Topic starter
28/05/2026 11:39 am
TL;DR: AI adoption is rapidly outpacing identity controls as organisations try to secure Microsoft Dynamics 365 with SoD, telemetry, and access risk analysis across finance, supply chain, and customer-facing workloads, according to Delinea. The governance problem is no longer visibility alone; it is whether access decisions can still be proven, enforced, and audited fast enough for AI-era business applications.
Editorial analysis by NHI Mgmt Group, based on content published by Delinea: “DynamicsCon and DynamicsMinds Resources”.
Key questions
Q: How should teams govern access in Dynamics 365 environments?
A: Start with business transactions, not directory roles.
Q: Why do non-human identities create SOX control gaps in ERP and CRM environments?
A: Non-human identities often hold broad, persistent access to financial workflows, so a single compromise can alter transactions, manipulate reports, or obscure audit evidence.
Practitioner guidance
- Tighten SoD rules at object level Review Dynamics 365 entitlements down to the lowest securable object so conflicting capabilities are visible in finance, supply chain, and customer engagement workflows.
- Use telemetry to reclaim unused licenses Compare actual usage against assigned licenses across Dynamics 365 environments, then remove dormant access and reduce unnecessary cost exposure.
- Build risk reporting that shortens decisions Create access-risk dashboards that show SoD conflicts, privileged access concentration, and remediation status in one view for audit and control owners.
Bottom line: Dynamics 365 access governance now sits at the intersection of SoD, licence compliance, and operational change, which makes it a broader identity problem than a simple application admin task.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
28/05/2026 11:43 am
AI adoption is compressing the time available for access governance. The article’s central signal is not that Dynamics 365 is unusually risky, but that governance cycles built for slower change are being overtaken by operational pace. When business applications absorb AI-enabled processes, teams need evidence and enforcement faster than annual or quarterly review rhythms can provide. The practical conclusion is that access governance is becoming a real-time control discipline, not a retrospective compliance exercise.
A question worth separating out:
A: A mature programme can prove who created access, why it was granted, when it was reviewed, and how it was removed. The strongest signal is consistent evidence across identity, access, and audit workflows, not just faster provisioning. If reviews, revocation, and documentation remain manual, the programme is not yet audit ready.
👉 Read our full editorial: Dynamics 365 access governance exposes the gap between controls and AI