Credit Management Platform Engineering

Tech Stack

The Problem

The platform showed several symptoms of accumulated drift: email duplication on the Outlook tracking layer (the add-in's retry mechanism produced two records with identical MessageID, polluting case timelines), no server-side enforcement of business rules (key template-generated tasks could be deleted by handlers, breaking workflow integrity), 12 of 32 JavaScript web resources still relied on the deprecated Xrm.Page API, a SharePoint security mismatch where every authenticated tenant user could browse confidential case documents regardless of Dataverse roles, and a bloated Dataverse Search index consuming 16 GB on DEV alone across 51 indexed tables including many Microsoft-managed entities the firm never used.

Custom Plugin Development

Built a Pre-Validation Delete plugin in C# that blocks deletion of any task created from a key template — server-side enforcement closes the bypass loophole that UI-level locks left open, regardless of whether the deletion comes from the form, a grid, or the Web API. The plugin was scaffolded, built, signed, and deployed entirely from macOS using dotnet + pac CLI + direct Dataverse Web API calls — no Visual Studio, no Plugin Registration Tool. Navigating this required working through several undocumented Dataverse behaviours (solution-prefix requirement on PluginPackage fields, first-time registration via direct POST, correct ComponentType for package-to-solution association). I captured the full cross-platform recipe in a reference file now reused across multiple Power Platform projects.

Power Automate Flow Engineering

Diagnosed and rebuilt the email deduplication pipeline across three concrete scenarios: incoming email arriving when an Outgoing record already exists (cancel incoming, clear the regarding lookup), same-direction duplicates (cancel the newer, preserve the older), and outgoing email superseding an incoming (cancel the older, migrate the regarding link). Several Dataverse/Power Automate discoveries fed the implementation: the Dataverse connector cannot clear polymorphic lookups like regardingobjectid (implemented via raw HTTP DELETE with forwarded auth token), a 60-second Delay protecting against race conditions required a sibling Terminate action with runAfter Failed/TimedOut to swallow legitimate 404s from Get_trigger_email without flooding the support inbox. Validated by byte-level structural diff against backup before deployment and end-to-end tested on DEV.

Web Resource Modernization

Audited all 32 JavaScript web resources in the active solution and produced a per-script refactoring plan: 12 of 32 still used the deprecated Xrm.Page API, 27 of 32 lacked namespace wrappers (global scope collision risk), 29 of 32 lacked try/catch blocks (silent failure risk), and 20 of 32 had console.log statements left from development. Delivered a phased plan (~5–6 hours of work across 4 phases) with per-script problem/solution/test specifications structured as Jira-ready tasks. Phases 1–3 fully eliminate deprecated API usage; Phase 4 handles best-practice cleanup. The shared utility library refactor was flagged as high-impact (signature change requires updating all callers simultaneously) and isolated to its own phase.

SharePoint Security Architecture

Investigated a security gap where every authenticated tenant user could browse the SP site holding 35k+ case folders, regardless of Dataverse role assignments. Analyzed the underlying constraint — Microsoft's Server-Based SharePoint Integration always uses user-impersonation for the Documents tab, so app-only access simply isn't available for the model-driven app's document grid. Evaluated 12 architectural options ranging from lockdown + UX-disable through Microsoft Sensitivity Labels + DLP, multi-site distribution, custom PCF + app-only proxy, third-party tools, and full migration to Dataverse File columns. For third-party options specifically, I verified through vendor documentation that marketing claims of "overcoming the 50,000 unique permissions limit" are achieved through multi-library partitioning, not removal of the underlying SharePoint constraint. The product team selected a canvas-app-with-app-only-proxy path (zero direct SP access for users, mediated read/write through a service account) as the architectural target based on the trade-off matrix.

Dataverse Search Performance

The product owner reported that Dataverse Search in PPAC showed 354 indexed columns out of 950 (37%), and the team hadn't been able to reconcile this with a SQL backend dump showing different field counts. Performed a full reconciliation: confirmed 51 tables enabled for Global Search via EntityMetadata.SyncToExternalSearchIndex, parsed all 50 default Quick Find Views extracting Find/View/Filter columns, applied Microsoft's index multipliers (Lookup ×3, OptionSet/State/Status ×2), and reconciled to 328 weighted fields plus common defaults — within ~5% of the UI's number. Identified that the SQL flag the team was investigating (issearchable = 2,011 fields) is IsValidForAdvancedFind — a permission flag, not a Global Search membership flag. The team had been chasing the wrong lever. Delivered a cleanup plan with two leverage points: remove ~35 unused tables from the index (Customer Service, Field Service, Copilot Studio, Power Pages tables the firm never used) for the largest single ROI, plus trim Find/View columns from remaining Quick Find Views. Created a dedicated unmanaged solution structured for clean transport to TEST and PROD, with projected ~50–60% reduction in weighted index fields.

Outcome

Custom plugin deployed to DEV and confirmed by the product owner ("All works as expected"). Email deduplication flow active on DEV and PROD covering all three duplicate scenarios with safe failure modes. Web resource refactoring plan accepted — 25 dev tasks ready for sprint planning with per-script test plans. SharePoint security architecture decision unblocked with written trade-off matrix delivered to the technical lead for budget approval. Search index cleanup solution prepared for transport with projected ~60% reduction in weighted indexed fields. Parallel documentation produced: a reference file for cross-platform plugin deployment from macOS (now reused across other projects), a worklog capturing every deploy and decision for client billing transparency, and an ongoing Dataverse API knowledge base capturing platform-specific gotchas.