For CFOs, IT Directors, and Finance Directors managing D365 F&O, modernizing access governance often means shifting user provisioning from manual ERP entry to centralized Entra ID security groups. While this streamlines onboarding and aligns with zero-trust identity architectures, it introduces a critical, silent failure point in IT General Controls (ITGC).
When security role assignments are inherited dynamically from the identity management layer, the ERP application remains blind to intersecting privileges at the individual user level. Your native compliance reports will show zero unresolved SoD conflicts — providing a false sense of security — while users may silently possess the ability to create vendors and approve their own payments without triggering a single system alarm.
How the D365 F&O SoD Engine Works Normally
The native SoD framework in D365 F&O operates on a rigid hierarchical logic: Role → Duty → Privilege. The SoD rules engine evaluates risk exclusively at the Duty level.
In a standard setup, administrators navigate to System Administration → Security → Assign users to roles and manually link a user account to a security role. Conflict rules are configured at System Administration → Security → Segregation of Duties → Segregation of Duties Rules.
When the IT governance team executes the Verify compliance of user-role assignments batch job, the system scans the SecurityUserRole table. It looks at every individual user, unpacks the roles physically assigned to their profile, and cross-references the underlying duties against the conflict matrix. If a user holds conflicting duties, the system flags the violation and routes it to System Administration → Security → Segregation of Duties → Segregation of Duties Unresolved Conflicts — forcing an administrator to either deny the assignment or document a mitigation override.
What Happens When Entra ID Groups Are Used
The architecture fractures when organisations enable the Microsoft Entra ID security group configuration key and assign D365 security roles directly to Entra ID group objects — rather than to individual user records. Administrators navigate to System Administration → Users → Groups and assign roles to the group.
When a user logs in, D365 F&O validates their group membership token and dynamically grants cumulative access from all assigned roles. However, the native SoD engine is completely unequipped to unpack this group payload.
If a user belongs to an Entra ID "AP Clerk" group (granting invoice creation) and an "AP Manager" group (granting payment approval), they possess full end-to-end control over cash disbursements. The native D365 SoD compliance report returns completely clean — falsely asserting no conflicts exist.
How to Identify If Your Environment Is Affected
System Administration → Setup → License Configuration → expand the Administration folder. If the Microsoft Entra ID security group configuration key is checked, your environment supports group assignments.System Administration → Users → Groups. If this grid is populated with imported Entra ID groups and those groups have security roles assigned in the lower pane — your environment is actively using group-based provisioning and your SoD reports are unreliable.System Administration → Security → Segregation of Duties → Segregation of Duties Conflicts. If the report shows zero conflicts but your environment uses Entra ID group provisioning — the clean report is a false negative, not genuine compliance.What Auditors Find
External auditors do not rely on native D365 F&O compliance reports. During an ITGC or SOX audit, the audit team formally requests a full export of Entra ID group memberships alongside D365 role-to-duty architectural mappings.
Using external scripts or continuous controls monitoring software, auditors flatten the relational data and manually intersect group memberships with the ERP security layer. When they uncover users holding unmitigated conflict pairs — such as PurchOrderMaintain + PurchTableApprove — via inherited group access, they issue a material weakness finding.
The consequences include failed compliance audits, mandated emergency remediation projects, and costly retroactive forensic reviews to verify those over-privileged users did not execute fraudulent transactions during the fiscal period.
How to Remediate
Closing Recommendation
If your organisation provisions D365 F&O access via Entra ID groups, operate under the assumption that your native Segregation of Duties reports are fundamentally inaccurate. Finance and IT Directors must proactively mandate a review of group-based security assignments and implement external analysis or transition to automatic role assignments.
External auditors and regulatory bodies will not accept ignorance of underlying system architecture as an excuse for exposing the organisation to financial risk and internal fraud.
Identifying the Entra ID provisioning gap requires cross-referencing your D365 role assignments with your Entra ID group memberships — delivered as a complete governance report within 48 hours. No system access required.