← Back to Security Wiki
D365 F&O Architecture License August 2026 · 7 min read · Verified

The D365 F&O Security Role Architecture — Duties, Privileges, and Entry Points Explained for IT Directors

Security design is too often delegated to functional consultants. Without understanding the four-layer hierarchy, organisations inherit invisible SoD conflicts, uncontrolled license inflation, and ITGC findings that could have been prevented.

When security roles are assigned based on convenience rather than structured design, organisations inherit invisible Segregation of Duties conflicts, uncontrolled license inflation, and critical audit findings. True security governance begins with mastering the architectural hierarchy that dictates every user action inside the system.

The Four-Layer Hierarchy

Security Role

Job Function

Accounts Payable Clerk, Controller, Warehouse Manager. Users are never assigned direct permissions — only roles.

Duty

Business Sub-Task

Maintain vendor bank accounts, Approve vendor payments. Duties group related privileges to simplify role construction.

Privilege

Specific Access Level

Read, create, update, delete permissions on specific system objects. Privileges contain granular permissions.

Entry Point

AOT Software Object

Menu items, forms, reports, service operations, Web API operations. Every security evaluation resolves at this level.

What Entry Points Are and Why They Determine License Tier

Entry points are the granular software components that make up the D365 F&O application interface. They include menu items (Display, Action, Output), forms, reports, service operations, and Web API operations.

Key principle: A user's required license tier — Finance, Supply Chain Management, Commerce, or Team Members — is determined entirely by the highest privileged entry point assigned across all active roles. One premium menu item anywhere in the role set classifies the user at that premium tier.

If an operational user requires a lower-tier license but is assigned a single custom role containing one entry point mapped to a higher-tier requirement, the system reclassifies their entire license consumption upward. Stripping unnecessary premium entry points is the primary mechanism for license cost optimization.

How Duties Map to Business Processes

Duties are the primary building blocks for SoD frameworks. A well-designed duty aligns with a distinct business process while isolating incompatible functions. In the Procure-to-Pay cycle:

When cleanly separated into different roles, no single user can execute both steps. When a poorly configured role combines both, the user gains end-to-end control over the disbursement lifecycle.

Standard Roles vs. Custom Roles — Risks of Each

Standard OOTB Roles: Microsoft designs them for broad operational functionality — not strict audit compliance. They frequently contain unneeded access paths, hidden SoD conflicts, and elevated license requirements that push users into premium tiers unnecessarily.

Custom Roles: Allow precise least-privilege design but carry risk through undisciplined creation. Custom roles built without verifying underlying privileges and entry points often accumulate orphaned permissions or break during One Version monthly updates.

How to View Role Contents in D365 F&O

To audit what components are packed inside a security role:

Maintaining strict separation between role assignment and role design — ensuring that team members assigning user access cannot modify security definitions — is itself an essential governance control.

The Most Common Role Design Mistakes

Finding 1 — Material Weakness
Assigning System Administrator Role for Convenience
Granting super-user rights to functional users or technical support personnel to bypass permission errors. This instantly triggers a critical material weakness finding in any ITGC audit.
Finding 2 — Update Risk
Modifying Standard OOTB Roles Directly
Altering Microsoft-delivered roles rather than duplicating them into custom layers. Modified OOTB roles are overwritten during service updates, silently restoring the original over-privileged configuration.
Finding 3 — SoD Violation
Ignoring Additive Privilege Accumulation
Assigning multiple roles to a single user without evaluating how intersecting privileges combine. A user with three roles holds the cumulative duties of all three — the SoD engine evaluates the combination, not each role individually.
Finding 4 — Access Gap
Failing to Restrict Custom Entry Points
Creating custom reports or web services without assigning them to proper security privileges — leaving critical code execution endpoints exposed to unauthorized users or anonymous access.

A complete D365 F&O role architecture review — identifying SoD conflicts, license-inflating entry points, and role design deficiencies — delivered within 48 hours. No system access required.