@Huma Selot CU200816...
to satisfy SOX ITGC requirements for privileged access the goal is zero permanent System Administrator assignments in D365 F&O. Here is the exact end-to-end configuration:
Step 1 — Create a PIM-managed security group in Entra ID
Entra admin center > Groups > New group — create a security group (e.g. D365FO-SystemAdmin-PIM) — ensure 'Microsoft Entra roles can be assigned to this group' is set to Yes — open the group > Activity > Privileged Identity Management > Enable PIM for this group. Under Assignments configure your administrators as Eligible — not permanent members — requiring business justification, MFA on activation, and optional manager approval.
Step 2 — Map the security group to D365 F&O
In D365 F&O go to System administration > Feature management — verify Microsoft Entra ID security groups feature is enabled — then System administration > Setup > Microsoft Entra ID security groups — import your PIM group and map it to the System Administrator security role. When a user activates their PIM eligibility the group membership triggers and grants temporary System Admin access in D365 F&O.
Step 3 — Alternative via Power Platform Admin Center
If direct group mapping is restricted — ensure the administrator holds a Dynamics 365 Admin or Power Platform Admin role in Entra ID — PIM activation of that role temporarily provisions elevated rights inside the specific F&O environment instance via the PPAC JIT workflow.
The audit trail this creates:
External auditors check two things — the D365 F&O user list confirms zero permanent System Administrator assignments, and the Entra ID PIM Audit History provides timestamped proof of every elevation request including business justification, MFA validation, and exact auto-expiration timestamp. This is the evidence package that passes SOX ITGC logical access review for privileged access.
If it helps , mark as answered.
Share
Report
12
All responses (
Answers (
