Service datasheet · Foundations
D365 F&O Security & License Governance
Right-size what you are paying for, close the segregation-of-duties gaps, and be ready for the audit before it is announced.
Security in Dynamics 365 Finance & Operations drifts quietly. Roles get cloned to unblock a go-live, duties get widened to close a period, and users accumulate access nobody has revisited in years. Because license entitlement is driven by the access a user holds, that drift is not only a control problem — it is a recurring line item on your subscription. This engagement measures both, and gives you a defensible model you can actually maintain.
2–3 weeks
Fixed fee
Access & cost
Findings + model
Who this is for
Facing a renewal or true-up
You suspect you are over-licensed but cannot prove it, and you need defensible numbers before the next subscription conversation.
Under audit pressure
Internal audit, an external auditor, or a SOX program has raised segregation-of-duties findings and you need a credible remediation path.
Post go-live sprawl
Security was built under go-live pressure and never revisited. Custom roles have multiplied and nobody can explain who has access to what.
What the review covers
We work from the actual security configuration and user assignments in your environment rather than from documentation, because the two rarely match.
Full inventory of security roles, duties, privileges, and the custom objects layered on top
User-to-role assignment mapping, including inherited and organization-scoped assignments
Custom role lineage — what was cloned from standard, what diverged, and why
Entry point analysis: the menu items and tables each role actually reaches
Segregation-of-duties conflicts against a recognized control framework
Elevated and administrative access, including system administrator assignment discipline
License type mapping across Full User, Activity, Team Members, and attach scenarios
Users consuming a higher license tier than their real job function requires
Dormant, duplicate, and orphaned user accounts still holding entitlement
Extensible data security policies and record-level restriction coverage
Alignment between security design and legal entity or organizational boundaries
Governance process: who requests, who approves, and how changes are evidenced
What you receive
License optimization findings
Current entitlement versus required entitlement, user by user, with the reassignment actions that move people to the correct tier.
SoD conflict matrix
Every conflict identified, rated by financial exposure, with a recommended resolution or a documented compensating control.
Target security model
A rationalized role design mapped to real job functions, plus the governance process that stops the drift from returning.
Why this engagement pays for itself
Cost and control together
Licensing and segregation of duties are the same dataset viewed two ways. Reviewing them separately duplicates effort and misses the overlap.
Evidence, not opinion
Findings are drawn from actual role and assignment data with the query logic shown, so your auditors can reproduce them.
Built to be maintained
A role model nobody can administer decays within two quarters. The target design is sized to the team you actually have.
How the engagement runs
Scoping call
Confirm entities, user population, control framework, and the audit or renewal driver.
Extraction
Guided export of security configuration, user assignments, and license position.
Analysis
Conflict detection, entitlement modeling, role rationalization, and exposure rating.
Readout
Findings walkthrough, savings position, remediation backlog, and governance model.
Scope boundaries
The engagement produces findings and a target model. Implementing the role changes in your environment is a separate remediation scope.
Licensing figures reflect Microsoft program terms as they stand at the time of the review; commercial negotiation with Microsoft or your reseller remains yours to conduct.
This is not a formal audit opinion and does not substitute for one. It is designed to make your audit go better.
Frequently asked
Will this actually reduce our license spend?+
Frequently, yes — the common pattern is users holding a full license because of a role granting access they never use. That said, the review is honest: if your position is already tight, the report says so and the value lands on the control side instead.
Do you need production access?+
Read-only access to security configuration and user assignments is ideal. Where that is not possible, the review can run against exports from a recent copy of production.
Which segregation-of-duties framework do you use?+
We map against a recognized control set and tailor it to your risk profile and industry. If your auditors have already issued a specific conflict list, we work to theirs.
We have dozens of custom roles. Is that a problem?+
It is common and it is the main driver of both cost and conflict. Part of the deliverable is collapsing that sprawl into a maintainable set mapped to real job functions.
How much of our team's time does this take?+
Usually a short extraction session with an administrator plus a few validation conversations with process owners — typically under eight hours in total.
Know what you are paying for
Send us your entity count and rough user population. We will confirm scope on a short call and tell you what the review is likely to surface.
Dexnen LLC is an independent consultancy specializing in Microsoft Dynamics 365 Finance & Operations. Microsoft, Dynamics 365, and related product names are trademarks of Microsoft Corporation. This page describes service scope and is not a contractual offer; engagement terms are set out in the applicable Statement of Work.