The main thing to note is that you shouldn't depend solely on the transaction logs to establish that a user had never used a higher-tier operation. In Dynamics 365 Finance and Operations, licensing is mainly based on the security roles and on the duties, privileges, and securable objects that are assigned to the user.
For an audit, I would use a combination of **User Security Governance, security reports, and activity/audit data**:
1. Access **System administration > Security > Security Governance > License usage summary** and have a look at the **User License** and **Role License** views since these display the license requirements resulting from the user's assigned roles and enable you to go from Role → Duty → Privilege → Securable Object.
For every role, look at the objects that are marked **Not Entitled** regarding the lower-level licence since these are the ones which can cause a higher licence requirement; in the detailed view you can see the AOT object, the access level, and the entitlement status.
3. You should use the **Security Analysis** report to record the effective permissions that result from the user's roles, duties, and privileges. Likewise, the **Role Audit Trail** can show when a higher-privilege role was assigned or taken away.
4. The **User Activity Aging/User Log** information should be used as evidence of actual user activity; it can show when the user signed in and aid in establishing usage patterns, but it must not be considered as the main proof of license entitlement.
For an SAM audit, I would therefore build an evidence matrix such as:
**User → Assigned Roles → Duties → Privileges → Securable Objects → Required License → Actual Activity**
The key point is that the two issues—having access to a higher-tier function and in fact carrying out that function—are different. The licensing tools currently used by Microsoft are mainly designed for working out the licensing requirements based on the user's set security access rather than for proving that a specific transaction had or had not been carried out.
If the aim is to show that the users who have been assigned an Operations/Activity-type role never carry out Finance-level activities, it is first necessary to prove that their roles do not include higher-license securable objects, after which transaction/audit/activity data should be used as further supporting evidence.
The situation offers a far more robust audit trail when compared to attempting to establish licensing compliance just from the transaction logs.
Share
Report
10
All responses (
Answers (
