![\"Restrict](\"https:\/\/www.inogic.com\/blog\/wp-content\/uploads\/2026\/10\/Restrict-Dataverse-Record-Access-by-Column-Value-Using-Filtered-Record-Ownership.png\")
Imagine managing sales teams across four states. Your California sales reps should see California accounts, your Arizona reps should see Arizona accounts, and your sales head should have access to all accounts.<\/p>\nImagine managing sales teams across four states. Your California sales reps should see California accounts, your Arizona reps should see Arizona accounts, and your sales head should have access to all accounts.<\/p>\n
You could manage this using business units, teams, or manual record sharing. But as your business grows and records keep changing, maintaining these access rules can become complicated.<\/p>\n
What if you could control who sees a record based on a value in the record itself?<\/p>\n
That’s exactly what Microsoft’s new Filtered Record Ownership<\/strong> feature in Dataverse aims to do. Currently in preview, it lets you apply row-level security using column values, such as State, instead of relying on record ownership.<\/p>\n In this blog, we’ll walk through how to set up Filtered Record Ownership for a Regional Accounts table, create state-based filters, and assign them to security roles so each salesperson sees only the accounts relevant to their region.<\/p>\n Filtered record ownership lets you define filters based on your use case, such as State equals California, and grant them to a security role. Users with that role can create or read only the records that match the filter.<\/p>\n A few things are different from regular tables:<\/p>\n In Power Apps, open your solution and select New > Table (advanced properties)<\/strong>. Enter the display name (we used Regional Accounts<\/strong>), expand Advanced options<\/strong>, set Record ownership<\/strong> to Filtered (preview)<\/strong>, and click Save<\/strong>. We added columns for Account Name, City, State, Industry, and Annual Revenue, and entered sample accounts for California, Georgia, Alaska, and Arizona. State is the column our filters are based on.<\/p>\n Note:<\/strong> You can\u2019t change a table\u2019s record ownership type after it is created.<\/p>\n Open your model-driven app for editing and open the Regional Accounts table view. Select Filters<\/strong> in the top right of the action bar, remove any default filters, click + Add<\/strong>, and set State equals Arizona<\/strong>. Then click Download FetchXML<\/strong> and open the downloaded file in Notepad. Repeat this for each state (Georgia, Alaska, and California), so you have one FetchXML file per state.<\/p>\n A record filter is the security predicate that decides which rows a user can access. In your solution, select<\/p>\n + New > More > Other > Record Filter<\/strong>.<\/p>\n Click Save & close<\/strong> and repeat for the other states.<\/p>\n Note:<\/strong> The unique name can\u2019t contain spaces. A name like \u201cFilter Arizona\u201d fails with the error \u201cExport key attribute must begin with a letter and only consist of alpha-numeric and _.{}! characters\u201d. Use underscores instead, for example Filter_arizona.<\/span><\/p>\n An entity record filter links each record filter to the table. In your solution, select<\/p>\n + New > More > Other > EntityRecordFilter<\/strong> and enter: Click Save & close<\/strong>, repeat for each state, and then publish all customizations.<\/p>\n Note:<\/strong> Create the table, record filters, and entity record filters in the same environment<\/strong> where you will edit the security role. If they are in a different environment, the filters won\u2019t show up in the role.