Hello!
Need your assistance again, I am not sure if I can explain this clearly but let me try.
We are using Azure Active Directory to control the security of D365 Finance and Operation. Groups will be created to AAD, then AD account will be under that group for us to access the system.
This AD account will now be imported to D365 Finance and Operation for us to be able to access the D365 FinOps.
The thing is, roles are not assigned on the users. What we do is that, the groups from AAD are imported in D365 FinOps, then the role be assigned to this Group.
for example:
AD Group: Finance
AD Account: Mr. ABC (Mr ABC is a member of AD Group Finance in Azure Active Directory)
Going back in D365 FinOps, there is a role named HQFinance, and this role is assign to Group Finance in D365. See below as example.
Role is created in D365 FinOps, then will be assigned to Groups in D365 as well.
This Group is imported from AAD, there are no assigned role on the USERS in D365. all roles are assigned into the groups.
Then from D365 group to AAD group, it will be linked to the users via AAD group membership.
This works at most users, but here is my challenge (problem).
This HQFinance role, is assigned to AD Group Finance, the expectation is that, Mr. ABC will be able to access a certain functionality in D365, let's say to create Manual Payment Journal. But this functionality is disabled for M. ABC despite the fact that Priv and Duty is assigned to HQFinance role.
What I have tried is to assigned the HQFinance role direct to Mr. ABC user, and then the functionality is accessible. That is why I know that the right PRIV and DUTY is assigned to HQFinance role, since I am able to access it if the role is directly assigned to the USER itself. But if the I follow the supposed to be how the business wants it, Mr. ABC cannot access the functionality.
Need your insights, does anyone have same issue?
Take note:
- the functionality is not standard, it is under an ISV module
- MR. ABC is also member of other AD groups which is also finance related but might be for different purpose and access (does this affect the role access?)
- we are not allowed to put the roles directly to the USER account in D365
Please help.
