D365 F&O: Architect Guide to the New License Management
Enterprise implementations of Microsoft Dynamics 365 Finance and Supply Chain Management frequently incur substantial licensing audit penalties when custom security configurations inadvertently elevate user requirements. Under Microsoft's modern licensing architecture, tenant-level license reconciliation has transitioned toward centralized Power Platform admin center reporting and strict metadata-driven SKU evaluation. This guide provides enterprise architects with the technical mechanics to troubleshoot role-to-privilege license elevations, resolve Base versus Attach discrepancies, and build automated compliance monitoring pipelines.
At a glance
- 🔹 Applies to: Dynamics 365 Finance, Dynamics 365 Supply Chain Management (Platform update 10.0.38 and higher).
- 🔹 Prerequisites: System Administrator role in D365 F&O, Service Admin access to Power Platform admin center, and familiarity with AOT security metadata properties.
- 🔹 Effort level: Medium (4 to 8 hours for complete audit, remediation, and reporting automation).
- 🔹 Outcome: Complete alignment between Microsoft 365 tenant license purchases and F&O security role consumption, zero unexpected audit findings, and automated drift alerts.
How it works
Dynamics 365 Finance & Operations calculates license requirements from the bottom up. Every entry point in the Application Object Tree (AOT)—including Display, Action, and Output menu items—defines two metadata properties: ViewUserLicense and MaintainUserLicense. When a user receives Read permission to an entry point through a privilege, the system applies the ViewUserLicense tier. When a user receives Create, Update, Correct, or Delete permissions, the runtime engine applies the MaintainUserLicense tier. These requirements roll up through Privileges into Duties, aggregate into Security Roles, and resolve into an effective named-user SKU per user account.
The system batch job SysUserLicenseMiner runs periodically to inspect the security graph and update the underlying database tables (principally SysUserLicenseCountDetails and SysUserLicenseCount). Under the modernized licensing framework, Microsoft correlates these computed requirements against assigned tenant licenses in Entra ID and the Microsoft 365 Admin Center. Organizations utilizing multi-application footprints must account for Base and Attach tiering: a user accessing both Finance and Supply Chain Management requires one primary Base license and one secondary Attach license. If custom roles unintentionally include cross-functional entry points, users can inadvertently consume two full Base licenses.
| Capability / Mechanism | Legacy Licensing Model | Modern Unified License Management |
|---|---|---|
| Primary Administration Interface | F&O client (User license counts report) | Power Platform admin center & M365 Admin Center |
| Base vs. Attach Valuation | Manual calculation in Excel spreadsheets | Automated tenant reconciliation via licensing service |
| Custom Metadata Resolution | Static AOT properties evaluated on client sync | Continuous evaluation via SysUserLicenseMiner batch job |
| Multiplexing & Service User Auditing | Difficult to track across integration tiers | Unified service principal and user licensing telemetry |
| Security Role Analysis Granularity | Summary counts by User and License Type | Privilege- and entry-point-level exploded associations |
Step-by-step solution
-
Execute the License Mining Batch Process
Ensure that calculated licensing counts reflect the current security role assignments. Navigate to System administration > Inquiries > License > User license counts and verify the last run date. If security configurations were recently imported or deployed via ALM pipelines, trigger an immediate execution by scheduling the
SysUserLicenseMinertask under System administration > Periodic tasks > Process user license counts. This refreshes the underlying staging tables that populate both client-side inquiries and Dataverse-exposed entities. -
Inspect Role Licensing Demands via Security Configuration
Open System administration > Security > Security configuration to analyze custom role footprints. Select the target custom security role and review the User license type field in the role properties pane. If a role designed for warehouse floor personnel shows Operations instead of Activity, drill into the assigned duties to isolate which specific privilege drives the elevation.
-
Identify Elevated Menu Items in Visual Studio or Metadata Browser
Open Visual Studio and search the AOT for the offending privileges identified in step 2. Check the entry point permissions within each privilege: locate any Display or Action menu items where
MaintainUserLicenseis set toEnterpriseorOperations. In many custom extensions, developers duplicate standard menu items without altering the default licensing metadata, unintentionally binding the privilege to a full enterprise tier. -
Remediate Privilege Splitting and Access Levels
Deconstruct monolithic privileges into separate Read and Maintain variants to enforce the principle of least privilege. Assign the Read-only privilege (which points to
ViewUserLicense = ActivityorTeamMembers) to operational inquiries, and isolate edit/create operations into distinct privileges. If a duty only requires viewing status records, remove the maintain-level privilege so the runtime miner demotes the user's required license tier. -
Isolate Cross-App Permissions to Preserve Attach Tiering
Review combined roles that bundle Finance capabilities with Supply Chain Management duties. To avoid uncoordinated license consumption, ensure that users requiring access across both applications are assigned distinct, single-application roles rather than hybrid composite roles. This separation allows billing algorithms in the Power Platform admin center to correctly identify the anchor application as the Base SKU and apply the discounted Attach SKU for the secondary application.