<\/span><\/p>\n In the Power Platform admin center, go to your environment, then Settings > Users + permissions > Security roles > + New role<\/strong>. We created a role named Arizona Role<\/strong>. Open the role, find the Regional Accounts<\/strong> table, and on the Read<\/strong> privilege select the Arizona<\/strong> filter instead of None or All Records. If you want users to create, edit, or delete records, you can grant the filter on those privileges as well. Click Save + close<\/strong>.<\/p>\n Create one role per state in the same way.<\/p>\n Select a user, click Manage security roles<\/strong>, and assign the matching role: California Role to the California salesperson and Arizona Role to the Arizona salesperson.<\/p>\n When the Arizona salesperson opens the Regional Accounts view, only accounts with State = Arizona appear. The Alaska salesperson sees only Alaska accounts. The administrator sees all accounts because of the global All records<\/strong> permission.<\/p>\n [ Admin view with all records]<\/em><\/p>\n Managing record access across different teams doesn’t have to mean creating complicated ownership structures or manually sharing records.<\/p>\n With Filtered Record Ownership<\/strong>, you can use column values to define which records users can access. In our example, each salesperson sees accounts belonging to their assigned state, while administrators retain access to all records.<\/p>\n The biggest advantage is that access rules apply automatically. When a new account is added with a matching State value, it falls under the corresponding filter without requiring manual sharing or reassignment.<\/p>\n Beyond regional sales teams, this approach can also help manage access to bank branch records, hospital department data, HR records by office location, and other scenarios where access depends on a specific field value.<\/p>\n Since the feature is still in preview, test it in a development or sandbox environment before considering it for your business applications.<\/p>\n What is filtered record ownership in Dataverse?<\/strong><\/p>\n It is a row-level security feature, currently in preview, that grants users access to records based on filters on column values instead of record owners.<\/p>\n Can filtered record ownership tables have a record owner?<\/strong><\/p>\n No. These tables have no owner, so records can\u2019t be shared or assigned to an individual. The Created By column only tracks who created the record.<\/p>\n Can I use filters on an existing table?<\/strong><\/p>\n Yes. You can create record filters for existing user-owned or organization-owned tables. A new table is needed only if you want the filtered (no owner) ownership type.<\/p>\n Can I change an existing table to filtered record ownership?<\/strong><\/p>\n No. A table\u2019s record ownership type can\u2019t be changed after it is created.<\/p>\n Why can\u2019t I see the filter in my security role?<\/strong><\/p>\n The record filters and entity record filters probably aren\u2019t in the same environment as the role, or the customizations haven\u2019t been published. Check both, then reopen the role.<\/p>\n Does filtered record ownership affect performance?<\/strong><\/p>\n Yes. Filter permissions apply to every query, so an efficient data model and well-designed filters help avoid performance problems.<\/p>\n","protected":false},"excerpt":{"rendered":" Imagine managing sales teams across four states. Your California sales reps should see California accounts, your Arizona reps should see Arizona accounts, and your sales head should have access to all accounts. You could manage this using business units, teams, or manual record sharing. But as your business grows and records keep changing, maintaining these\u2026 Read More: Restrict Dataverse Record Access by Column Value Using Filtered Record\u2026 »<\/a><\/span><\/p>\n","protected":false},"author":15,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2354,2361],"tags":[3444],"class_list":["post-46760","post","type-post","status-publish","format-standard","hentry","category-dataverse","category-technical","tag-filtered-record-ownership"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\tWhat is Filtered Record Ownership?<\/strong><\/h3>\n
