Advanced Cloud Security Documentation
Index

Three-Phase Setup

Advanced Cloud Security follows a three-phase approach to implementing security and compliance. Understanding this workflow is essential for successfully deploying ACS in your organization.

Overview of the Three Phases

The ACS main page displays three columns representing the phases:

Phase Name Scope Purpose
1 Build All Companies Define security features and generate the extension
2 Configure Compliance Per Company Set up compliance rules and approvers
3 Assign Security Per Company Apply security features to users

Why Three Phases?

This structured approach ensures:

  1. Security definitions are consistent across all companies
  2. Compliance can be customized per company as needed
  3. User assignments are flexible and company-specific
  4. Extension generation happens once for all companies

Phase 1: Build

The Build phase is where you define what to secure. Changes made here affect all companies.

Build Phase Tasks

Task Description
Define Security Features Create named collections of security settings
Handle Conflict Fields Resolve fields with existing security expressions
Compliance Tables Select which tables to track for compliance
Create Extension Generate the runtime extension

Important: Extension Generation

Every time you add, modify, or remove security definitions, you must regenerate the extension.

The extension is the actual AL code that implements your security rules. Without regenerating:

  • New fields won't be secured
  • Removed security rules will still apply
  • Changes won't take effect

Build Phase Workflow

Define Security Feature
        ↓
Add fields, actions, data filters
        ↓
Handle any conflict fields
        ↓
(If using compliance) Select tables
        ↓
CREATE EXTENSION ← Don't forget this step!

Phase 2: Configure Compliance

The Configure Compliance phase sets up the rules for tracking and approving changes. This is configured per company.

Configure Compliance Tasks

Task Description
Compliance Setup Configure which fields require approval
Approval Rules Define approval workflow rules
Compliance Approvers Designate users who can approve changes
Approver Groups Create groups of approvers

When to Configure Compliance

Configure compliance after:

  1. You've defined which tables to track (in Build phase)
  2. You've generated the extension
  3. You're ready to implement approval workflows

Compliance is Optional

If you only need field-level security and data filters, you can skip Phase 2 entirely. The Compliance module is a separate licensed feature.

Phase 3: Assign Security

The Assign Security phase applies your security features to users. This is configured per company.

Assign Security Tasks

Task Description
Assign to Users Apply security features directly to users
Assign to Security Groups Apply security features to BC security groups
Assign to Permission Sets Apply security features via permission sets
User Filters Configure user-specific filter values
See Effective Security View the combined security for any user

Assignment Methods

You can combine multiple assignment methods:

User's Effective Security = Direct Assignment 
                          + Security Group Assignments
                          + Permission Set Assignments

Security from all sources is combined. The effective security is the union of all assigned features.

Workflow Example

Here's a complete example of implementing a "Hide Cost Prices" security feature:

Phase 1: Build

  1. Open Define Security Features
  2. Create new feature: "Hide Cost Prices"
  3. Add fields:
    • Item."Unit Cost"
    • Item."Last Direct Cost"
    • Item Ledger Entry."Cost Amount (Actual)"
  4. Set visibility to "Hidden"
  5. Handle any conflict fields if prompted
  6. Click Create Extension
  7. Install the generated extension

Phase 2: Configure Compliance

(Skip if not tracking cost changes for compliance)

Phase 3: Assign Security

  1. Open Assign Security to Users
  2. Find the sales team users
  3. Assign "Hide Cost Prices" feature
  4. Verify with See Effective Security

Multi-Company Considerations

Phase 1 (Build)

  • Security features are defined once
  • Apply automatically to all companies
  • Extension works across all companies
  • "For all companies" label on the page

Phase 2 & 3 (Configure Compliance & Assign Security)

  • Configured per company
  • Shows "For: [Company Name]" on the page
  • Switch companies to configure for each
  • User filter values can vary by company

Common Mistakes to Avoid

Mistake Consequence Solution
Forgetting to regenerate extension New security not applied Always create extension after changes
Defining security in wrong company Security still works (global) Use designated "base company"
Skipping user filter configuration Data filters don't work Assign filter values to users
Not installing the generated extension Security not evaluated Generate and install the extension

Quick Reference Card

Build Phase Checklist

  • Define security features
  • Add field controls
  • Add action controls
  • Add data filters
  • Handle conflict fields
  • Select compliance tables (optional)
  • Create Extension

Assign Security Checklist

  • Assign features to users/groups/permission sets
  • Configure user filter values
  • Verify with Effective Security view
  • Test with end users