Dataverse tables and security roles
Dataverse is the standard data platform for Power Platform. Questions about it are common because it ties together apps, flows, security and Dynamics 365.
Tables, columns and rows
Data is stored in tables (formerly entities). A table has columns (formerly fields) and rows (formerly records). Dataverse ships with standard tables such as Account and Contact from the Common Data Model, and you can add custom tables.
Column types include text, number, choice (formerly option set), date, lookup and file. A lookup column creates a relationship to another table.
Relationships
- One-to-many (1:N): one account has many contacts.
- Many-to-one (N:1): the reverse view of the same link.
- Many-to-many (N:N): many rows relate to many rows.
Calculated and rollup columns
A calculated column computes a value from other columns in the same row. A rollup column aggregates related rows, such as the total value of all open opportunities. Rollups update on a schedule, not instantly.
Business logic without code
| Feature | Purpose |
|---|---|
| Business rule | Simple validation, defaults, show/hide fields |
| Business process flow | Guides users through stages |
| Cloud flow | Automation triggered by row changes |
| Plug-in | Custom code, for developers |
Security model
Dataverse security is role-based:
- Security roles define privileges (Create, Read, Write, Delete, Append, Assign, Share) per table.
- Each privilege has an access level: User, Business Unit, Parent: Child Business Units, or Organization.
- Business units group users and set the boundary of data visibility.
- Teams can own rows and hold roles.
- Column-level security uses field security profiles to protect single columns.
The smallest unit you can secure is a column, and row-level access comes from ownership and role access levels.
Common built-in roles: System Administrator (full control), System Customizer (customize without data access to others’ rows), Environment Maker (build only, no data), Basic User (use apps with own data).
Exam traps
- Environment Maker lets a person build, not read data. Data access needs a role such as Basic User.
- Row-level security in Dataverse is not the same as row-level security in Power BI.
- Business rules are no-code; plug-ins are code.
- Old names still appear: entity = table, field = column, record = row, option set = choice.
- Dataverse is not required for every app; SharePoint, Excel and SQL work too, but you lose the built-in security model.
Practice questions
Choose an answer, then review the explanation to check your understanding.
1. An app must store data securely in the cloud and enforce row-level access. Which data service should you choose?
Show answer
Answer: A.Dataverse has a built-in security model with tables, relationships and role-based access to rows and columns.
2. A column in a table holds salary data that only HR may read. What feature restricts access to that single column?
Show answer
Answer: B.Column-level security (field security profiles) limits who can read or write specific columns.
3. A new developer needs to build apps in an environment but must not see company data. Which role fits?
Show answer
Answer: B.Environment Maker can create resources but has no access to data in Dataverse tables unless another role grants it.
4. You need a rule that makes a field required and shows an error message, without writing code. What do you use?
Show answer
Answer: A.A business rule applies simple logic such as required fields, defaults or validation without code.