Skip to main content

Configure Business Object Security

CryspIQ® enables organisations to protect business object and factual data at a field level using Business Object Security.

Business Object Security allows administrators to assign Microsoft Entra ID security groups to specific business objects, facts or data elements within the CryspIQ® enterprise data model.

CryspIQ® uses Microsoft SQL Server Dynamic Data Masking to protect sensitive values. By default, no security groups are granted access. Access must be explicitly assigned.

What is Business Object Security?​

Business Object Security protects sensitive business data elements associated with a business object or fact.

Examples include:

Business Object / FactProtected Data Element
EmployeeSalary Amount
SupplierBank Account Details
ContractContract Value
AssetAsset Valuation
IncidentSensitive Investigation Notes

This allows CryspIQ® to protect data at a detailed field level while still allowing authorised users to work with the information they need.

How Business Object Security Works​

CryspIQ® applies field-level protection using SQL Server Dynamic Data Masking.

By default:

  • Protected fields are masked.
  • No security groups are granted access.
  • Users must belong to an authorised Microsoft Entra ID security group to view unmasked values.
  • Users without access will see masked values.

Example​

A protected value may appear as:

XXXXXX

instead of:

750000

Only authorised users belonging to approved security groups can view the unmasked value.

Before You Start​

Before configuring Business Object Security, ensure:

  • Microsoft Entra ID security groups already exist.
  • Security groups have been added to CryspIQ®.
  • Business objects, facts or data elements are available in CryspIQ®.
  • You have Data Administrator permissions.
warning

Business Object Security follows a deny by default model.

No security group receives access until access is explicitly assigned.

From the main menu navigate to:

Security → Business Object Security

The Business Object Security page displays business objects, facts or field-level data elements available for protection.

Business Object Security Overview

Assign Security Groups​

To grant access to a protected business object or fact field:

  1. Open Security → Business Object Security.
  2. Locate the business object, fact or data element.
  3. Select Edit Security.
  4. Choose the Microsoft Entra ID security group.
  5. Save the configuration.

Assign Business Object Security

Only users belonging to the selected security groups will be able to view the unmasked value.

Example Configuration​

Contract Value​

Security GroupAccess
FINANCE_USERSAllowed
EXECUTIVE_USERSAllowed
PROCUREMENT_USERSAllowed
GENERAL_USERSDenied

Employee Salary Amount​

Security GroupAccess
HR_USERSAllowed
PAYROLL_USERSAllowed
EXECUTIVE_USERSAllowed
OPERATIONS_USERSDenied

Supplier Bank Account Details​

Security GroupAccess
FINANCE_USERSAllowed
ACCOUNTS_PAYABLE_USERSAllowed
PROCUREMENT_USERSDenied

Business Object Security vs Contextual Security​

CryspIQ® supports multiple layers of data protection.

Security TypeProtectsExample
Business Object SecurityBusiness object or fact-level fieldsContract value, salary amount, supplier bank account
Contextual SecurityContextual attributes and descriptive fieldsDate of birth, personal email, mobile number
Security GroupsDataset or business access boundariesFinance, HR, Operations
Functional RolesScreens and featuresData Administrator, Data Steward, User

Use Business Object Security when the sensitive value is part of the business object or factual data being consumed.

Review Existing Assignments​

To review current protection:

  1. Open Security → Business Object Security.
  2. Select the business object, fact or field.
  3. Review assigned security groups.
  4. Confirm the access remains appropriate.

Regular reviews help ensure sensitive data remains protected as organisational responsibilities change.

Best Practices​

Protect High-Risk Business Data​

Apply Business Object Security to data such as:

  • Financial amounts
  • Payroll values
  • Contract values
  • Supplier bank details
  • Sensitive customer identifiers
  • Commercially sensitive metrics

Use Business-Based Security Groups​

Assign access using groups aligned to business responsibility.

Good examples:

FINANCE_USERS
HR_USERS
PAYROLL_USERS
EXECUTIVE_USERS
ACCOUNTS_PAYABLE_USERS

Avoid assigning access through individual user-based groups.

Apply Least Privilege​

Only grant access when the user has a genuine business need.

If a group does not require access to the unmasked value, do not assign it.

Review Sensitive Access Regularly​

Review access to high-risk fields periodically.

Recommended review points include:

  • Staff role changes
  • Department restructures
  • Audit preparation
  • New reporting use cases
  • Regulatory or compliance changes

Troubleshooting​

User Sees Masked Values​

Check:

  • The user belongs to the correct Microsoft Entra ID security group.
  • The security group has been added to CryspIQ®.
  • The security group has been assigned to the business object or fact field.
  • The user has logged out and back in after group changes.

User Can Access the Dataset but Not the Field​

This usually means dataset access has been granted, but field-level access has not.

Review:

  • Business Object Security assignments
  • Contextual Security assignments
  • Microsoft Entra ID group membership

User Can See a Sensitive Field Unexpectedly​

Immediately review:

  • Assigned security groups
  • Microsoft Entra ID group membership
  • Business Object Security configuration
  • Any overlapping access groups

Follow your organisation’s security and compliance procedures where required.

Security Model Summary​

Security LayerPurpose
Functional RolesControls what screens and features a user can access
Access ControlControls access to datasets and business areas
Business Object SecurityControls access to protected field-level business or factual data
Contextual SecurityControls access to protected contextual attributes
SQL Server Data MaskingMasks protected values for unauthorised users

Together these controls help ensure users can work with the data they need while sensitive business information remains protected.

Next Steps​

After configuring Business Object Security:

  1. Confirm the correct security groups are assigned.
  2. Test access using representative user accounts.
  3. Confirm unauthorised users see masked values.
  4. Confirm authorised users can view unmasked values.
  5. Document ownership and review schedules.

CryspIQ® automatically applies Business Object Security whenever protected data is queried, viewed or consumed.