1. Role Overview & Business Purpose
Role Name (AOT)
APEX_VendClerk_Custom
Display Name
Apex Accounts Payable Clerk (Restricted)
Cloned From
VendClerk — Standard Microsoft out-of-the-box Accounts Payable Clerk role
Business Purpose
Allows AP transactional staff to enter, match, and prepare vendor invoices for payment workflow submission. Explicitly prevents creation of Vendor Master records, generation of EFT payment files, and bypassing of the 3-way matching policy.
Legal Entity Scope
Enforced via XDS Policy APEX_AP_LegalEntity_XDS — Constrained to: UK01, UAE1, SA01
ERP Environment
D365 Finance & Operations · Cloud · Version 10.0.47
Remediation Trigger
SoD Conflict SOD-AP-001 — IT Audit Finding APEX-FIND-2025-001 (Grant Thornton UK ITGC Review Q3 2025)
2. Security Architecture Changes
| Change Type | AOT Object Name | Object Type | Business Justification | Risk Impact |
|---|---|---|---|---|
| REMOVED | VendTableMaintain | Duty | Prevents AP clerks from creating or modifying Vendor Master records — eliminates ghost vendor creation risk | Critical SoD conflict eliminated |
| REMOVED | VendPaymMaintain | Duty | Prevents AP clerks from generating or releasing Vendor Payment EFT files — eliminates unauthorised payment risk | Critical SoD conflict eliminated |
| REMOVED | VendInvoicePost | Privilege | Removes direct invoice posting. All invoices must now pass through D365 AP Workflow engine for independent approval | Authorisation control enforced |
| REMOVED | VendPaymProcess | Duty | Removes payment processing capability entirely from AP clerk role — payment execution isolated to Treasury team | Payment fraud risk eliminated |
| ADDED | APEX_VendInvoiceMaintain_NoPost | Custom Duty | Cloned from standard VendInvoiceMaintain. Stripped VendInvoicePost privilege. Forces workflow submission without direct posting capability | Business process maintained — risk eliminated |
| ADDED | VendInvoiceWorkspaceMaintain | Privilege | Grants access to AP Invoice Entry workspace — required for day-to-day invoice entry operations | Operational continuity preserved |
| ADDED | WorkflowStatusView | Privilege | Allows users to track the approval status of invoices they submitted through the workflow engine | Transparency without elevated access |
3. License Impact Assessment
⚠ License tier is determined by the highest-privileged entry point within the assigned role. Review required after every role modification to prevent M365 license enforcement blocking.
Finance (Base)
Operations tier triggered by VendTableMaintain and VendPaymMaintain entry points. User was over-licensed relative to actual business function.
Finance (Base)
License tier unchanged — AP invoice entry requires Finance Base. However, SoD risk eliminated through duty-level restriction without operational disruption.
4. UAT Test Results — Business Process Verification
| Test Case ID | Test Description | Expected Result | Actual Result | Tested By | Result |
|---|---|---|---|---|---|
| TC-AP-001 | Enter vendor invoice against a Purchase Order and submit to AP Workflow for approval | Invoice entered, workflow triggered, approval notification sent to manager | Invoice entered successfully. Workflow triggered. Approval routed to M. Al-Fayed (AP Manager). No direct posting option visible. | M. Al-Fayed AP Lead |
PASS |
| TC-AP-002 | Attempt to access Vendor Master maintenance form to create or edit a Vendor record | Hard-stop access denied error. No vendor master access. | System returned correct access denied error on Vendor Master form. User unable to view or modify vendor bank account details. | M. Al-Fayed AP Lead |
PASS |
| TC-AP-003 | Attempt to generate or release a Vendor Payment EFT file from Payment Journal | No access to Payment Journal generation. Hard-stop error. | Payment Journal menu item not visible in user navigation. Confirmed via Security Diagnostics that VendPaymProcess duty absent from role. | M. Al-Fayed AP Lead |
PASS |
| TC-AP-004 | View workflow approval status of a submitted invoice | Workflow status visible via WorkflowStatusView privilege | User able to view workflow approval history and current status without additional access. | M. Al-Fayed AP Lead |
PASS |
5. Approval & Sign-off
M. Al-Fayed
Accounts Payable Lead
Date: 14 August 2026
S. Mullaji
D365 Security Architect
Date: 15 August 2026
K. Patel
IT Audit Manager
Date: 17 August 2026