Today, users who have access to call recordings and transcriptions can view and download those artifacts by default. This feature introduces role-based controls that allow organizations to preserve view access while explicitly denying download capabilities.

Two new Dataverse security roles are introduced:

Deny Recording Download
Deny Transcription Download

When either role is assigned to a user:

The user can continue to view and play back recordings and transcripts as permitted by existing access.
The user is blocked from downloading the corresponding artifact.

Enforcement model

Enforcement is applied server-side across:
- Dynamics 365 Contact Center UI
- Public and internal APIs
- Direct download URLs or integrations
Download requests are denied regardless of how they are initiated.

Scope and configuration

Access control is driven entirely by Dataverse role assignment.
The deny roles override implicit download behavior without affecting recording, transcription, or playback functionality.

Security and compliance impact

Prevents unauthorized data export while maintaining operational visibility.
Enables clear separation between data consumption and extraction.
Supports enterprise and regulated-industry security expectations with explicit, auditable authorization controls.

This design ensures that access to recordings and transcripts is intentional, enforceable, and aligned with modern data protection standards.