# D365 Finance and Supply Chain Security Role Design Worksheet > Source: https://netray.co/tools/d365-security-role-design-worksheet > Publisher: Netray (netray.co), AI and integration engineering for ERP and manufacturing systems. > Section: Free Tools ## Short answer Map job functions to custom security roles, duties, data restrictions and segregation-of-duties conflicts, with a risk score per role for review. ## Category microsoft-dynamics ## Erp Microsoft Dynamics 365 Finance and Supply Chain ## Audience - D365 F&O consultant - Security architect - Internal auditor ## Tool **Kind:** worksheet **Mode:** editable **Columns:** #### Job function **Key:** func **Type:** text #### Role (custom or standard) **Key:** role **Type:** text #### Key duties **Key:** duties **Type:** text #### Data scope **Key:** scope **Type:** select **Options:** - All legal entities - Single legal entity - Organization hierarchy - XDS policy #### SoD conflict **Key:** sod **Type:** select **Options:** - None - Mitigated - Open #### Users **Key:** users **Type:** number #### Likelihood 1-5 **Key:** likelihood **Type:** number #### Impact 1-5 **Key:** impact **Type:** number #### Risk score **Key:** risk **Type:** number **Expr:** likelihood * impact **Format:** integer #### Role owner **Key:** owner **Type:** text **Rows:** **Func:** Production planner **Role:** Production planner (custom copy) **Duties:** Maintain planned orders, firm and schedule production orders **Scope:** Single legal entity **Sod:** None **Users:** 6 **Likelihood:** 2 **Impact:** 3 **Owner:** Operations manager **Func:** Shop floor supervisor **Role:** Production floor manager (custom copy) **Duties:** Release, start and report production orders **Scope:** Single legal entity **Sod:** None **Users:** 12 **Likelihood:** 2 **Impact:** 3 **Owner:** Plant manager **Func:** Buyer **Role:** Purchasing agent (custom copy) **Duties:** Create and confirm purchase orders **Scope:** Organization hierarchy **Sod:** Mitigated **Users:** 8 **Likelihood:** 3 **Impact:** 4 **Owner:** Procurement lead **Func:** Accounts payable clerk **Role:** Accounts payable clerk (custom copy) **Duties:** Enter vendor invoices, no vendor master change **Scope:** Single legal entity **Sod:** Open **Users:** 5 **Likelihood:** 3 **Impact:** 5 **Owner:** Controller **Func:** Cost accountant **Role:** Cost accountant (custom copy) **Duties:** Run inventory close, maintain costing versions **Scope:** All legal entities **Sod:** None **Users:** 3 **Likelihood:** 2 **Impact:** 4 **Owner:** Controller **Totals:** #### Total role assignments **Key:** users **Agg:** sum **Format:** integer #### Average risk score **Key:** risk **Agg:** avg **Format:** decimal **Summary:** #### Average risk score **Key:** mean_risk **Expr:** avg_risk **Format:** decimal **Primary:** true #### Roles reviewed **Key:** role_count **Expr:** count **Format:** integer **Notes:** Use this as a design and review sheet. The actual configuration lives in System administration > Security > Security configuration. Segregation of duties rules are defined and evaluated in the SoD feature of your version. Review with internal audit before publishing roles to production. ## Content **Intro:** Security in Dynamics 365 Finance and Supply Chain is role based, built from roles, duties and privileges, with data restrictions on top. A clear design worksheet prevents the typical outcome of copied roles with accumulated rights nobody can explain. This sheet maps job functions to roles and rates the risk of each. **Sections:** #### How to use the worksheet **Body:** List each job function, the role or custom role that serves it, and the key duties it needs. Choose the data scope, record whether a segregation-of-duties conflict exists, then rate likelihood and impact from 1 to 5. The risk score multiplies the two. Review the top-scoring rows first with the process owner and internal audit. **Bullets:** - Start from job functions, not from menu items - Prefer standard duties and privileges, extend only when needed - Record the owner who approves membership of each role - Revisit scores after every major release #### The D365 security model in brief **Body:** Roles contain duties, duties contain privileges, and privileges grant access to menu items, forms and actions with a specific access level. Users are assigned roles, optionally limited to legal entities or organization hierarchies. Extensible data security policies can restrict records further. Segregation of duties rules flag combinations of duties that should not sit with one person, such as vendor maintenance and invoice entry. #### Designing for least privilege **Body:** Start with the standard role closest to the job and copy it into a custom role you control, then remove duties that are not needed. Avoid assigning the system administrator role for convenience. Keep emergency access in a controlled, logged and time-limited process. For manufacturing, review shop floor, planning and costing roles separately, since their data and posting power differ. #### Common mistakes **Body:** Frequent issues are modifying standard roles directly so updates conflict, adding users to many roles until the union grants far more than intended, ignoring legal-entity scope, and never reviewing assignments after people change jobs. Run a periodic access review and record the outcome. **Cta:** If you want role and access questions answered from live D365 security data, read-only and with the queries visible, we can talk about how that is set up. **Faq:** #### What is the difference between a role, duty and privilege? **Answer:** A privilege grants specific access to an object such as a menu item with a defined access level. A duty groups privileges for a business task. A role groups duties for a job function. Users receive roles, and effective access is the combination. #### Should I edit standard security roles? **Answer:** No. Copy a standard role into a custom role and change the copy. Direct edits to standard roles can conflict with updates and make it hard to explain what differs from the product baseline. #### How do segregation of duties rules work? **Answer:** You define rules that name two conflicting duties. When a role assignment or role definition creates the conflict, the system flags it and may require a documented mitigation. Rules are a control, so keep an owner and review date for every exception. #### How do I limit a role to certain companies? **Answer:** When assigning a role to a user you can limit it to specific legal entities or an organization hierarchy. For finer record-level restrictions use extensible data security policies, and test them with real user accounts, not an administrator. ## Search terms d365 security role design, d365 security matrix template, dynamics 365 finance security roles spreadsheet, d365 segregation of duties matrix, d365 f&o custom security role template, d365 duties privileges worksheet, d365 role based security design document, d365 sod conflict template --- Talk to an engineer: https://netray.co/contact?intent=erp_ai | Machine catalog: https://netray.co/agent/catalog.json