How can I limit Concurrent Sessions D365FO

(1) Share

Report

Posted on by MS-29011540-0

341

Hello all,
Hope you are all doing great!
Is there a way to limit concurrent sessions in d365fo(on prem) whether it's out-of-the-box or customized way?

Categories:

Dynamics 365 Finance

I have the same question (0)

All responses (9)

Answers (2)

Verified answer

André Arnaud de Cal... 303,085 Super User 2026 Season 1 on at

Like (1)

Report
Copy link

Link copied!

Hi,

There is no option to limit the number of sessions. Can you tell us why you are asking this question?

Note that when making an attempt to limit the number of sessions, you will introduce issue like users being locked out or integrations not able to connect. I would recommend against a limitation. You should ensure the hardware infrastructure is scaled for the number of users and sessions.

Was this reply helpful? Yes No
MS-29011540-0 341 on at

Like (0)

Report
Copy link

Link copied!

@André Arnaud de Calavon
Thanks for your reply.
Our customer asks for that as it represents a security issue for him [OWASP Top Ten - A07:2021-Identification and Authentication Failures]
So this represents a security issue for him that requires a mitigation to proceed forward, they should have realized the consequences as they request the ability to enable/disable this limitation feature.

Was this reply helpful? Yes No
Martin Dráb 238,736 Most Valuable Professional on at

Like (0)

Report
Copy link

Link copied!

Hmm, so if I open a second browser tab to check data in another form, or I execute an asynchronous process, I've just made a serious security problem (because I have two sessions in F&O)? I don't see how. But I see how working in the ERP system would become much more difficult if disallow it, and some things would stop working completely.

I suggest you talk to the customer, find more information about what actual security problem they mean, and you explain them all the unintentional consequences of such a step.

I don't know, maybe they have several uses that connect to the same user account or so, and they don't actually had F&O sessions in mind.

Was this reply helpful? Yes No
André Arnaud de Cal... 303,085 Super User 2026 Season 1 on at

Like (0)

Report
Copy link

Link copied!

Hi,

The number of active sessions is not making any difference in security, As mentioned by Martin, for valid reasons, you can open multiple tab pages.
I think the requirement is more to limit the number of login attempts, not sessions. After several authentication failures, e.g. block the user account. This would be more a setting for Azure Active Directory, Internet Information Services, or Entra ID. In fact this is related to Authentication which can't be customized in Dynamics 365 F&O.

PS. I corrected you tag. You used Dynamics AX which is referring to older versions of the product. I changed it to Dynamics 365 Finance.

Was this reply helpful? Yes No
MS-29011540-0 341 on at

Like (1)

Report
Copy link

Link copied!

@Martin Dráb @André Arnaud de Calavon
They don't want to limit the number of sessions instead they want to limit the number of concurrent sessions.
I mean the user can open as many browser tabs as he wants. but he can't open a new concurrent session from another browser or another device.

Was this reply helpful? Yes No
Martin Dráb 238,736 Most Valuable Professional on at

Like (0)

Report
Copy link

Link copied!

Hmm, could you please elaborate what's your definition of "concurrent"? In my opinion, all sessions running at the same time runs concurrently, and whether I open a new tab in a same browser or a different browser doesn't matter. Also, don't forget about features like Open in Excel - their design would block them, making the (expensive) system much less useful.

Also, can you confirm that they mean F&O sessions? A session may mean quite a few different things, depending on context.

Was this reply helpful? Yes No
André Arnaud de Cal... 303,085 Super User 2026 Season 1 on at

Like (1)

Report
Copy link

Link copied!

Like Martin mentioned, trying to stop different types of login, e.g. Open in Excel, or Power Automate actions can give issues if you proceed with this idea.

There are features in Azure to recognize if a user is logging in from different locations. E.g. if an user usually is using computers in Copenhagen, Denmark and suddenly there is a login from New York, then this is suspicious, unless the user is on a business trip.

Was this reply helpful? Yes No
Verified answer

Navneeth Nagrajan 2,495 Super User 2026 Season 1 on at

Like (1)

Report
Copy link

Link copied!

Hi MS29011540-0,

Assumptions:
1. You are saying if an user opens a D365 FO and then tries to open a session of D365 FO through another login in another browser window.

Considering that D365 FO licensing is based on named users (one license per unique user, regardless of sessions), not concurrent sessions. D365 FO uses Microsoft Entra ID for authentication which does not natively support per-user concurrency limits. As Martin and Andre rightly mentioned earlier, there are no out of the box setups to strictly enforce single concurrent sessions per user across different browsers or devices while allowing unlimited tabs within the same browser session.

In addition to this, if you are looking for session timeout options then that's available in D365 FO under System Administration -> Setup -> Session Management -> Set inactivity timeout in minutes (Represents the amount of time the user can be inactive before their session ends).

Hope this helps. Happy to answer questions, if any.

1 people found this reply helpful.

Was this reply helpful? Yes No
MS-29011540-0 341 on at

Like (0)

Report
Copy link

Link copied!

@Martin Dráb @André Arnaud de Calavon @Navneeth Nagrajan
Thank you for your answers <3

Was this reply helpful? Yes No