Dynamics 365 security and compliance: who can see what, how it is logged and what Microsoft covers

Microsoft runs the data centers, the platform, patching, backups and encryption, and publishes its certifications and audit reports on the Service Trust Portal. Those reports are what your auditors ask for when they want proof that the cloud service is controlled.

Everything about who can do what inside your environments is yours: user accounts, roles, sharing, integrations, connectors and logging. A Dynamics 365 tenant can be fully compliant at Microsoft's layer and still let every salesperson export every customer. That is the part this guide covers.

In Sales, Customer Service and other Dataverse apps, a security role grants privileges on each table, such as read or write, at a depth: the user's own records, their business unit, the units below it, or the whole organization. A user's access is the sum of all their roles and team roles, so one broad role undoes several careful ones.

Field-level security hides individual columns from everyone outside a profile. Finance and operations apps use their own role-based security with roles, duties and privileges, and support segregation of duties rules so one person cannot both create a vendor and pay it.

Dataverse encrypts data at rest and in transit by default with Microsoft-managed keys. Companies with stricter rules can use a customer-managed key held in their own Azure Key Vault, which is available for Managed Environments.

Customer Lockbox adds a step where your administrators must approve before a Microsoft engineer can access your data during a support case. Both features have licensing conditions, so check them against your plan before you promise them to an auditor.