November 18, 2025

Securing Dynamics 365 and Salesforce: A Shared Responsibility Model That Works for US Companies

You’ve made the smart move. Your customer relationships are thriving on Salesforce, and your financial operations are streamlined with Dynamics 365. But as you entrust these …

You’ve made the smart move. Your customer relationships are thriving on Salesforce, and your financial operations are streamlined with Dynamics 365. But as you entrust these platforms with your most sensitive data, a critical question emerges: Who is truly responsible for keeping it all secure? If you answered, “Microsoft & Salesforce,” you’re half right, and that’s a dangerous position to be in. The reality is that securing your cloud investment is a partnership, governed by the Shared Responsibility Model.  

Table of Contents hide
Demystifying the Shared Responsibility Model: It’s a Partnership, Not a Handoff
From Theory to Practice: Implementing Your Zero-Trust User Access Matrix
Step 1: Discover Roles and Classify Data
Step 2: Define “Least Privilege” Permissions
Step 3: Enforce with Multi-Factor Authentication (MFA)
Step 4: Implement Continuous Monitoring
Secure Your Future with CMC Global as Your Security Partner

Demystifying the Shared Responsibility Model: It’s a Partnership, Not a Handoff 

According to one cloud-security survey, 70% of organizations believe cloud security is a shared responsibility between provider and customer. Think of this model as leasing an office in a secure business park. The landlord (Microsoft/Salesforce) is responsible for the overall health of the property: the perimeter fence, the guards at the gate, the power to the building, and the roof over your head. 

But what about the lock on your specific office door? Who gets the key? And once inside, who can access the filing cabinet with confidential employee records? That responsibility is yours. 

Let’s break it down: 

What Microsoft & Salesforce Handle (The “Cloud Itself”) 

These giants invest billions in securing their physical data centers, global network infrastructure, and the core application platforms. They ensure the software is available and that the underlying infrastructure is resilient. Their job is to make sure the platform itself is a fortress. 

What Your Company Handles (The “Data in the Cloud”)

This is where your control and your risk resides. You are responsible for: 

  • User Access & Permissions: Who can log in and what can they see/do once they’re in? 
  • Data Classification & Protection: Which data is public, internal, confidential, or restricted? 
  • Endpoint Security: Are the devices connecting to your CRM company-managed and secure? 
  • Configuration Settings: Are security features like audit trails and session timeouts properly enabled? 
  • Regulatory Compliance: Adhering to industry mandates like HIPAA, CCPA, or SOX for the data you store and process. 

Ignoring your side of this partnership is like leaving the keys to your filing cabinet in the lock for anyone to find. 

From Theory to Practice: Implementing Your Zero-Trust User Access Matrix 

Knowing your responsibility is one thing; acting on it is another. The most effective strategy for securing access is adopting a Zero-Trust mindset: “Never trust, always verify.” A recent survey found that 81% of organizations have fully or partially implemented a Zero-Trust model. Assume no user or device is inherently safe, whether they’re inside or outside your corporate network. 

For your Dynamics 365 and Salesforce environments, this translates into building and enforcing a Zero-Trust User Access Matrix. 

Here’s a practical, four-step approach: 

Step 1: Discover Roles and Classify Data 

Start by identifying every user role that interacts with your systems: Sales Rep, Sales Manager, Finance Analyst, Support Agent, External Partner. Simultaneously, classify your data. What constitutes “Confidential” customer information? What financial data is “Restricted”? 

Step 2: Define “Least Privilege” Permissions 

This is the core of your matrix. Create a clear chart that maps each role to the specific data and functions they absolutely need to do their job and nothing more. 

Step 3: Enforce with Multi-Factor Authentication (MFA) 

MFA is the non-negotiable gatekeeper of your Zero-Trust matrix. A username and password are no longer enough. MFA ensures that even if credentials are stolen, an attacker cannot gain access. 

Step 4: Implement Continuous Monitoring 

Security is not a “set-it-and-forget-it” task. Use native and third-party tools to monitor for anomalous behavior, such as a user logging in from an unknown location at 3 a.m. or attempting to export thousands of records unexpectedly. 

Secure Your Future with CMC Global as Your Security Partner 

This is where the right partner transforms your security from a theoretical concept into a fortified, operational reality. At CMC Global, we specialize in helping US companies navigate this exact challenge. 

We bring: 

  • Deep Platform Expertise: Our teams hold top-tier certifications in both Microsoft Dynamics 365 and Salesforce, giving us the unique ability to secure your integrated business environment. 
  • A Proven Security Framework: We don’t just configure settings; we conduct a comprehensive audit, design a tailored Zero-Trust strategy, and implement a robust security posture management program tailored to your business needs. 
  • Peace of Mind: With CMC Global as your guide, you can focus on driving growth and innovation from your CRM and ERP investments, confident that your data is protected by industry-leading practices. 

Don’t leave your cloud security to chance. 

Schedule a Free Security Assessment with our experts today.  

We’ll review your current Dynamics 365 and Salesforce setup against the Shared Responsibility Model and provide a personalized roadmap to a more secure future.