Most ERP systems grant access by attaching menus or permissions to a job title, and many let an administrator make an exception for one person. D365 F&O builds access from the entry point upwards, has no deny, has no field-level restriction, and prices every user by the highest thing their roles can reach. This chapter maps the patterns that appear in almost every source system, whatever it is called.
Access control looks similar across ERP systems until you try to move it. The recurring shape is a container — a job title, a group, a profile, a permission set — with a list of programs or screens attached, users placed into one or more containers, and an administrator who can make an exception for an individual when the containers do…
Access levels on a permission are Read, Update, Create, Correct, Delete and Invoke. There is no separate privilege for opening a screen — Read implies it. If your source system separates the right to open something from the right to change it, that distinction has to be re-derived rather than translated.
Most of a security migration is reshaping. Three source patterns have no target equivalent at all, and each of them is in daily use somewhere in your current system.
The legal entity is the only hard boundary. It bounds security, the ledger, the subledgers and statutory reporting simultaneously, which makes it the cheapest and strongest restriction available.
If your organisation maintains a conflict matrix in a spreadsheet or in an external governance tool, this is better than that, because it enforces rather than reports. But it enforces without warning, and there is no way to run a rule in advisory mode to see who it would catch.
The licence tiers are Finance, Supply Chain Management, Commerce, Human Resources, Team Members and Activity. A role's requirement is the highest requirement of any entry point any of its duties can reach.
There is no single access report. Many source systems produce one document showing every way a user obtained their access, and auditors get used to it. The target answers the same questions from several places. Show auditors the replacement set before the first audit rather than during it.
Extract the current state as data, not as screenshots. Every user, every permission container including the ones that shipped with the product, every individual grant, every individual removal, every data restriction, and the current licence position. Isolate the individual removals. Group them by what was removed.
Most source systems are more expressive than D365 F&O in the specific ways organisations rely on daily: they can take a permission away from one person, they can hide a field from a population, and many of them can be licensed by concurrency. D365 is less expressive and considerably more auditable.