TL;DR: AI adoption is rapidly outpacing identity controls as organisations try to secure Microsoft Dynamics 365 with SoD, telemetry, and access risk analysis across finance, supply chain, and customer-facing workloads, according to Delinea. The governance problem is no longer visibility alone; it is whether access decisions can still be proven, enforced, and audited fast enough for AI-era business applications.
At a glance
What this is: This is an access-governance roundup for Microsoft Dynamics 365 that argues AI adoption is widening the gap between business application controls and the speed at which identity decisions now need to be made.
Why it matters: It matters because IAM, IGA, and PAM teams need to govern application access, segregation of duties, and license compliance in systems where business risk now moves faster than manual review cycles.
Context
Dynamics 365 access governance is the problem of proving that the right people and processes can reach the right business functions without creating segregation-of-duties, compliance, or operational risk. In this article, the core issue is that the control model around enterprise applications is being stressed by AI adoption and by the pace at which access decisions now need to be made.
The article focuses on Microsoft Dynamics 365 Finance & Supply Chain, Business Central, Customer Engagement, Dynamics AX, and Dynamics GP. It frames access governance as a business-controls problem rather than a pure IT problem, because organisations need to analyse access down to the securable object, track license usage, and surface risk quickly enough to support finance and operations.
Key questions
Q: How should teams govern access in Dynamics 365 environments?
A: Start with business transactions, not directory roles. Define the high-risk actions that create fraud, compliance, or data exposure, then test whether any identity can combine them in a harmful way. Add telemetry so reviews use actual activity, and treat service accounts and integrations as first-class identities.
Q: Why do non-human identities create SOX control gaps in ERP and CRM environments?
A: Non-human identities often hold broad, persistent access to financial workflows, so a single compromise can alter transactions, manipulate reports, or obscure audit evidence. SOX relies on accurate records and effective internal controls, and NHI sprawl weakens both when ownership, access boundaries, and behavioral monitoring are unclear. That makes governance and traceability essential.
Q: What are the signs that licence governance and access governance are drifting apart?
A: Common signals include unused licences that remain paid for, active accounts tied to abandoned applications, renewal alerts with no access review, and offboarding events that do not result in licence reclamation. Those are governance gaps, not just cost issues.
A: A mature programme can prove who created access, why it was granted, when it was reviewed, and how it was removed. The strongest signal is consistent evidence across identity, access, and audit workflows, not just faster provisioning. If reviews, revocation, and documentation remain manual, the programme is not yet audit ready.
Background and context
How SoD analysis maps to business-application risk
Segregation of Duties, or SoD, is the control that prevents one identity from combining conflicting capabilities in a business process. In Dynamics environments, the useful unit of analysis is not the whole application but the lowest securable object, because risk often emerges when a user can approve, post, amend, or reconcile within the same workflow. That is why access governance in ERP and CRM systems has to be object-level, not just role-level. Once organisations add AI-assisted workflows or more complex operating models, SoD becomes harder to interpret because the business process can change faster than the access model. The technical challenge is not simply detecting toxic combinations but keeping the access catalogue aligned with how the application is actually used.
Practical implication: Map SoD rules to the smallest meaningful business objects so risk analysis reflects real transaction paths, not just broad roles.
Why telemetry changes license compliance and access review
Telemetry in this context is behavioural usage data that shows whether a licensed capability is actually being used. For Dynamics 365, telemetry supports both cost control and governance because unused licenses can be reclaimed and access can be validated against actual activity rather than assumption. That matters when Microsoft license enforcement changes or when organisations need to prove that entitlement scope matches business need. Telemetry also gives governance teams a faster signal than periodic reviews, which is useful when application estates span multiple Dynamics products and legacy environments. The technical shift is from static entitlement counting to evidence-backed access decisions, where usage data becomes part of the governance record.
Practical implication: Use telemetry to identify unused entitlements, trim overprovisioned access, and back access decisions with current usage evidence.
How access-risk reporting supports audit and operational decision-making
Access-risk reporting turns raw entitlement and activity data into a governance view that business and audit teams can act on. In Dynamics 365, that includes showing where SoD conflicts exist, where privileged access is concentrated, and where application-specific controls are not keeping pace with operational change. The value is not only in detection but in shortening the time from issue identification to decision. That is why custom visualisations and faster reporting matter in ERP governance: they reduce the lag between control failure and remediation discussion. In practice, reporting becomes the bridge between technical access data and the evidence auditors expect.
Practical implication: Build reporting that highlights SoD conflicts, privileged access concentration, and remediation status in one governance view.
NHI Mgmt Group analysis
AI adoption is compressing the time available for access governance. The article’s central signal is not that Dynamics 365 is unusually risky, but that governance cycles built for slower change are being overtaken by operational pace. When business applications absorb AI-enabled processes, teams need evidence and enforcement faster than annual or quarterly review rhythms can provide. The practical conclusion is that access governance is becoming a real-time control discipline, not a retrospective compliance exercise.
