A company uses Dynamics 365 Sales and Dynamics 365 Customer Service apps. Technicians doing repair work should not have access to customer orders and invoices. You need to limit the technicians…

Environment-level security controls access to an entire Dynamics 365 environment but does not offer granular control over specific record types within applications for users who have environment access.

Data loss prevention (DLP) policies are designed to prevent sensitive data from being shared or exfiltrated outside the organization, not for controlling internal user access to specific record types within Dynamics 365 applications.

Role-based security in Dynamics 365 allows administrators to define security roles with precise privileges and access levels for different record types (entities). By creating a security role for technicians that specifically omits read or write privileges for the 'Order' and 'Invoice' entities, their access to customer orders and invoices can be effectively restricted.

Row-level security restricts access to individual records (rows) of data, typically based on ownership or business unit, but it is not the primary method for restricting access to entire entity types (like all orders or invoices) for a group of users.