11.4 BPF Security Roles, Order & Process Lifecycle

BPF Security Roles, Order & Process Lifecycle

In complex enterprise environments, organizations frequently maintain multiple distinct business processes for the same underlying table. A global organization might operate a Standard SMB Sales Process, an Enterprise Strategic Sales Process, and a Government Procurement Process all anchored to the Opportunity table. Controlling which users have access to specific processes, determining which process applies automatically upon record creation, managing process state transitions, and automating process navigation via client-side scripting are fundamental competencies for the functional consultant.

For the PL-200: Microsoft Power Platform Functional Consultant exam, you must master BPF security role administration, process order precedence rules, the three lifecycle states, and the Client API (formContext.data.process) object model.

---

1. BPF Security Roles & Access Governance

Because every Business Process Flow in Dataverse is stored as an autonomous custom table, access control leverages the standard Dataverse Role-Based Access Control (RBAC) security architecture.

+-----------------------------------------------------------------------------+
|                        BPF SECURITY PRIVILEGE MODEL                         |
|                                                                             |
|   +---------------------------------------------------------------------+   |
|   |                   DATAVERSE SECURITY ROLE: 'SALES REP'              |   |
|   +---------------------------------------------------------------------+   |
|               |                                            |                |
|               v                                            v                |
|   +-----------------------+                    +-----------------------+    |
|   |  STANDARD SALES BPF   |                    | ENTERPRISE SALES BPF  |    |
|   | - Create: User Depth  |                    | - Create: NONE        |    |
|   | - Read:   Org Depth   |                    | - Read:   NONE        |    |
|   | - Write:  User Depth  |                    | - Write:  NONE        |    |
|   | - Delete: NONE        |                    | - Delete: NONE        |    |
|   +-----------------------+                    +-----------------------+    |
|               |                                            |                |
|               v                                            v                |
|        [ACCESS GRANTED]                             [ACCESS DENIED]         |
|   User sees BPF chevron on form                BPF is completely hidden     |
+-----------------------------------------------------------------------------+

Configuring BPF Security Privileges

In the Modern Process Designer, selecting Edit Security Roles opens the security configuration dialog. Security privileges for the custom BPF entity mirror standard Dataverse table privileges:

• Create: Allows the user (or system automation running in user context) to instantiate a new instance of the BPF on a record.
• Read: Allows the user to view the BPF chevron header on the model-driven form and inspect stages/steps.
• Write: Allows the user to update data steps, advance stages, and modify the process instance record.
• Delete: Allows the user to delete a BPF instance record from the database.

[!IMPORTANT] No Read Privilege = Hidden Process: If a user's assigned security roles grant None for the Read privilege on a specific BPF table, the process is completely invisible to that user. The user will not see the BPF header, will not see the process in the Switch Process dialog, and cannot have that process automatically applied to records they create.

---

2. Order Process Flow & Process Precedence

When multiple Business Process Flows are enabled on the same table, Dataverse must determine which flow to apply automatically when a user creates a new record. This behavior is governed by the Order Process Flow configuration.

+-----------------------------------------------------------------------------+
|                     ORDER PROCESS FLOW PRECEDENCE RESOLUTION                |
|                                                                             |
|   [RECORD CREATED BY USER 'ALICE']                                          |
|                 |                                                           |
|                 v                                                           |
|   +---------------------------------------------------------------------+   |
|   |                     EVALUATE ORDER PROCESS FLOW                     |   |
|   |   Rank 1: Government Sales Process   ---> Does Alice have Read? [NO] |   |
|   |   Rank 2: Enterprise Sales Process   ---> Does Alice have Read? [YES]|   |
|   |   Rank 3: Standard SMB Sales Process ---> (Skipped - Match Found)   |   |
|   +---------------------------------------------------------------------+   |
|                 |                                                           |
|                 v                                                           |
|   [INSTANTIATE RANK 2: 'Enterprise Sales Process']                          |
+-----------------------------------------------------------------------------+

Evaluation Mechanics

1. In the Power Apps Maker Portal, navigate to the table's process list and select Order Process Flow.
2. Reorder the active BPFs vertically to establish priority (Rank 1 at the top, followed by Rank 2, 3, etc.).
3. Runtime Precedence Resolution: When a user creates a new row, Dataverse scans the ordered list from top to bottom. The first (highest-ranked) BPF for which the creating user possesses Read security privileges is automatically instantiated and displayed on the new record.