SoD in enterprise applications now depends on object-level visibility, not role labels. Broad roles hide the combinations that actually create business risk, especially in finance and supply-chain workflows. The article’s emphasis on the lowest securable object reflects where auditors and control owners eventually land when they need defensible evidence. Practitioners should treat object-level analysis as the baseline for application governance, not an advanced option.
License compliance is now part of access governance, not a separate admin task. The article links unused licenses, upcoming enforcement, and telemetry into one operational problem: proving that access is both necessary and current. That collapses the old separation between cost management and control assurance. The implication is that governance teams must own licence visibility alongside entitlements, or they will miss both risk and waste.
Application governance is moving toward evidence-led control operations. Custom visualisations, faster risk insights, and continuous usage signals matter because they reduce the lag between detection and decision. This is not just a reporting preference; it reflects the way modern business applications are audited and managed under pressure. Practitioners should expect ERP governance to look more like continuous control monitoring than periodic certification.
Business application risk management is becoming a core identity discipline. The article shows why access decisions in Dynamics 365 cannot be left to application owners alone or treated as a niche ERP concern. Identity teams now need to govern who can do what inside critical business systems, with enough fidelity to satisfy security, finance, and compliance stakeholders. The practical conclusion is that application access governance belongs inside the identity programme, not beside it.
What this signals
Dynamics 365 governance is a useful example of a wider pattern: business application controls are now judged by how quickly they can produce evidence, not by how many policy statements they contain. As AI accelerates process change, access governance teams need continuous visibility into who can do what, where SoD conflicts sit, and whether licences still match real usage.
Evidence-led access governance: the decisive shift is from reviewing entitlements on a schedule to proving them against current system behaviour. That change affects ERP, CRM, and adjacent business applications alike, because control owners increasingly need telemetry, audit-ready reporting, and object-level access analysis in one operating model.
For practitioners
- Tighten SoD rules at object level Review Dynamics 365 entitlements down to the lowest securable object so conflicting capabilities are visible in finance, supply chain, and customer engagement workflows.
- Use telemetry to reclaim unused licenses Compare actual usage against assigned licenses across Dynamics 365 environments, then remove dormant access and reduce unnecessary cost exposure.
- Build risk reporting that shortens decisions Create access-risk dashboards that show SoD conflicts, privileged access concentration, and remediation status in one view for audit and control owners.
- Align governance with upcoming enforcement Prepare license and entitlement reviews for Microsoft’s enforcement changes so access evidence is current before compliance issues surface.
Key takeaways
- Dynamics 365 access governance now sits at the intersection of SoD, licence compliance, and operational change, which makes it a broader identity problem than a simple application admin task.
- The article points to access analysis at the lowest securable object, because role-level views are too coarse to defend business risk in finance and supply-chain workflows.
- Organisations that connect telemetry, reporting, and access review can shorten the distance between identifying a control issue and proving remediation.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST CSF 2.0, CIS Controls v8, NIST SP 800-53 Rev 5 and OWASP ASVS set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article is about governing access permissions and entitlements in Dynamics 365 business applications. |
| Recommendation — Apply PR.AA-05 to review Dynamics 365 entitlements against business need and SoD constraints. | ||
| CIS Controls v8 | CIS-5 — Account Management | License compliance and access cleanup depend on accurate account and entitlement management. |
| Recommendation — Use CIS-5 to remove unused Dynamics 365 accounts and keep assigned access aligned to current need. | ||
| NIST SP 800-53 Rev 5 | AC-6 — Least Privilege | SoD and object-level access analysis are both grounded in least-privilege enforcement. |
| Recommendation — Enforce AC-6 by limiting Dynamics 365 access to the smallest set of business functions required. | ||
| ISO/IEC 27001:2022 | A.8.2 — Privileged Access Rights | The article’s governance concerns include privileged access and control over sensitive application capabilities. |
| Recommendation — Review A.8.2 assignments to ensure privileged Dynamics 365 access is justified and periodically revalidated. | ||
| OWASP ASVS | V8 — Authorization | The article concerns whether access decisions inside business applications are properly constrained and auditable. |
| Recommendation — Apply V8 principles to verify that authorization paths in business applications match intended access rules. | ||
Key terms
- Segregation of Duties: Segregation of Duties is a control principle that prevents one person or role from combining incompatible permissions that could create fraud, error, or undetected change. In ERP environments, it must account for roles, transactions, approvals, and compensating controls across business processes.
- Securable Object: A securable object is a data resource that can have permissions applied to it, such as a database, schema, or table. In Snowflake-style access models, these objects form a hierarchy, so effective governance requires understanding both direct grants and permissions inherited through parent roles or higher-level resources.
- Telemetry: Telemetry is the raw data collected from systems, including logs, metrics, and traces. It becomes useful for governance only when it is correlated with identity, entitlement, and workload context so teams can interpret behaviour instead of just storing events.
- Access Risk Analysis: Access Risk Analysis is the process of evaluating entitlements against rules that define conflicting or excessive access. In SAP governance, it helps identify segregation of duties issues, critical permissions, and risky combinations before or after access is granted.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on May 28, 2026.
Updated on October 8, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org