Activities

The match roles process often results in new security roles. To access Microsoft Dynamics 365 for Finance and Operations, Enterprise edition, users must be assigned to security roles. This procedure guides you to the pages where you can:

• All securable objects: roles, duties, privileges, and entry points, with the related license type and access level.
  
• The associations between the securable objects: user-role, role-duty, role-privilege, duty-privilege, and privilege-entry point.

• Selected logged events.
  
• Events logged for selected users.
  
• Events logged for selected roles.
  

Use security requests to register any required changes in the security setup. As a user, you can create a security request from any page. You can only do so, if the 'Security request user' role is assigned to your user setup.

Security request type

For each security request type, a different type-specific section is added to the Security request page. In this section, fill in or add the required type-specific information.

This table shows the available security request types, for each type the related section, and a description of what to do in this section (see step 10):

As a security administrator, use security requests to register any required changes in the security setup. In Security and compliance studio, you can create security requests from the Security management workspace.

Security request type

For each security request type, a different type-specific section is added to the Security request page. In this section, fill in or add the required type-specific information.

This table shows the available security request types, for each type the related section, and a description of what to do in this section (see step 9):

All users must be assigned to at least one security role to have access to Dynamics 365 for Finance and Operations. The security roles that are assigned to a user determine the duties that the user can perform and the parts of the user interface that the user can view.

You can use the Security role wizard to create or edit a security role. You can select the desired duties, privileges, and entry points.

Snapshot

The Security role wizard uses the latest snapshot as a basis. So, for the Security role wizard to have the best performance, make sure the latest snapshot is up-to-date.

In the Security and compliance studio parameters, the Enable dynamic snapshot parameter exists. If set to:

• Yes, the roles that you create with the Security role wizard are saved automatically in the latest snapshot.
• No, no automatic updates are done to the latest snapshot. If you want a new role to be available for Security and compliance studio functions, create a new snapshot.

If you match roles to the securable objects from a security scenario, you can choose to create a new role from a selection of matched privileges. So, you can create a specific security role, which is still based on the security scenario.
The matched privileges have at least one of the securable objects from the scenario. In determining the match, the access level for the securable objects, as defined in the security scenario, are not considered.
Note that:

• A privilege can be shown several times, for a different securable object.
• A securable object can be shown several times as it can be linked to several privileges.
• For each entry, the related license types are shown.

This information offers the opportunity to reduce license costs. You can search for and select the privileges with the lowest license type.

You create snapshots to be able to use Security and compliance studio functions, for example:

Snapshot

Snapshot creation

You create a snapshot in these cases:

• The first time you want to explore the security configuration or match roles.
• Changes are made to the security configuration. So, these changes become available for the security explorer or match roles function.
• You want to compare the current security configuration with a previous security configuration.

You are advised to create snapshots:

• In batch, if you frequently make changes to the security configuration.
• In the background, because the creation of a snapshot can take quite some time.

Dynamic snapshot

In the Security and compliance studio parameters, you can use the 'Enable dynamic snapshots' field to enable automatic updates of security configuration changes to the latest snapshot. So, no new snapshot is required each time you change the security configuration.

Automatic updates of security configuration changes to the latest snapshot are done when you, for example:

• Publish changes.
• Approve security requests.
• Update or create a role with the wizard.
• Import security configurations.
• Assign users to roles.

Note: If yo use dynamic snapshots, you are advised to create a snapshot regularly. You do so to ensure that no security inconsistencies occur and to create a safety net,

On the sensitive data change tracking setup, you can define the users who can view the changes that are logged for the sensitive data setup.

If you:

• Do not define users, all users with access to the Sensitive data log page, can view all logged changes.
• Define users, only these users can view the logged changes for the sensitive data change tracking setup.

You can run the Microsoft Entra ID user status batch job to disable users in D365 FO if these users no longer exist in the Microsoft Entra ID.

If you have exported a security role configuration or customization, you can download the XML file from the Security and compliance file share workspace.

It is advisable to create a subset of security roles that are actually used in your company. This way, the security administrator has a better overview of the security roles that are used in your company.

So, if a standard security role matches a scenario, you can create an exact copy of this standard security role and assign this copy to the applicable users.

Consider creating a subset of security roles that are actually used in your company. This way, the security administrator has a better overview of the security roles that are used in your company.

This topic explains how you can create an exact copy of a security role.

On the sensitive data change tracking setup, you define the table fields for which sensitive data changes must tracked.

