Finance | Project Operations, Human Resources, ...

D365 license for guest user

(2) Share

Report

Posted on by AC-05090437-0 Microsoft Employee

Hi,

I have an app deployed on Azure and need to access to D365 Dataverse (which means users need D365 license), this app is external facing.

Now, these external users are currently created as internal users in my organization's EntraID to allocate Dynamics licenses, but this causes a security concern for me.

Question:

1. Can these external users be created as guest users in EntraID and still allocate Dynamics licenses to them with MFA enforced?

2. If these external users use other Single Sign On (SSO) method or Microsoft Entra External ID to authenticate, can I assign Dynamics licenses to them?

All responses (3)

Answers (0)

Sort by

SajeedMullaji 860 on at

Like (1)

Report
Copy link

Link copied!

This touches an important security and governance boundary in D365 environments.
On Question 1 — Yes, guest users in Entra ID can be assigned D365 licenses and MFA can be enforced through Conditional Access policies scoped to guest accounts. However — and this is the critical governance point — guest users provisioned via Entra ID security groups rather than direct role assignment in D365 bypass the native Segregation of Duties engine entirely. Microsoft confirmed this limitation. Any SoD rules configured in D365 will not fire for these users.
On Question 2 — External ID and SSO authentication methods are supported for D365 access when properly configured in Entra ID. License assignment follows the same model — the license must be assigned in M365 Admin Center regardless of authentication method used.
The security concern you flagged is valid and worth taking seriously. External users with D365 access created as internal users in Entra ID creates identity governance complexity that should be reviewed against your access control framework.
Suggested answer

vishalsahijwani 431 on at

Like (0)

Report
Copy link

Link copied!

Hi @AC-05090437-0 ,

Yes external users can be converted into guest accounts on Entra ID and you can assign Dataverse and Dynamics licenses as well along with MFA authentication

It will depend if you are using Single Sign On and as long as the users exist in your tenant as guest user licensing will work but if you will use Entra External ID as a separate Customer Identity and Access Management tenant then licenses cannot be assigned. So as long as you are keeping users as guest users in your existing tenant you should be fine.
Suggested answer

Subra 2,407 Super User 2026 Season 2 on at

Like (0)

Report
Copy link

Link copied!

Hi @AC-05090437-0

Yes, you can add the external users into your tenant as a guest account and assign the license as well based on your need with MFA authitication.

Thanks,
Subra

If this helped, please mark it as "Verified" for others facing the same issue