DAC to Multi-Org migration

The article features the transition from Data Access Control (DAC) to Zuora Multi-Org, highlighting the benefits and migration strategies for businesses.

Note: Data Access Control (DAC) is not available for sale and is in maintenance mode. However, we will continue to support it for customers who already purchased this capability.

Data Access Control (DAC) enables organizations to manage user access to data within Zuora Billing through a hierarchical tag structure. Tags are assigned to users and objects, and access is determined based on the tag hierarchy.

Zuora Multi-Org was introduced to address DAC limitations, including:

No API support for managing the hierarchy
Limited flexibility in access management
Reduced administrative autonomy

Multi-Org provides a more scalable and API-driven framework for managing organizational structures and data access.

Migration Options

Organizations with a DAC-enabled tenant can migrate to Multi-Org using one of the following approaches:

Reuse the Existing DAC Hierarchy

Migrate the existing DAC tag hierarchy to Multi-Org using a 1:1 mapping. This approach preserves the current organizational structure while transitioning to the Multi-Org framework.
Create a New Multi-Org Hierarchy

Design and implement a new organizational hierarchy in Multi-Org that better aligns with current business requirements.

Upgrade Using the Existing DAC Hierarchy

When using the 1:1 migration approach, DAC hierarchy elements are mapped to Multi-Org entities as follows:

DAC Tag Hierarchy 1:1 mapping to Multi-Org hierarchy


DAC	Multi-Org
Root Root is referred to as the global entity by default.	Root Root is referred to as the global organization (default parent)
Segments Children under the root level.	Org. Units Each of the children under the root is referred to as an org. unit.

For more information see DAC upgrade to Multi-Org.

API Changes

For DAC customers, migration to Multi-Org introduces backward-incompatible API changes.

Prior to migration, API payloads contain hierarchy fields in the format xxx__h. Where xxx represents the hierarchy API name.

After migration:

The xxx__h fields are no longer available.
These fields are replaced by organization-based fields such as:
- organizationLabels
- organizationLabel

Applications and integrations that reference DAC hierarchy fields must be updated to use the new Multi-Org organization fields.

Existing DAC API Payloads

The following APIs have xxx__h field in their response body:


Method	URI	Field Path
`GET`	`/accounts/{account-key}`	`basicInfo.tags`
`GET`	`/accounts/{account-key}/summary`	`basicInfo.tags`
`GET`	`/catalog/product/{product-id}`	`tags`
`GET`	`catalog/products`	`products.tags`


Method	URI	Request body field
`POST`	`/orders`	`newAccount.tagging`
`PUT`	`/accounts/{account-key}`	`tagging`
`PUT`	`/orders/{orderNumber}`	`newAccount.tagging`

Key Differences Between DAC and Multi-Org

DAC

Users with access to a parent node automatically inherit access to all child nodes and their associated data.
Child nodes and their associated data can be removed from an organizational hierarchy, subject to hierarchy constraints.

Zuora Multi-Org

Access is granted explicitly to specific org units.
Users can access data only for the org units to which they have been assigned permissions.

Welcome to Zuora Product Documentation

Explore our rich library of product information