For each table that is defined in the General section of the Sensitive data setup page, a query is created automatically. If the the defined table is a:

• Common table, when the record is saved, the query is created. If the query already exists for the sensitive data setup, the query is automatically added to the record.
• Date-effective table or an inheritance structure table, the query is created when the table is mapped to a related staging table.

A query is applied on record level to the related table.

You can edit an automatically created query. Usually, you edit a query only in specific cases. For example, if a table record has a type field, you can make the query type-specific. For the LogisticsElectronicAddress table, you can, for example, track sensitive data changes only for addresses that are marked as Private. To do so, add a range to the related query with the Private field, and Criteria set to Yes.

• The related roles.
  
• The users that are assigned to these roles.
  
• The related privileges.
  
• The entry points of these privileges.
  

• Red dot - Operations
  
• Orange dot - Activity users
  
• Gray dot - None
  
• No dot - Team members

You can export a security role with all its related security configuration.
As a result, an XML file is created with the security role configuration. The XML file is stored in the Security and compliance file share workspace.
You can use the XML file to import and use the security role configuration in another environment.

You can export a customized security role. Only the security role customizations are exported.

As a result, an XML file is created with the security role customizations. The XML file is stored in the Security and compliance file share workspace.

You can use the XML file to import and use the security role customizations in another environment.

• All data of the sensitive data access setup.
• Only the sensitive data access setup that is related to a pinned security object in the security configuration.

• The related roles.
• The users that are assigned to these roles.
• The related privileges.
• The entry points of these privileges.

You can give a securable object access to sensitive data.

You can import a security role with all its related security configuration from an XML file that is exported from another environment.
When the securable objects are imported from the XML file, these objects are published automatically.
If dynamic snapshots are enabled, the published objects are automatically updated in the latest snapshot.

You can import a customized security role from an XML file that is exported from another environment. Only the security role customizations are imported.

When the securable objects are imported from the XML file, these objects are published automatically.

If dynamic snapshots are enabled, the published objects are automatically updated in the latest snapshot.

When changes to a security role are required, you can choose to create a new version of it. In this case, the previous version of the security role must become inactive. So, it can't be assigned to users anymore.

Before you inactivate a security role, make sure it's not assigned to any user. If you inactivate a security role that is still assigned to users, you get an error message listing the users to which it is assigned.

You can also activate an inactive security role.

During implementation, to make security configuration event logging possible, you initialize the Security and compliance studio IT audit. You initialize just once.

You can insert an image in the description of a security request.
You can insert an image as:

• Security request user from any page.
• Security administrator from the Security administration workspace.

In this topic, as an example, an image is inserted as Security user.

Use match roles to match all securable objects, as defined in a security scenario, to security roles.

For each license type, you can monitor the related number of users. You can also, for each user, monitor the related license type.

When you have set up the tracking of sensitive data changes, changes to sensitive data are logged.

Who can view the sensitive data log is defined on the related sensitive data change tracking users setup.

If on the sensitive data setup:

• No users are defined, all users with access to the Sensitive data log page, can view all logged changes.
• Users are defined, only these users can view the logged changes for the sensitive data change tracking setup.

On the Sensitive data log page, in the:

• Upper grid, view the sensitive data change events. Each time sensitive data is changed, an event is logged by table, user, sensitive data setup, and date/time.
• Details grid, for the selected sensitive data change event, view the data changes to one or more fields with sensitive data.

In Security and compliance studio, you can monitor all specified field asset classifications.

You can use table security to manage permissions on table field level. Use table security recording to define the tables and table fields for which you want to set or change permissions. After recording the fields, you can define the desired access right for each recorded field.

The licensing model of D365 F&SCM has changed. Previously, for D365 F&SCM, these license types were available:

You can set up rules to separate tasks that must be performed by different users. This concept is named segregation of duties. If on verification, the definition of a security role or the role assignments of a user violate the rules, the conflict is logged. All conflicts must be resolved by the security administrator.

For each logged conflict, you can:

• Deny the role assignment – Deny the assignment of the user to the additional security role. If you deny an automatic role assignment, the user is marked as excluded from the role. The excluded user is not granted the access that is associated with the role, and the user cannot be assigned to the role until the security administrator removes the exclusion.
  
• Allow the role assignment – Override the conflict and allow the user to be assigned to both security roles. If you override a conflict, you must enter a reason in the Reason for override field.

With the segregation rules (enhanced) functionality, you can use segregation security sets to generate entry point level segregation rules.

Use a segregation security set to list and group entry points for which segregation rules are desired. You can use these segregation security sets to set up segregation rules.

