Dynamics Community Forum Thread Details

Best approach to detect multiple user accounts signing in from the same physical device

Hi Everyone,

Working on environment: D365 Finance & Operations (cloud).

Goal:
I need to detect when more than one Dynamics user account is being used
from the same physical device, and ideally count how many distinct users
are active on that device. The business reason is this is not permissible to login with more than one account in the same device.

Constraint:
All client machines sit behind a single shared public IP (corporate NAT),
so IP address alone cannot distinguish one device from another. User-agent
strings are also identical across users on the same OS/browser build, so
"IP + user agent" doesn't uniquely identify a device.

What I've considered:
- Custom X++ to read the client IP / user agent server-side. My
understanding is that X++ runs on the AOS and can't access the browser
client's IP or request headers in F&O cloud — is that correct?
- Microsoft Entra ID sign-in logs expose a Device ID (DeviceDetail.DeviceId)
that distinguishes machines even behind one shared IP. I'm considering
querying sign-in logs via Microsoft Graph, filtering by the F&O app ID,
and grouping by deviceId to count distinct users per device.

Questions:
1. Is the Entra sign-in-logs + Device ID approach the recommended path for
this, or is there a supported in-product (X++) mechanism I'm missing?
2. How reliably is Device ID populated for F&O browser sign-ins?
3. Has anyone built device-level concurrent-account detection for F&O, and
what did you use to surface it?

**! important**

Or if I could find out when a user logs in to store the device the user logged into in a custom log table or anything that tells me that this user account is opened on more than one device.

Thanks in advance.

Categories:

Dynamics 365 Finance

🔑 Key Points

X++ limitations: In F&O cloud, X++ executes on the AOS tier and does not expose raw HTTP request headers (client IP, user-agent). So you cannot reliably capture device identity directly in X++ code.

Entra ID sign-in logs: These logs are the authoritative source for device-level information. The DeviceDetail.DeviceId field is populated when the device is registered or known to Entra ID. This is the most reliable way to distinguish machines behind a shared IP.

Graph API integration: You can query sign-in logs via Microsoft Graph, filter by the F&O application ID, and group by deviceId. This allows you to count distinct users per device.

Reliability of DeviceId: For browser-based F&O sign-ins, DeviceId is populated if the device is Azure AD-joined, hybrid-joined, or compliant via Intune. If the device is unmanaged (personal browser session), DeviceId may be blank. In such cases, you cannot enforce device-level uniqueness.

Custom logging approach: You could build a custom log table in F&O that records user sign-ins, but without DeviceId from Entra, you cannot distinguish physical devices. The only supported way is to consume Entra logs externally and then surface the results back into F&O (e.g., via Dataverse or Power BI dashboards).

✅ Recommended Solution Path

Use Entra ID sign-in logs

Query via Microsoft Graph API.
Filter by F&O app ID (00000015-0000-0000-c000-000000000000).
Group by deviceId and count distinct userPrincipalName.

Build detection logic

If more than one user is active on the same deviceId, flag it.
Store results in a monitoring table or send alerts via Power Automate.

Surface in F&O

Optionally, push the detection results into Dataverse or a custom table in F&O for reporting.
Use Power BI or custom workspace to visualize concurrent account usage per device.

⚠️ Important Notes

DeviceId is not guaranteed for unmanaged browsers. If your compliance requirement is strict, you may need to enforce Conditional Access policies in Entra ID (e.g., only allow sign-ins from compliant devices).

There is no in-product X++ mechanism to capture device identity for browser sessions. The Entra logs are the supported path.

For audit purposes, you can combine sign-in logs with session telemetry from Application Insights, but device uniqueness still depends on Entra.

📌 Suggested Next Step

Implement a scheduled Graph API query that checks F&O sign-ins every 15 minutes, groups by deviceId, and raises an alert if multiple distinct users are detected. This gives you a reliable compliance control without modifying F&O code.

Quick Links

Leaderboard > Finance | Project Operations, Human Resources, AX, GP, SL