Infor M3 Security Settings: Roles, Authorization and Setup
infor m3 security settings
Also searched as
- m3 roles and authorities setup
- m3 function authorization
- m3 user security company division
Short answer
M3 security combines who the user is, the roles they hold, which programs and options a role may use (function authority), and which companies, divisions, facilities and warehouses it may work in (data scope). You set it up by connecting users to roles and roles to authorizations, then audit with the security reports.
Applies to: Infor M3 Business Engine, on-prem and cloud. Identity may come from Infor OS / ION identity or directory services, depending on deployment.
Set up security for a new user group
- 1Define the job role in business terms first: what they need to enter, view and approve.
- 2Create or select the M3 role that represents it and connect the programs and options (function authority) it needs. Use the lowest rights that work.
- 3Connect the role to the companies, divisions, facilities and warehouses the group works in.
- 4Create the user and connect the role. Set the user's defaults in MNS150, including company and division.
- 5Check how identity is provided: single sign-on through your identity provider, a directory, or M3-managed passwords.
- 6Test as the user (or with a test account) by walking through the real process and noting any not-authorized messages.
- 7Document the role and who approved it, then audit periodically.
The layers
Identity answers who is signing in. Roles are the unit you manage; users should receive access through roles and not through individual exceptions. Function authority is the program and option level: view, create, change, delete. Data scope limits company, division and sometimes facility and warehouse.
Integrations follow the same rules. An MI call runs with the service user's roles, so a missing program authority shows up as a not-authorized error.
Segregation of duties
Design roles so that no one person can both create a supplier and approve its payments, or create a purchase order and receive it. Split these functions across roles and test combinations that one user might hold.
Document conflicts as a matrix and review it each audit cycle. Where a conflict cannot be avoided, compensate with approval workflows and report review.
Auditing
Use the standard security listings in your M3 version, or query the security tables on a reporting replica, to answer which users hold which roles and which roles can run which programs. Export results for the auditor.
Review dormant users, service accounts with broad rights and temporary access that was never removed.
Try it here, free
Infor M3 Go-Live Readiness Checklist
Checklist of items to confirm before an M3 go-live, grouped by data, testing, security and integration, and people and support.
Common pitfalls
- !Granting rights to individual users instead of roles.
- !Copying an administrator's access as a shortcut.
- !Service accounts with full authority and no owner.
- !Forgetting data scope, so a user sees every division.
- !No periodic access review.
How an ERP-grounded AI assistant handles this
Access review is slow when it means reading security tables by hand. A read-only assistant can list who can run a sensitive program, which users hold conflicting roles and which accounts are dormant, with the query shown. Netray can host it on-prem so identity data stays inside your network.
Frequently asked questions
Do I assign rights to users or roles in M3?
Roles. Connect users to roles and keep individual exceptions to a minimum, because roles are what you can audit and reuse.
Why does a user get a not-authorized error?
Their roles do not include the program or option, or the company, division or facility is outside their data scope. Compare against a user who can do the task.
Does the same security apply to API users?
Yes. An API call runs as the authenticated user, so give service accounts a dedicated role with only the programs they call.
Related
How to Change Division in Infor M3
In M3 a user works in one company (CONO) and one division (DIVI) at a time. You switch for the current session from the company/division selector in the H5 client, and you change the default you land in through the user settings (MNS150). If the division you want is missing or rejected, the user lacks authority for it.
Error fixM3 API Error: Not Authorized to Program
Not authorized to program (or the equivalent transaction-level authorization error) means the M3 user ID the integration authenticates as can log in fine but has not been granted access to that specific MI program, transaction, or company/division through its authority group. Fixing it means adding the program/transaction to the integration user's authority group in M3, not changing anything in the calling code.
Error fixEVS006 in Infor M3: What It Means and How to Fix It
EVS006 is an M3 message ID. We cannot give one authoritative meaning for it that holds across every version and program, and a guessed meaning would send you the wrong way. This page shows how to resolve the exact text and the field behind the message in your own system, which is the reliable way to fix any M3 message.