Switching Processes on Existing Records

If a record requires a different process later in its lifecycle (e.g., an SMB deal expands into an Enterprise deal), users with Read privileges on both processes can click Switch Process on the model-driven app command bar:

• A dialog opens listing all active BPF definitions available to the user.
• Selecting a new process applies that BPF to the record. The previous BPF instance remains preserved in the database in its current state.

---

3. The BPF Lifecycle & Status Reasons

Every instance of a Business Process Flow possesses a system-managed lifecycle status, stored in the statecode and statuscode columns of the BPF table:

+-----------------------------------------------------------------------------+
|                          BPF LIFECYCLE STATE MACHINE                        |
|                                                                             |
|                               [ INITIALIZE ]                                |
|                                      |                                      |
|                                      v                                      |
|                             +-----------------+                             |
|       +-------------------> |     ACTIVE      | <-------------------+       |
|       |                     | (statecode = 0) |                     |       |
|       |                     +-----------------+                     |       |
|       |                              |                              |       |
|       |              +---------------+---------------+              |       |
|       |              |                               |              |       |
|       |              v                               v              |       |
|   [REACTIVATE] +-------------+                 +---------------+    |       |
|       |        |  FINISHED   |                 |   ABANDONED   |    |       |
|       |        | (state = 1, |                 |  (state = 1,  | ---+       |
|       |        | status = 2) |                 |  status = 3)  |            |
|       |        +-------------+                 +---------------+            |
|       |                                                                     |
|       +---------------------------------------------------------------------+       |
+-----------------------------------------------------------------------------+

1. Active (statecode = 0, statuscode = 1): The process is actively underway. Users can edit steps and navigate forward/backward.
2. Finished (statecode = 1, statuscode = 2): The process reached the final stage and the user clicked Finish. The process bar is marked with a completion indicator and steps become read-only unless reactivated.
3. Abandoned (statecode = 1, statuscode = 3): The process was terminated early without reaching full completion (e.g., an Opportunity was marked Lost or a project was cancelled). Abandoned processes can be reactivated at any time.

---

4. Programmatic Control via Client API (formContext.data.process)

For advanced requirements where business rules or UI events must dynamically interact with the BPF, developers and functional consultants use the Client API via JavaScript web resources bound to model-driven form events.

The formContext.data.process Object Model

// 1. Get the current active process and active stage
var activeProcess = formContext.data.process.getActiveProcess();
var processId = activeProcess.getId();
var processName = activeProcess.getName();

var activeStage = formContext.data.process.getActiveStage();
var stageId = activeStage.getId();
var stageName = activeStage.getName();
var stageCategory = activeStage.getCategory().getValue();

// 2. Programmatically Advance or Move Backwards
formContext.data.process.moveNext(function (result) {
    if (result === "success") {
        console.log("Successfully advanced to next stage.");
    } else if (result === "invalid") {
        console.log("Cannot advance: Required stage steps are missing.");
    }
});

// 3. Switch Active Process Programmatically
var targetProcessId = "a1b2c3d4-0000-0000-0000-000000000000";
formContext.data.process.setActiveProcess(targetProcessId, function (result) {
    if (result === "success") {
        formContext.data.refresh();
    }
});

// 4. Register Stage Change Event Handlers
formContext.data.process.addOnStageChange(function (executionContext) {
    var currentStage = formContext.data.process.getActiveStage();
    console.log("Stage changed to: " + currentStage.getName());
});

Essential Client API Methods Reference