Dynamics Community Forum Thread Details

Clarification on Security Structure – Why Separate View and Maintain Privileges in the Same Duty?

Hello everyone,

I’m looking for clarification regarding security design best practices in Dynamics 365 Finance & Operations.

Currently, I have the following security structure:

Role  
 └── Duty  
      ├── View Privilege (Read access to menu item)  
      └── Maintain Privilege (Update access to same menu item)

Both privileges are inside the same Duty, and that Duty is assigned to a Role.

When I assign this Role to a user, the user effectively receives Maintain (Update) access, since Update already includes Read access.

My question is:

- If Maintain already includes Read, what is the purpose of keeping the View privilege inside the same Duty?

- Is this considered good practice, or should View and Maintain be separated into different Duties to support role flexibility?

From my understanding, separating them would allow:

One role to have View-only access
Another role to have Maintain access
Better alignment with the least privilege principle

However, if both privileges are always assigned together within the same Duty, the View privilege seems redundant.

I would appreciate guidance on:

Microsoft best practice for structuring View vs Maintain privileges
Whether Duties should represent business responsibilities rather than access levels
How this is typically handled in enterprise implementations

Thank you in advance for your insights.

Categories:

Dynamics 365 general

Quick Links

Leaderboard > Microsoft Dynamics 365 | Integration, Dataverse, and general topics