Core Objective

Replace process-only honor systems with a robust, automated security architecture that physically enforces change governance. The solution must ensure that even users with elevated privileges adhere to change approvals, segregation of duties, and secure ALM pipelinesstopping unauthorized modifications and accidental deployments into Production without paralyzing daily administrative operations.

Key Deliverables & Responsibilities

- Production Environment Hardening
- Configure granular Dataverse security roles and Microsoft Entra ID group-based permissions.
- Prevent direct customizations, entity modifications, or schema edits within the Production environment.
- Deployment Safeguards (UAT to Prod)
- Implement technical barriers and automated approval gates.
- Eliminate accidental promotions or manual solution imports from UAT directly to Production to establish clean ALM separation.

- Privileged Access Management (PAM)
- Define Just-In-Time (JIT) access mechanisms, Microsoft Entra PIM roles, and break-glass governance.
- Ensure administrators retain troubleshooting capabilities without holding continuous, standing modification rights.
- Dual-Track Administrative Balance
- Restructure operational permissions to completely decouple business support, user onboarding, licensing, and daily configuration from solution publishing and production metadata changes.
- Auditability & Telemetry
- Activate Power Platform administrative logs, Dataverse auditing, and deployment history monitoring to alert stakeholders of out-of-band modifications.

- Engagement Focus Areas





Focus DomainTechnical Implementation StrategyDirect Schema LocksRestricting System Customizer / System Administrator standing rights in Prod; leveraging managed solutions and environment security settings.Pipeline SeparationSecuring Power Platform Pipelines or Azure DevOps / GitHub release gates with service principal service connections and mandatory approvers.Admin Operational ContinuityDesigning role-tailored support personas that handle records, views, and operational tickets without granting structural solution import permissions. Required Skills & Technical Competencies

- Microsoft Dynamics 365 Sales & Dataverse: Deep architectural understanding of Dataverse security models, business units, role inheritance, field-level security, and solution layering (Managed vs. Unmanaged solutions).
- Power Platform Administration Center (PPAC): Proven experience managing environment tiers (Dev, Test/UAT, Prod), security groups, tenant-level isolation, and workplace routing.
- ALM & Deployment Controls: Hands-on implementation of automated release controls using Power Platform Pipelines, Azure DevOps (Power Platform Build Tools), or GitHub Actions with strict approval gates.
- Identity & Privileged Access: Solid working knowledge of Microsoft Entra ID, Privileged Identity Management (PIM), security group synchronization to Dataverse, and service principal authentication.
- Governance & Compliance Design: Ability to map written enterprise change management frameworks into enforceable technical guardrails and auditing baselines.
- Preferred Qualifications & Background
- Proven track record hardening enterprise Dynamics 365 or Power Platform environments against unauthorized changes and rogue deployments.
- Experience implementing automated alerts using Microsoft Purview, Power Platform CoE Starter Kit, or Azure Application Insights for configuration drift.

- Relevant certifications
- Microsoft Certified: Power Platform Solution Architect Expert
- Security Operations Analyst Associate (SC-200)
- Power Platform Functional Consultant Associate (PL-200)
- Strong stakeholder communication skills to balance strict compliance requirements with practical operational agility.

📌 Dynamics 365 Sales Security & ALM Governance Specialist (Pune)
🏢 Avyka Info
📍 Pune