CRM security and access control for investment firms
Answer in brief
CRM security and access control at an investment firm starts with identity: people sign in through the firm's identity provider, such as Microsoft Entra ID, so access ends when employment ends. On top of that sit roles, deal-level walls for MNPI, isolation of each firm's data, audit logs, and clear retention and export terms. Canteris uses sign-in with Microsoft Entra ID, and each firm's data is isolated.
Identity and sign-in through Microsoft Entra ID
Single sign-on through your identity provider is the baseline. It means the CRM inherits your password policy, multi-factor rules and conditional access, and that disabling a departing employee in one place removes their access everywhere.
- Joiners: access granted by group membership, so a new associate gets the associate role on day one.
- Movers: a move from BD to the deal team changes groups, and the CRM role follows.
- Leavers: disabling the account ends CRM access. Check whether sessions and API tokens are revoked at the same time.
- Service accounts: any integration identity is named, owned by a person and reviewed.
Canteris uses sign-in with Microsoft Entra ID. For any vendor, ask whether local passwords can be disabled entirely.
CRM security and access control: roles, walls and MNPI
| Role | Sees | Edits |
|---|---|---|
| Partner | All unrestricted deals and relationships | Own deals; stage decisions |
| Deal team | All unrestricted deals | Deals they are staffed on |
| BD | Relationships, intermediaries, deal sources | Contacts and activities |
| IR | LP-adjacent relationships | Its own records |
| Compliance | Everything, including restricted deals | Restrictions and walls |
| Admin | Configuration | Fields, views, roles |
Deal-level walls. Some deals must be visible only to a named team: a take-private, a sensitive carve-out, anything involving a public company. A wall should hide the deal from search, reports, dashboards, exports and AI assistants for everyone outside the team. Test this rather than taking it on trust.
MNPI. Record wall-crossings with a date and the person who approved them. Make sure email capture respects restrictions, so a restricted thread does not create a visible company or contact elsewhere.
Illustration: A made-up 30-person fund restricts a take-private codenamed "Project Birch". A test user on the BD team searches for the target name, opens the pipeline report and runs an export. None of them show the deal. Compliance logs the test result.
Tenant isolation, audit logs, retention and export
- Isolation: your data must be separated from every other customer's. Ask how isolation is enforced and tested. Canteris states that each firm's data is isolated.
- Audit logs: sign-ins, record views on restricted deals, exports, permission changes and deletions, with user and timestamp. Ask how long logs are kept and whether you can export them.
- Retention: can you set how long captured email content and notes are kept, and purge a record fully, including derived summaries?
- Export: a full export in a documented format, on demand, including activities and relationships, not just a contact list.
- Exit: what happens to your data, backups included, after the contract ends.
Vendor due diligence questionnaire
- Which identity providers do you support for sign-in, and can local passwords be turned off?
- How are roles mapped to identity groups?
- How do deal-level restrictions apply to search, reports, exports, alerts and AI features?
- How is each customer's data isolated, and how is that tested?
- What does the audit log record, for how long, and can we export it?
- Where is data hosted, and which subprocessors handle it?
- Which third-party audits or attestations do you hold? Send the reports and their scope, not a logo.
- How do you handle a security incident, and how fast do you notify customers?
- If the product reads email through Microsoft Graph, which permissions does it request?
- What is the export format, and how long after termination is data deleted?
Questions & answers
Why does single sign-on matter for a CRM?
It ties CRM access to your identity provider, so multi-factor rules apply and disabling a departing employee ends their access in one step.
What is a deal-level wall?
A restriction that makes a deal visible only to a named team and hides it from search, reports, exports and assistants for everyone else.
What does Canteris state about security?
Canteris uses sign-in with Microsoft Entra ID, and each firm’s data is isolated. Ask the vendor directly for anything beyond that.
Should we accept a certification logo as evidence?
No. Ask for the actual report, read its scope and dates, and check that it covers the product and hosting you will use.
Sources for this entry
- Microsoft Entra ID documentationIdentity, single sign-on and access management for Microsoft tenants.
- Microsoft Graph overviewHow apps are granted access to Microsoft 365 data.
- CanterisSign-in with Microsoft Entra ID and per-firm data isolation.
Continue this reading path
- CRM email capture from OutlookCRM email capture from Outlook builds companies, contacts, deals and thread notes from Microsoft 365 mail. What to capture, exclude, merge and review.
- CRM data migrationCRM data migration works best as a six-week project: inventory, field mapping, dedupe rules, history decisions, a cutover date and validation checks.
- Private equity CRM costPrivate equity CRM cost is driven by seats, modules, data feeds, setup, migration, support and term. A worksheet and vendor questions; no prices listed.
- How to choose a private equity CRMHow to choose a private equity CRM in six steps: requirements, a weighted scorecard you fill in, a demo script, a live-deal pilot, references, contract.
- CRM adoption at investment firmsCRM adoption at investment firms depends on less typing, a pipeline meeting run from the CRM, clear value per role, a 90-day plan and measured usage.
Cite this entry
Private Equity CRM. “CRM security and access control.” Canteris Reference, published by Canteris. Updated . https://privateequitycrm.com/security-and-access/