D365 Finance and Supply Chain Security Role Design Worksheet
Security in Dynamics 365 Finance and Supply Chain is role based, built from roles, duties and privileges, with data restrictions on top. A clear design worksheet prevents the typical outcome of copied roles with accumulated rights nobody can explain. This sheet maps job functions to roles and rates the risk of each.
| Job function | Role (custom or standard) | Key duties | Data scope | SoD conflict | Users | Likelihood 1-5 | Impact 1-5 | Risk score | Role owner | |
|---|---|---|---|---|---|---|---|---|---|---|
6 | ||||||||||
6 | ||||||||||
12 | ||||||||||
15 | ||||||||||
8 |
Use this as a design and review sheet. The actual configuration lives in System administration > Security > Security configuration. Segregation of duties rules are defined and evaluated in the SoD feature of your version. Review with internal audit before publishing roles to production.
Access review from live D365 security data
Need role assignments and SoD findings summarized from your system? Optional follow-up, the worksheet is free.
Optional. The tool and every export work without this. No spam.
How to use the worksheet
List each job function, the role or custom role that serves it, and the key duties it needs. Choose the data scope, record whether a segregation-of-duties conflict exists, then rate likelihood and impact from 1 to 5. The risk score multiplies the two. Review the top-scoring rows first with the process owner and internal audit.
- Start from job functions, not from menu items
- Prefer standard duties and privileges, extend only when needed
- Record the owner who approves membership of each role
- Revisit scores after every major release
The D365 security model in brief
Roles contain duties, duties contain privileges, and privileges grant access to menu items, forms and actions with a specific access level. Users are assigned roles, optionally limited to legal entities or organization hierarchies. Extensible data security policies can restrict records further. Segregation of duties rules flag combinations of duties that should not sit with one person, such as vendor maintenance and invoice entry.
Designing for least privilege
Start with the standard role closest to the job and copy it into a custom role you control, then remove duties that are not needed. Avoid assigning the system administrator role for convenience. Keep emergency access in a controlled, logged and time-limited process. For manufacturing, review shop floor, planning and costing roles separately, since their data and posting power differ.
Common mistakes
Frequent issues are modifying standard roles directly so updates conflict, adding users to many roles until the union grants far more than intended, ignoring legal-entity scope, and never reviewing assignments after people change jobs. Run a periodic access review and record the outcome.
Frequently Asked Questions
What is the difference between a role, duty and privilege?
A privilege grants specific access to an object such as a menu item with a defined access level. A duty groups privileges for a business task. A role groups duties for a job function. Users receive roles, and effective access is the combination.
Should I edit standard security roles?
No. Copy a standard role into a custom role and change the copy. Direct edits to standard roles can conflict with updates and make it hard to explain what differs from the product baseline.
How do segregation of duties rules work?
You define rules that name two conflicting duties. When a role assignment or role definition creates the conflict, the system flags it and may require a documented mitigation. Rules are a control, so keep an owner and review date for every exception.
How do I limit a role to certain companies?
When assigning a role to a user you can limit it to specific legal entities or an organization hierarchy. For finer record-level restrictions use extensible data security policies, and test them with real user accounts, not an administrator.
If you want role and access questions answered from live D365 security data, read-only and with the queries visible, we can talk about how that is set up.
Related Tools
D365 Batch Job Checklist
A practical checklist to design, review and monitor batch jobs in D365 F&O, covering batch groups, recurrence, alerts, cleanup jobs and go-live checks.
Microsoft DynamicsD365 One Version Update Test Checklist
A repeatable checklist for testing each Dynamics 365 service update in a sandbox before production, including regression, extensions, integrations and rollback readiness.
Microsoft DynamicsD365 F&O Manufacturing Data Entities Reference
A searchable list of the data entities consultants reach for first when loading or integrating manufacturing data in D365 F&O, with the area, purpose and import notes.
Microsoft DynamicsD365 Data Management Import Worksheet Template
Track every D365 DMF import by entity, sequence, legal entity, rows loaded and errors, with an automatic error rate for cutover reporting.
More Microsoft Dynamics tools
See all- D365 F&O OData URL Builder
- D365 Finance and Supply Chain Functional Design Document Template
- D365 Finance and Supply Chain Fit-Gap Analysis Worksheet
- D365 Finance and Supply Chain Data Migration Mapping Worksheet
- D365 Finance and Supply Chain Cutover Plan Template
- D365 Finance and Supply Chain UAT Test Case Worksheet
- D365 Finance and Supply Chain Integration Interface Register
- D365 Finance and Supply Chain Change Request Form Template
- D365 Finance and Supply Chain Implementation Effort Estimator