Business units

A business unit (BU) in Dataverse is a hierarchical organisational scope that every user and every record belongs to. Each environment has a single root BU and a tree of child BUs beneath. Security roles combine table-level privileges with scopes that reference business units — user-owned, business unit, parent: child business unit, or organisation — determining whose records a user can act on. Business units typically map to organisational structure (divisions, regions, subsidiaries) but should be kept simple; overly deep trees complicate administration. Teams, field-level security profiles, and row sharing layer on top of the BU foundation for finer control.

In practice, the right number of business units is almost always fewer than a new admin's first instinct — mapping every organisational chart box to its own BU produces a deep tree that is technically accurate and operationally painful, since every BU is a real administrative boundary with real maintenance cost. Most well-run implementations keep the BU tree shallow (root plus one layer of regional or divisional BUs) and use security roles at business-unit scope, plus teams for cross-cutting groups, to get the finer-grained access control that a deeper BU tree would otherwise be reached for.

Where confusion shows up: moving a user or a record between business units after go-live is possible but not free — a user's BU affects which records they can see under BU-scoped security roles, so reorganising the BU structure later can silently change who can access what unless the security-role scopes are reviewed at the same time. This is why the BU tree is one of the first things designed in a Dataverse security model, not something adjusted casually as the org chart shifts.