How Can I Stop our Dynamics 365 CE Users From Reworking SharePoint URLs to Find Documents They Shouldn’t?  

The Challenge: Granular Permissions vs. Flat Document Libraries 

Organizations using Dynamics 365 Customer Engagement (CE) often implement granular security models within entities. For example, in a legal entity, a user might have access to Case 1 but must be restricted from viewing Case 2 due to the sensitivity of the data but both Cases relate to the same entity.  

However, when using the native SharePoint integration, all documents related to an entity (e.g., Cases relating to a single Customer) are stored in a single document library. This creates a serious security vulnerability: 

A clever user can simply manipulate the SharePoint URL to access documents from another case they shouldn’t see. 

This happens because: 

• SharePoint permissions do not inherit Dynamics 365 CE security roles. 

• The integration does not enforce record-level security. 

• SharePoint’s flat folder structure lacks awareness of Dynamics’ entity-level access controls. 

This issue has been widely acknowledged in the Dynamics community and can lead to data breaches, compliance violations, and loss of trust. [Dynamics Community Member Post]  

Why Native Integration Falls Short 

• No automatic permission sync between Dynamics and SharePoint. Manual SharePoint permission management is error-prone and not scalable. 

• Security context (e.g., user roles, team memberships, record ownership) is lost when documents move to SharePoint.  

The Solution: Application Access Permissions + Microsoft Graph API 

Instead of giving users direct access to SharePoint, a more secure and scalable approach is to leverage the permissions already configured in Dynamics 365 CE. 

✅ Use Application Access Permissions 

• These permissions allow your app to act on behalf of the organization, not the user. 

• They respect Dynamics’ security model, ensuring users only access what they’re allowed to. 

✅ Use Microsoft Graph API for Document Operations 

• Upload, retrieve, and manage documents programmatically. 

• Users never interact directly with SharePoint. 

• Documents are stored in SharePoint, but access is controlled via Dynamics. 

This approach ensures: 

• Consistent security enforcement. 

• No need for dual permission strategies. 

• No risk of URL manipulation or unauthorized access.  

Want to Avoid Custom Development? Meet Filer for Dynamics 

If building a custom solution with PCF controls and Graph API sounds complex, Filer for Dynamics offers a ready-made solution: 

🔒 Security by Design 

• With a flick of a switch, Filer uses application access permissions and Microsoft Graph API. 

• Users are blocked from direct SharePoint access. 

• Documents are still stored in SharePoint, but only accessible through Dynamics. 

🚀 Enhanced Functionality 

• No file size limits. 

• Built-in document viewers, editors, and redaction tools. 

• No need to switch between apps — everything happens inside Dynamics. 

🧠 Smart Permissions 

• Filer respects Dynamics’ security roles, teams, and ownership. 

• No need to manually configure SharePoint permissions. 

Conclusion 

The native integration between Dynamics 365 CE and SharePoint is convenient but not secure enough for sensitive data scenarios. By using application access permissions and Microsoft Graph API, organizations can enforce consistent security, eliminate risks, and streamline document management. 

Filer for Dynamics makes this transformation effortless; no custom code, no complexity, just secure and seamless document management. 

Want to Learn More? 

Reach out to explore how Filer for Dynamics can secure your documents, simplify your workflows, and protect your data; all within the Dynamics 365 experience.