Error fixM3 API Error: Record already exist
Record already exist means the MI Add transaction you called is trying to insert a key that is already present in the target M3 table, most often because a prior call succeeded and was retried, or because the key fields you built do not match what you think they match. Read the errorField and errorFieldGroup attributes on the response to see exactly which key field M3 flagged, then either switch to the matching Chg (change) transaction or fix the key construction in the caller.
AdvancedPaging M3 API MI List Transactions Past the Default Record Limit
M3 List transactions (the read/browse transaction most MI programs expose, such as CRS610MI.LstByNumber or OIS100MI.LstOrderHead) cap the rows returned per call using the MaxReturnedRecords input field, and by default many clients leave it low or unset, which looks like the API silently truncating results. Set MaxReturnedRecords explicitly, then loop the call using the last key values from the previous page as the starting position until fewer rows than the limit come back.
How-toHow to Build a Grid Mapping in M3 Enterprise Collaborator (MEC)
M3 Enterprise Collaborator (MEC) moves data between an external format (EDI, flat file, XML) and M3's own API by chaining a collection step (getting the document in), a grid mapping step (field-level transformation from source structure to M3 API call structure), and a delivery step (executing the mapped MI transaction). Building a new mapping means defining the source document structure, building the grid that maps each source field to its M3 API field, and testing with representative sample documents before going live.
AI for ERPInfor M3 AI: A Practical Path from MI Programs to a Private Assistant
Infor M3 AI explained: grounded natural-language answers over MI programs and MEC, agents for distribution and manufacturing, on-prem or EU private cloud.
Stuck on Infor M3?
Talk to engineers who work inside Infor M3 every week, and who build private AI that answers these questions from your own ERP data.
Keep exploring
Free tools
- Infor M3 Go-Live Readiness ChecklistChecklist of items to confirm before an M3 go-live, grouped by data, testing, security and integration, and people and support.
- Infor M3 H5 Script Review ChecklistA review checklist for H5 Client scripts covering design, coding, security, testing and upgrade risk.
- Infor M3 AI Assistant Sizing and Value CalculatorSize the GPUs and estimate the monthly value and payback of a private, on-prem AI assistant for Infor M3.
ERP fixes and how-tos
- How to Change Division in Infor M3Change company and division in Infor M3: switch at runtime in H5, set the default in MNS150, and fix the authority problems that block a division change.
- M3 API Error: Not Authorized to ProgramM3 API or MvxAPI call rejected with Not authorized to program or transaction. Check the calling user's authority group and function grants, not just password.
- Infor M3 Date Format: User Setting, API and DatabaseHow dates work in Infor M3: the user display format in MNS150, the 8-digit YYYYMMDD format used by MI APIs and tables, and how to convert them.
Guides
- Infor M3 Supply Chain Planning: Settings That Actually MatterInfor M3 supply chain planning deep dive: planning methods, safety stock, planned orders, distribution orders, and MRP tuning that reduces expedites.
- Infor M3 Financials Configuration: Structure, Rules, and CloseInfor M3 financials configuration guide: company and division setup, accounting identities, FAM functions, accounting rules, and period close controls.
- AI Distribution Optimization for Infor M3Optimize Infor M3 distribution with AI. Warehouse automation, order fulfillment optimization, and demand forecasting for distribution-intensive operations.
AI on your ERP
- Infor M3 Customer Order Management With AI for Status, Allocation and Promise DatesAI for Infor M3 customer order management: answer order status, allocation and delivery date questions from OOHEAD and OOLINE data without exposing it publicly.
- Infor M3 Supply Chain Planning With AI That Explains the MRP OutputAI for Infor M3 supply chain planning: explain MRP action messages, review planned orders, and trace shortages through MITBAL and MITMAS on private infrastructure.
Integrations
- How to use ChatGPT with Infor M3How to use ChatGPT with Infor M3: exports, custom GPT actions over the M3 API or ION, enterprise data controls, and when a private model is the safer choice.
- How to add an AI chatbot to Infor M3How to add an AI chatbot to Infor M3 for staff and customers: grounded in M3 data via the API, embedded in a portal or Teams, and able to run fully on-prem.