In this post we've shared a series of best practice steps to protect your customer data by preventing individuals from copying CRM records to their USB stick, or sharing them on the cloud.
In just one click an employee could export an entire CRM customer database and begin contacting these contacts at their new company.
That might appear a worst-case scenario but it is real risk if you don't have an effective user security policy in place.
is a robust system to safeguard customer data but this must be carefully configured to make sure that users are granted the correct access permissions.
and we'll help you put in place a user security policy that removes this risk and gives you the peace of mind of knowing that your data is secure.
1. Prevent Data Export to Excel
The most obvious and damaging way that data theft occurs is by exporting to Excel.
CRM data can be exported to Excel from any view covering unlimited fields for each record type.
For contact records an exportable CRM view could include: names, phone numbers, email address, mail address, job title, decision making status and other segmentation.
Even more data can be transferred from CRM accounts, leads, opportunities. Perhaps even a list of active customer contracts that includes their values and expiry dates.
And, in just a few minutes irretrievable damage may be done...
2. Using Security Roles
There are a few easy adjustments System Administrators can make.
CRM security roles make sure that access to sensitive data is tightly controlled.
Security roles are a matrix of privileges and access permissions for CRM record types / entities.
Arranged under different tabs based on their functionality these include: Core Records, Marketing, Sales, Service, Business Management, Service Management, Customization and Custom Entities.
Each CRM user is assigned a security role which can done on an organisational, business unit, team or individual user basis to prevent the wrong people accessing data.
Another important consideration is to determine if each user should have access to all CRM records, or just their own.
On the Business Management screen in each Security Role a series of privacy related privileges control the action a user can take.
As shown below one of these options is Export to Excel.
Turning this function off for users assigned to this security role prevents data export but this will also cut-off users ability to run reports from Excel.
Check what security role each user belongs to and verify that the Export to Excel option is with-held.
Controlling permissions to export to Excel is the most important measure in protecting CRM data but as shown above there are further privacy settings. These include:
3. CRM for Mobile
As well as enabling users to access Dynamics mobile apps another consideration is CRM mobile offline.
CRM Online data is downloaded to the SQL Azure database using the Azure cloud, based on the entities you've enabled for offline availability.
When a user connects to the Azure Cloud service from a mobile app with offline capability, data is downloaded from the SQL Azure database to a local database on the mobile device. Data transfer between the SQL Azure database on the Azure cloud and the CRM mobile app with offline capability is through a secure SSL connection. Ultimately, customer data is stored in SQL Azure database and on the mobile device.
The system administrator determines if users are permitted to go offline with CRM Mobile Offline App by using security roles and Dynamics CRM Mobile profile customization. CRM admins can configure which entities are downloaded via Offline Sync by using the Sync Filters setting in the Setting –Mobile Offline dialog box.
It's important to note that data stored in the user’s device is controlled by the customer, not Microsoft. Admin users have full control over the data that can be extracted at the user security role or entity levels.
4. Document Generation
Creating documents via templates pulls through certain fields from within CRM. The ability to create single documents is an important privilege, especially for creating quotes.
This permission is a method of extracting CRM data, but it is an immensely time-consuming one should an individual consider doing this maliciously. As such, this permission is regarded as an acceptable risk.
5. Go Offline in Outlook
Users of the CRM for Outlook plugin, have the option to take data offline.
This stores data in a SQL database on the user’s machine but if permission is revoked, they will not have the option within Outlook to ‘go offline. More information can be found .
Given widespread access to the internet, off-line data is unlikely to be essential for all users.
6. Print
Disabling this will prevent users from printing CRM reports. This also blocks a report being printed to a PDF file.
This may need investigation before disabling the function as some reports will be rendered useless if they can't be printed, or available as PDF files. If needed, different print settings can be made on a report by report basis.
7. Field Level Security
Another option is to apply field level security which restricts access to especially sensitive data. .
8. Trusted IP Addresses
Finally, you can also limit access to Dynamics CRM Online to users with trusted IP addresses to reduce unauthorised access.
When trusted IP address restrictions are applied to a user’s profile and the user attempt to log in from an unapproved IP address, CRM access is blocked.
This extended control requires Azure Active Directory Premium in addition to a federated or managed Azure Active Directory tenant.
Conclusion
A sensible default permission setting for a user security profile in Microsoft Dynamics is:
- No export to excel.
- Sync of calendar information and uploading of emails sent from outlook into contact records on CRM.
- Documentation generation enabled
- No offline SQL database
- Printing of selected reports allowed
with Preact to verify that you have the most effective security permissions. We'll make sure that your data is safeguarded while still enabling individual users to access the records and functions they need.
are a UK based Microsoft CRM Gold Partner implementing and supporting CRM since 1993.
for more information about Microsoft Dynamics and CRM.
