Topic starter
25/06/2026 12:58 am
TL;DR: User access reviews in Microsoft Dynamics 365 Business Central often fail when teams rely on spreadsheets, low-context reviewers, and infrequent certification cycles, leaving overprovisioned financial access, hidden indirect entitlements, and SoD conflicts untouched, according to Delinea. The governance issue is not review volume alone, but whether access reviews can actually expose what users can do with business-critical permissions.
Editorial analysis by NHI Mgmt Group, based on content published by Delinea: “User access reviews for Microsoft Dynamics 365 BC: Lightweight strategies that work”.
Key questions
Q: What breaks when SaaS access reviews rely on spreadsheets?
A: Spreadsheets freeze access data in time, so reviewers work from stale exports while roles, teams, and app usage keep changing.
Q: Why do over-permissive ERP roles create business risk even when reviews are done?
A: Because a completed review is only as good as the access model behind it.
Q: How can security teams tell whether a D365 BC access review is actually working?
A: Look for evidence that reviewers can explain what users can do, not just what roles they hold.
Practitioner guidance
- Prioritise high-risk D365 BC roles Begin certification with financial posting rights, vendor master access, and elevated roles such as Super so reviewers focus on the access most likely to create fraud, error, or SoD conflict.
- Replace spreadsheets with workflow-based reviews Use automated routing, reminders, and escalation so access owners see the full review task rather than a static list that hides dependencies and stale assignments.
- Review effective access, not just direct roles Validate indirect access, security group inheritance, and excluded permissions so certification reflects what users can actually do in the application.
Bottom line: Dynamics 365 BC access reviews fail when they certify role names instead of actual business capability.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 10:05 am
Risk-based certification is the only defensible review model for complex ERP access. Annual or quarterly review cycles are too blunt when a business system aggregates roles, security groups, and excluded permissions into effective access. Delinea’s example shows that the real control question is not whether a user has a named role, but whether that role combination creates financial or operational authority beyond job scope. Practitioners should treat access certification as a risk allocation exercise, not a routine calendar task.
A few things that frame the scale:
- Over 70% of organisations lack automated access risk analysis, user access reviews and provisioning and deprovisioning, according to Pathlock's 2025 Digital Transformation and Access Risk Report.
A question worth separating out:
Q: Who should own access certification for business applications like D365 BC?
A: IT can run the workflow, but business owners should decide whether access still fits the job. That accountability split matters because technical role names rarely describe business authority clearly enough for safe approval. Ownership belongs with the people who understand the process risk, while IT provides the control record.
👉 Read our full editorial: User access reviews for Dynamics 365 BC need risk-based rigor