Migrating user roles from SAP to D365 isn’t a direct “copy-paste” exercise, and that’s where most people get stuck.
SAP roles and D365 security models are fundamentally different. SAP is more role-transaction driven, while D365 is based on duties, privileges, and role-based access tied to business processes. So trying to replicate SAP roles exactly in D365 usually creates unnecessary complexity.
A better approach is to treat this as a role redesign, not just migration.
In most real implementations, what works is:
-
Analyze existing SAP roles and identify actual business responsibilities behind them
-
Map those responsibilities to standard D365 security roles wherever possible
-
Only create custom roles if there’s a genuine gap
-
Use tools like Security configuration / RSAT / data management framework to bulk assign roles instead of manual setup
Also, avoid creating hundreds of highly granular roles like in SAP. D365 works better with fewer, well-structured roles aligned to job functions.
One more important point. This is a good opportunity to clean up access. Many SAP environments carry legacy roles that no one questions. If you migrate them blindly, you carry the same problems into D365.
So instead of asking “how to migrate roles”, the better question is “what access should users actually have in the new system”.
That shift usually saves a lot of effort and avoids long-term security issues.