\n
Prerequisites<\/strong><\/h3>\n
\n
Steps to set up filtered record ownership<\/strong><\/h3>\n
\n
\n![\"Restrict](\"https:\/\/www.inogic.com\/blog\/wp-content\/uploads\/2026\/10\/Restrict-Dataverse-Record-Access-by-Column-Value-Using-Filtered-Record-Ownership-1.jpg\")
\n![\"Restrict](\"https:\/\/www.inogic.com\/blog\/wp-content\/uploads\/2026\/10\/Restrict-Dataverse-Record-Access-by-Column-Value-Using-Filtered-Record-Ownership-2-e1793358781688.jpg\")
<\/p>\n![\"Restrict](\"https:\/\/www.inogic.com\/blog\/wp-content\/uploads\/2026\/10\/Restrict-Dataverse-Record-Access-by-Column-Value-Using-Filtered-Record-Ownership-3.jpg\")
<\/p>\n\n
\n![\"Restrict](\"https:\/\/www.inogic.com\/blog\/wp-content\/uploads\/2026\/10\/Restrict-Dataverse-Record-Access-by-Column-Value-Using-Filtered-Record-Ownership-4.jpg\")
<\/p>\n\n
![\"Restrict](\"https:\/\/www.inogic.com\/blog\/wp-content\/uploads\/2026\/10\/Restrict-Dataverse-Record-Access-by-Column-Value-Using-Filtered-Record-Ownership-5.jpg\")
<\/p>\n\n
![\"Restrict](\"https:\/\/www.inogic.com\/blog\/wp-content\/uploads\/2026\/10\/Restrict-Dataverse-Record-Access-by-Column-Value-Using-Filtered-Record-Ownership-6.jpg\")
<\/p>\n<fetch version=\"1.0\" mapping=\"logical\" savedqueryid=\"47b740f5-58f4-4c59-bfd2-b9caa0df0086\" no-lock=\"false\" distinct=\"true\">\r\n\r\n<entity name=\"cr656_regionalaccounts\">\r\n\r\n<attribute name=\"statecode\"\/>\r\n\r\n<attribute name=\"cr656_regionalaccountsid\"\/>\r\n\r\n<attribute name=\"cr656_name\"\/>\r\n\r\n<attribute name=\"createdon\"\/>\r\n\r\n<order attribute=\"cr656_name\" descending=\"false\"\/>\r\n\r\n<attribute name=\"cr656_state\"\/>\r\n\r\n<attribute name=\"cr656_industry\"\/>\r\n\r\n<attribute name=\"modifiedby\"\/>\r\n\r\n<attribute name=\"cr656_contactperson\"\/>\r\n\r\n<attribute name=\"createdby\"\/>\r\n\r\n<filter type=\"and\">\r\n\r\n<condition attribute=\"statecode\" operator=\"eq\" value=\"0\"\/>\r\n\r\n<condition attribute=\"cr656_state\" operator=\"eq\" value=\"2\"\/>\r\n\r\n<\/filter>\r\n\r\n<\/entity>\r\n\r\n<\/fetch><\/pre>\n
\n
\n![\"Restrict](\"https:\/\/www.inogic.com\/blog\/wp-content\/uploads\/2026\/10\/Restrict-Dataverse-Record-Access-by-Column-Value-Using-Filtered-Record-Ownership-7.jpg\")
<\/p>\n\n
![\"Restrict](\"https:\/\/www.inogic.com\/blog\/wp-content\/uploads\/2026\/10\/Restrict-Dataverse-Record-Access-by-Column-Value-Using-Filtered-Record-Ownership-8.jpg\")
<\/p>\n![\"Restrict](\"https:\/\/www.inogic.com\/blog\/wp-content\/uploads\/2026\/10\/Restrict-Dataverse-Record-Access-by-Column-Value-Using-Filtered-Record-Ownership-9.jpg\")
<\/p>\n\n
\n![\"Restrict](\"https:\/\/www.inogic.com\/blog\/wp-content\/uploads\/2026\/10\/Restrict-Dataverse-Record-Access-by-Column-Value-Using-Filtered-Record-Ownership-10.jpg\")
<\/p>\n![\"Restrict](\"https:\/\/www.inogic.com\/blog\/wp-content\/uploads\/2026\/10\/Restrict-Dataverse-Record-Access-by-Column-Value-Using-Filtered-Record-Ownership-11.jpg\")
<\/p>\n\n
![\"Restrict](\"https:\/\/www.inogic.com\/blog\/wp-content\/uploads\/2026\/10\/Restrict-Dataverse-Record-Access-by-Column-Value-Using-Filtered-Record-Ownership-12.jpg\")
<\/p>\nThe result<\/strong><\/h3>\n
![\"Restrict](\"https:\/\/www.inogic.com\/blog\/wp-content\/uploads\/2026\/10\/Restrict-Dataverse-Record-Access-by-Column-Value-Using-Filtered-Record-Ownership-13.jpg\")
![\"Restrict](\"https:\/\/www.inogic.com\/blog\/wp-content\/uploads\/2026\/10\/Restrict-Dataverse-Record-Access-by-Column-Value-Using-Filtered-Record-Ownership-14.jpg\")
<\/em><\/p>\n![\"Restrict](\"https:\/\/www.inogic.com\/blog\/wp-content\/uploads\/2026\/10\/Restrict-Dataverse-Record-Access-by-Column-Value-Using-Filtered-Record-Ownership-15.jpg\")
<\/h3>\nThings to keep in mind<\/strong><\/h3>\n
\n
Conclusion<\/strong><\/h3>\n
Frequently Asked Questions<\/strong><\/h3>\n