Business One authorises each user individually and has no role object at all, so this is not a translation exercise — it is the design of a role, duty and privilege catalogue from scratch, with data ownership rebuilt as Extensible Data Security, segregation of duties introduced for the first time, and a licence bill that role design now writes.
Every other source system covered on this site arrives with something role-shaped. There is a responsibility, a permission list, an authorisation template, a PFCG role — an object that somebody built, that several users share, and that a migration team can inventory, argue about and map.
Before designing anything, it is worth writing down precisely what exists, because the inventory is short and the shortness is the point.
D365 composes four levels above the entry points they secure, and the composition runs upward from objects the application already contains rather than downward from a written access matrix.
Because there is no source catalogue, the method matters more here than on any other path. This is the sequence that works.
This is the hardest single mapping on the path, and it is hard for a reason that is easy to state and easy to underestimate.
The organisational chapter for this path settled what each company database becomes. The security consequence is worth stating separately, because it changes something the estate never had to think about.
D365 ships a genuine segregation-of-duties engine. A rule pairs a first duty with a second duty, carries a severity and free-text risk and mitigation notes, and the platform refuses to combine the conflicting duties into one role at save time.
In the source estate, two decisions are independent: somebody picks a licence type for a user, and somebody ticks authorisation nodes. Neither constrains the other.
The source estate has a change log available on master-data and document windows without anybody enabling anything, which means it treats change history as something the application simply does. That expectation needs resetting carefully.
There is no source role to convert, so the worked example runs the other way: from a job to a role.
Business One has no role object, so this workstream has nothing to translate and everything to design. Authorisations are per user, the only reuse mechanism is copying somebody's position, and a mature estate therefore has as many distinct positions as it has users.