-
Export License Data via Data Entities for Verification
Navigate to System administration > Workspaces > Data management and create an export project for the
SecurityUserRoleLicenseEntityandUserLicenseCountEntity. Export the data to CSV to verify that the remediation successfully reduced the user license classifications from full enterprise to Activity or Team Member tiers. Validate that service accounts and non-interactive integration users are not linked to expensive interactive enterprise SKUs.
Worked example
Apex Global Logistics, an international freight operator with 450 system users, upgraded their environment to version 10.0.39. Following an internal audit, the IT compliance team discovered that 65 dispatchers assigned to the custom role AGL_WarehouseDispatcher were classified as requiring full Dynamics 365 Supply Chain Management licenses instead of the budgeted Operations - Activity licenses. This discrepancy created a significant, unbudgeted annual licensing liability.
Upon structural analysis of the role, the solution architect discovered that the custom duty AGL_ShipmentTrackingDuty contained a display menu item reference to CustPackingSlipJournal. The entry point permission in the custom privilege was configured with access set to Update, which forced the runtime license miner to evaluate the menu item's MaintainUserLicense metadata property (set to Enterprise). The dispatchers only required viewing shipping document records, never posting or editing journals.
The architect executed the following X++ diagnostic class to identify every privilege driving enterprise-tier licensing within the dispatch role:
internal final class AGL_LicenseAuditService
{
public static void main(Args _args)
{
SecurityRole securityRole;
SecurityRolePrivilegeExplodedGraph explodedGraph;
SecurityPrivilege securityPrivilege;
select firstOnly RecId from securityRole
where securityRole.AotName == 'AGL_WarehouseDispatcher';
if (!securityRole.RecId)
{
Info("Security role AGL_WarehouseDispatcher not found.");
return;
}
while select securityPrivilege
join explodedGraph
where explodedGraph.SecurityPrivilege == securityPrivilege.RecId
&& explodedGraph.SecurityRole == securityRole.RecId
&& (securityPrivilege.UserLicenseType == UserLicenseType::Enterprise
|| securityPrivilege.UserLicenseType == UserLicenseType::Operations)
{
Info(strFmt("Elevated Privilege: %1 | License Type: %2",
securityPrivilege.AotName,
securityPrivilege.UserLicenseType));
}
}
}The output isolated AGL_ShipmentTrackingDuty and its underlying privilege AGL_PackingSlipJournalViewPrivilege. The privilege had its entry point access level lowered from Correct to Read, mapping the runtime requirement to ViewUserLicense (which was set to Activity). After saving the configuration and running SysUserLicenseMiner, all 65 dispatchers immediately downgraded to Operations - Activity licensing, completely eliminating the audit discrepancy without modifying operational workflows.
Automation and AI opportunities
Compliance management should not rely on periodic manual reviews. Architects can expose licensing data using the out-of-the-box data entity SecurityUserRoleLicenseEntity through OData endpoints (e.g., https://<environment>.operations.dynamics.com/data/SecurityUserRoleLicenses). A scheduled Power Automate cloud flow can query this endpoint on the first day of each month, compare the returned user counts against license quantities retrieved from the Microsoft Graph API (/v1.0/subscribedSkus), and generate an alert if consumed licenses exceed allocated capacity.
Furthermore, teams utilizing Microsoft Copilot Studio can deploy an internal administrative Copilot connected to Dataverse virtual tables. This allows security administrators to submit natural-language prompts such as: "List all users assigned to the Logistics Coordinator role whose calculated SKU is Enterprise but who have not logged in for 45 days." Copilot can synthesize inactive user records and automatically draft an approval workflow in Microsoft Teams to de-provision or downgrade licenses.
Common pitfalls and troubleshooting
- Symptom: A user with read-only access to a specific inquiry form triggers a full Finance Enterprise license requirement.
Cause: The entry point menu item in the AOT has itsViewUserLicenseproperty explicitly set toEnterpriseinstead ofActivityorNone.
