Create a truly personal field with Field Level Security

Since Microsoft Dynamics CRM 2011 was released, I never had the chance to really use Field Level Security feature. Last week, I was asked to implement a secured field that should be accessed only by the owner of the record, even if the record itself can be accessed by anyone.

 

This can be achieved with one field level security profile and one plugin.
 

Field Level Security Profile

The field level security profile basically restrict Read and Update of the field to all users (or all teams) but allows Create. This way, anyone can create a record with access to the secure field. When created, as all users can’t read or update, the field is not accessible anymore.
 

Plugin

The plugin will handle this problem. On PostCreate event, it will share the secured field with the owner. For this, we use the entity PrincipalObjectAttributeAccess to give Read and Update access to the secured field to the owner of the record.

public void ShareSecureFieldWithOwner(Entity record)
{
    // Any method that helps you find the AttributeMetadata Id
    var attributeId = FindSecuredAttribute();

    if (attributeId != Guid.Empty)
    {
        var userAccess = new PrincipalObjectAttributeAccess
                             {
                                 AttributeId = attributeId,
                                 ObjectId = record.ToEntityReference(),
                                 PrincipalId = record.OwnerId,
                                 UpdateAccess = true,
                                 ReadAccess = true
                             };

        context.AddObject(userAccess);
        context.SaveChanges();
    }
}

Voilà! You have now a secure field accessible only for the owner of the record!