Why we're building this
Every Dynamics environment starts with a clean security concept. Then reality happens: a project adds three roles because the existing ones “almost” fit. Someone gets elevated rights “just for the migration” — and keeps them. A team is copied, a business unit restructured, an admin leaves and their permissions live on. None of these steps is a mistake on its own. Together, after a few years, they add up to a system where nobody can say with confidence what a single user can actually see and change.
Most of the time, that's an invisible problem. Until it isn't: an auditor asks who can access customer data, and the honest answer would take days. A data protection officer wants to know why a departed contractor still shows up in the user list. A security review finds privileges nobody remembers granting. The information exists — scattered across roles, teams, business units and column-level settings. What's missing is a way to read it.
That's the gap the Security Suite closes: it turns the security model you already have into something you can actually see, question and clean up — the same way xRM Audit made your data changes readable and Data Guard made your data quality enforceable.
How it works
See who can access what in Dataverse — and why. Change it safely, with proof.
Security Health surfaces critical privileges, disabled users who still hold roles, application users without roles, orphaned shares and gaps in audit coverage.
Access Explain lists every table, every privilege and every depth for a user or team — and names the role or team each one comes from.
The Impact Simulator combines up to 25 changes and shows exactly who gains or loses which rights — before anything happens.
Change requests run through four-eyes approval, enforced on the server rather than in the interface. Approving and applying stay separate steps.
Role Studio warns before you create a near-duplicate role. Role Mining proposes a cleaner model from the access people actually have.
The auditor export generates your permissions concept as Word and PDF, straight from the live model.
Understand access
Your business units, teams and roles as an interactive org chart, with layers for roles, teams, shares, walls and reach.
Why can Anna see this record? Five path types — role, team, ownership, share and cascade — plus hierarchy, shown as a path.
Why can’t Javier open this record, and what exactly would grant him access.
Ask “who can delete accounts organisation-wide?” and get the list, with the reason for each person.
How many records a user can reach, how many of them hold personal data, how many sit outside their own unit — compared to their peers.
Ask in plain language, in the app or in Microsoft 365 Copilot. Read-only, answered from your snapshot, always with a link to the evidence.
Find what’s wrong
Checks for critical privileges, disabled users with roles, app users without roles, orphaned shares, default teams with admin rights and audit coverage. Accept a finding with a reason and it leaves the score.
Plug-in steps that run as an admin, flows on personal connections, custom APIs without an execute privilege, AI agents — who acts with whose rights.
Every share, including shares across walls and shares still held by disabled users.
Which columns hold sensitive data and should be secured.
Change safely
Combine up to 25 steps and see exactly who gains or loses which rights. Lockouts and wall breaches are flagged before you submit.
Always, critical changes only, or off. Enforced on the server, not just in the interface — approving and applying are separate steps.
The Suite refuses any change that would leave you without an interactive administrator.
Users request roles themselves; time-limited access is removed automatically when it expires.
Run a change at a set time, and undo it as a new request.
Move role packages between environments as a reviewed request.
Prove it
Define walls between business units or teams, find every existing path across them, and block shares, team memberships and owner changes across the wall — also in the standard Dynamics interface. Per wall: off, report only, or block.
Every security change made outside the Suite is detected, rated and reported — with who, what and when.
Block direct role changes outside the Suite in production.
Compare a user’s access between any two snapshots.
Periodic recertification by the responsible managers. “Remove” creates a request rather than a silent change.
Permissions concept as Word and PDF documents, generated from the live model.
Frequently asked questions
We don’t announce dates before we’re sure we can keep them. Leave your contact below and you’ll get exactly one mail at launch.
Yes. A small group of organizations will get the Suite before general availability — in exchange for honest feedback.
That is what the Impact Simulator is for. Combine up to 25 steps, see who gains or loses which rights, and only then submit. Lockouts and wall breaches are flagged before anything happens.
Guardrails and Prod-Lock block direct role changes in production. Anything that still happens outside the Suite is picked up by the Watchdog, rated and reported with who, what and when.
No. Like Audit, Data Guard and Translation Studio, the Security Suite runs Dataverse-native inside your environment. AI is optional and runs on your own Azure OpenAI or Anthropic key.
It reads as system and writes as you: every change runs with your own rights and is fully audited.
Audit answers “who changed what”, the Security Suite answers “who can do what”. Data Guard decides what may be written in the first place.
One mail at launch, early access if you want it, zero spam. Tell us you're interested and we'll take it from there.
Get notified at launch →Already shipping
The Security Suite joins a family that already covers audit, data quality and translations — all Dataverse-native, all on Microsoft AppSource.
Welcome to the fascinating world of
xRM Products, get to
know us and our products now!
© 2026 xRM Products LLC
