teams to provide the ability to dynamically identify additional users (outside of owners) to work with those records, they will see all the fields though...

[PatrickDamborg]

To achieve what you're asking, you could use a power automate flow and share the record with an unbound action. This grants access both on the client-and server side, but it is definitely not best practice, and I would advice you to advice for a different process rather than breaking your back in order to meet this requirement. 

Can you provide more context on the exact case, you're working with? 

To accomplish what you're asking, I would create a table called ParentTable_Sensititive_info. 

Create a 1:1 relationship between the two. 

Add the sensitive columns to that table (The ones which only the owner is allowed to edit). 

Set up the security on the sensitive information table to user-only. 

Set the security on the parent table as required. 

If you need a more tangible solution, please share more about your case.