How secure is Dynamics 365?

As a Dynamics 365 Partner, we get regularly asked by prospects and existing customers about how secure the platform is. To answer that question, we need to look at the underlying infrastructure that underpins this CRM. But to reflect on an overview of the sector, over the last ten years, the IT industry has seen an enormous shift from on-premise to Cloud. Data storage, software, processing, traditionally controlled in local environments such as office networks are now performed in data centres across the world. This shift caused plenty of friction in the upper echelons of businesses, with fears over security and privacy as they hand over sensitive data from a businesses environment to another. 

An organisation that wants to succeed in delivering cloud services must consider security at the core of every decision they make or face disastrous consequences.

To get back to Dynamics 365, it sits on top of Microsofts Azure platform, arguably the largest cloud platform in the world. To have been successful, they needed to be at the cutting edge of security. So how does it achieve that?

TLS Encrypted connections

Transport Layer Security (TLS) is one of the most important and widely used security protocols. It protects a significant proportion of the data that gets transmitted online. It's most prominently used to secure the data that travels between a web browser and website via HTTPS, but it can also be used to secure email and a host of other protocols.

Safeguard access with Azure Activity Directory

• Microsoft invests over USD 1 billion annually on cybersecurity research and development.
• Microsoft employs more than 3,500 security experts focused on securing your data and privacy.
• Azure has more certifications than any other cloud provider. View the comprehensive list.
• Azure AD manages more than 1.2 billion identities and processes over 8 billion authentications every day.

Leverages Microsoft Cyber Defense Operations Center (CDOC)

The security system leverages Microsoft Cyber Defense Operations Center, which brings together security response experts from across the company to help protect, detect, and respond to threats in real-time. Staffed with dedicated teams 24x7, the Center has direct access to thousands of security professionals, data scientists, and product engineers throughout Microsoft to ensure rapid response and resolution to security threats. 

Physical Security - Microsoft Data Centres

Azure safeguards data in facilities that are protected by industry-leading physical security systems and are compliant with a comprehensive portfolio of standards and regulations.

GDPR compliance

Microsoft has invested significant resources helping partners and businesses maintain GDPR compliance and helping to protect customer data as well as managing communications. They've put together a plethora of resouces to help with this commitment to GDPR.

• White papers
• Data Subject Requests
• Compliance Manager
• Webcasts
• Blog posts
• E-books

Role-based security aligned with your organisation

Role-based access control (RBAC) restricts network access based on a person's role within an organisation and has become one of the main methods for advanced access control. The roles in RBAC refer to the levels of access that employees have to the network.

Microsoft Operational Security Assurance

Effective operational security spans many domains—including physical security, staffing controls, asset management, and others—which are documented in numerous standards and frameworks. OSA outlines security engineering practices that organisations should adopt and is a framework used to improve core aspects of operational security of online services. 

Dynamics 365 has benefited by leveraging Azure infrastructure, which delivers world-class security for businesses and users across the world. We understand the concerns on-premise organisations have about the Cloud; it's a big jump to migrate data that is physically stored at your organisations' location to letting someone else look after it daily. 

However, consider whether your own IT security principles are as robust as the likes of Azure and if not, what is the cost required to match them? We suspect that's a very tall order.