For each segregation rule with segregation security sets, child segregation rules are generated automatically. A child segregation rule is generated for each combination of entry points from the two segregation security sets of the segregation rule.

If you give a securable object access to sensitive data, you must specify the reason you do so. This topic explains how to set up sensitive data access reasons.

You can set up the tracking of changes to sensitive data. You set up sensitive data change tracking by field.

You can define the fields, for which sensitive data changes must tracked, in these ways:

• With the field picker
• Manually

You can add any field from any table to the sensitive data setup. However, the table can be date-effective or part of an inheritance structure. In this case, the table cannot be used to enable change logging for sensitive data. Instead, the related staging table must be used to enable change logging for sensitive data.

To define which staging table must be used to enable change logging, map the date-effective table or inheritance structure table to the desired staging table. Also, map the applicable fields of the date-effective table or inheritance structure table to the related fields of the staging table.

Examples of date-effective tables or inheritance structure tables and related staging tables are:

• DirPartyTable -> DirPartyAttachmentStaging
• DirPerson -> DirPersonStaging
• LogisticsPostalAddress -> LogisticsPostalAddressElectronicContactStaging

To use some features and functionality in D365 FO, user groups can be required. For example, users are outside the organization hierarchy for budget planning but must work with budget plans. You can assign budget plans to user groups. You can also set up restrictions for journal posting that are based on user groups.

This topic describes how to create a user group and add users to it.

As a security administrator, you can create a security request from the Security management workspace. Usually, a security request is approved by the security manager.

Once you have completed the security request creation, submit the security request for approval.

How the approval process is done, depends on the setup:

• An approval workflow is active: You submit the security request to the approval workflow.
• No approval workflow is active: You manually assign the security request to a security manager for approval.

As a security request user, you can create a security request from any page. Usually, a security request must be approved by the security manager.

Once you have completed the security request creation, submit the security request for approval.

How the approval process is done, depends on the setup:

• An approval workflow is active: You submit the security request to the approval workflow.
• No approval workflow is active: You manually assign the security request to a security manager for approval.

You can set up segregation of duties rules (enhanced) to separate tasks that must be performed by different roles or users. With the enhanced segregation rules, you can not only define segregation rules on duty level, but also on privilege level, on entry point level, and with segregation security sets.

On demand, a predefined set of segregation rules (enhanced) is available.

Predefined segregation rules

The set of segregation rules (enhanced) consists of:

• Segregation security sets: The segregation security sets have lists of entry points.
• Segregation of duty rules (enhanced): The segregation rules are based on segregation security sets or privileges.

The predefined segregation rules (enhanced) are mainly related to these functional areas:

• Purchase
• Sales
• Production
• Warehouse management

Import

You can import the predefined segregation of duties rules (enhanced) with the Data management import function.

To import the set of predefined segregation rules (enhanced):

1. Create an import project.
2. Add a file with source data format 'Package'.
3. Upload the data file. As a result, these entities are added to the import project:
   • Segregation security sets
   • Segregation security set lines
   • Enhanced SoD rules
4. Run the import project.

On import:

1. The segregation security sets and lines are imported.
2. The segregation rules (enhanced) are imported. These rules are set up for segregation security sets or for privileges.
3. For each imported segregation rule that is set up for segregation security sets, child segregation rules are generated. A child segregation rule is generated for each combination of entry points, as defined in the two segregation security sets of the segregation rule.

You can set up segregation of duties rules to separate tasks that must be performed by different users. On demand, a predefined set of segregation of duties rules is available.

These predefined segregation of duties rules are set up based on this risk identification matrix for several transaction types:

You can upload the predefined segregation of duties rules in Data management.

You can set up rules to separate tasks that must be performed by different users. This concept is named segregation of duties. Use Verify compliance of user-roles assignments to verify whether user role assignments comply with new rules for segregation of duties. So, it verifies inter-role compliance and user-level validations.

• Number of security objects with access to sensitive data
  
• Number of users with access to sensitive data per organization
  
• Number of roles per user with access to sensitive data
  
• Reasons to give roles access to sensitive data

• Roles
  
• Duties
  
• Privileges
  
• Users

For Security and compliance studio, an extension is added to the Person search report.

On the Person search report, in the Security and compliance studio results section, you can find this security information:

• Security requests of which the user is the owner.
• Stand-ins in which the user is involved. Both possibilities are shown:
  • The user is the stand-in for another user.
  • Another user is the stand-in for the user.
• Scenarios of which the user is the owner.
• Table security recordings of which the user is the owner.

For more information, refer to Person search report.