Skip to navigation
User managementMulti-OrgMulti-Org configuration and managementMulti-Org upgrade models

DAC to Multi-Org migration

View as Markdown

The article features the transition from Data Access Control (DAC) to Zuora Multi-Org, highlighting the benefits and migration strategies for businesses.

Data Access Control (DAC) is not available for sale and is in maintenance mode. However, we will continue to support it for customers who already purchased this capability.

Data Access Control (DAC) enables organizations to manage user access to data within Zuora Billing through a hierarchical tag structure. Tags are assigned to users and objects, and access is determined based on the tag hierarchy.

Zuora Multi-Org was introduced to address DAC limitations, including:

  • No API support for managing the hierarchy
  • Limited flexibility in access management
  • Reduced administrative autonomy

Multi-Org provides a more scalable and API-driven framework for managing organizational structures and data access.

Migration Options

  1. Reuse the Existing DAC Hierarchy

    Migrate the existing DAC tag hierarchy to Multi-Org using a 1:1 mapping. This approach preserves the current organizational structure while transitioning to the Multi-Org framework.

  2. Create a New Multi-Org Hierarchy

    Design and implement a new organizational hierarchy in Multi-Org that better aligns with current business requirements.

Upgrade Using the Existing DAC Hierarchy

When using the 1:1 migration approach, DAC hierarchy elements are mapped to Multi-Org entities as follows:

DAC Tag Hierarchy 1:1 mapping to Multi-Org hierarchy

DACMulti-Org
Root Root is referred to as the global entity by default.Root Root is referred to as the global organization (default parent)
Segments Children under the root level.Org. Units Each of the children under the root is referred to as an org. unit.

For more information see DAC upgrade to Multi-Org.

API Changes

For DAC customers, migration to Multi-Org introduces backward-incompatible API changes.

Prior to migration, API payloads contain hierarchy fields in the format xxx__h. Where xxx represents the hierarchy API name.

After migration:

  • The xxx__h fields are no longer available.

  • These fields are replaced by organization-based fields such as:

    • organizationLabels
    • organizationLabel

Applications and integrations that reference DAC hierarchy fields must be updated to use the new Multi-Org organization fields.

Existing DAC API Payloads

The following APIs have xxx__h field in their response body:

MethodURIField Path
GET/accounts/{account-key}basicInfo.tags
GET/accounts/{account-key}/summarybasicInfo.tags
GET/catalog/product/{product-id}tags
GETcatalog/productsproducts.tags
MethodURIRequest body field
POST/ordersnewAccount.tagging
PUT/accounts/{account-key}tagging
PUT/orders/{orderNumber}newAccount.tagging

Key Differences Between DAC and Multi-Org

DAC

  • Users with access to a parent node automatically inherit access to all child nodes and their associated data.
  • Child nodes and their associated data can be removed from an organizational hierarchy, subject to hierarchy constraints.

Zuora Multi-Org

  • Access is granted explicitly to specific org units.
  • Users can access data only for the org units to which they have been assigned permissions.