Fix: Create an extension of the menu item (or customize the security privilege in the Security configuration form) and adjust the user license metadata. Re-run the license miner batch job. - Symptom: Role modifications do not reflect in the Power Platform admin center or User license counts inquiries.
Cause: TheSysUserLicenseMinerbatch job is in a suspended or failed state, or has not executed since the security changes were committed.
Fix: Navigate to System administration > Inquiries > Batch jobs, locate the batch description Process user license counts, verify its recurring schedule, and execute it manually to force an immediate calculation. - Symptom: Users accessing both Finance and Supply Chain Management are billed for two independent Base licenses instead of Base + Attach.
Cause: User identities across Microsoft 365 and D365 F&O are not mapped to identical Entra Object IDs, or hybrid custom security roles combine both modules without clear tenant-level SKU entitlement assignment.
Fix: In Microsoft 365 Admin Center, ensure the user is assigned the primary SKU (e.g., Dynamics 365 Finance) and the complementary Add-on SKU (e.g., Dynamics 365 Supply Chain Management Attach). Re-import users under System administration > Users > Users to synchronize the Entra identity. - Symptom: Integration service accounts consume expensive interactive enterprise licenses.
Cause: External integration endpoints and automated API callers are authenticated as interactive Named Users assigned standard System Administrator or business roles.
Fix: Transition integration authentication to Microsoft Entra registered applications under System administration > Setup > Microsoft Entra ID applications. Assign non-interactive service roles with focused privileges, which do not consume interactive named-user licenses. - Symptom: External vendor users accessing Vendor Collaboration trigger full enterprise licenses.
Cause: Custom roles designed for vendor contacts contain privileges referencing standard procurement menu items rather than external vendor-specific entry points.
Fix: Audit custom vendor roles against the standardVendor (external)security role. Ensure all assigned privileges use entry points specifically designed for external access whereViewUserLicenseandMaintainUserLicenseare set toNoneorActivity.
Best-practice checklist
- ✅ Audit all custom security roles in development environments using the Security configuration licensing preview before deploying to production.
- ✅ Schedule the
Process user license counts(SysUserLicenseMiner) batch job to run daily during off-peak hours. - ✅ Segregate duty responsibilities between view-only operations and transaction-posting actions to avoid unintentional license inflation.
- ✅ Ensure integration processes authenticate exclusively via Entra ID Applications rather than interactive named user accounts.
- ✅ Maintain separate security roles for Finance and Supply Chain capabilities to maximize the benefit of discounted Base + Attach licensing tiers.
- ✅ Configure automated drift notifications via Power Automate to flag any role change that elevates a user's license tier.
- ✅ Regularly reconcile active users against Entra ID disabled accounts to revoke role assignments from departed personnel.
FAQ
How does D365 F&O determine whether a user requires an Activity or Enterprise license?
The requirement is dictated by the highest license tier among all entry points accessible to the user across all assigned security roles. If a user has fifty privileges requiring Activity licenses and a single privilege granting access to an entry point with MaintainUserLicense = Enterprise, the user's license type resolves to Enterprise.
Can we override the license type assigned to a standard Microsoft out-of-the-box privilege?
Standard privilege metadata cannot be directly edited in Visual Studio extensions if the object is locked by Microsoft. However, you can duplicate the privilege into your custom model, modify the entry point permissions or access levels to reflect the required lower tier, and replace the standard privilege within your custom duties and roles.
Do inactive or disabled users consume licenses according to the license mining report?
Users who are disabled in System administration > Users > Users (where the Enabled checkbox is unchecked) are excluded from the calculated totals during the SysUserLicenseMiner run. However, if an account remains enabled in F&O while being disabled in Entra ID, it will continue to compute licensing requirements inside F&O inquiries.
Key takeaways
- 🎯 Licensing requirements in D365 F&O are strictly governed by metadata properties on menu items, rolled up through privileges and duties.
- 🎯 Custom security extensions are the primary source of unintended enterprise license inflation across operational teams.
- 🎯 Splitting composite privileges into distinct Read and Maintain variants allows users to perform daily tasks at Activity or Team Member tiers.
- 🎯 Automating OData exports to Power Automate and Power BI provides continuous visibility into licensing compliance, preventing unexpected true-up costs during Microsoft audits.
Further reading
For more details on licensing governance, refer to the official announcement and documentation on the New License Management in Dynamics 365 Finance & Operations platform updates.
Note: written with AI assistance and reviewed by Gaurav Jadaun. Always validate in a sandbox environment before applying to production.
Comments
Post a Comment