Step-by-step playbooks you can run yourself. No engagement required to get started.
Grant/deny conflicts, mixed-tier privileges, sysadmin-plus-business-role overlaps: none of it needs usage evidence to catch. Here's why the lightest check we run is worth running after every security change during remediation, not just once at the end.
Most reviews start with a user list and a role count, about ten questions. A properly scoped intake runs to 106. Here's what falls in the gap.
Instead of two hours of manual UI exports, get just-in-time database access to a Tier 2 sandbox and run one script that pulls all 33 datasets, license, security, personalization, and audit-log evidence, unattended.
A working list of the device, integration, and background-operation roles that carry no license requirement on their own.
Telemetry is one of the strongest inputs in a license review, and also one of the easiest to misuse.
A role name rarely tells you why it's expensive. The entry points inside it do.
Most licensing reviews start with a user export and a few disabled accounts. That feels productive and rarely gives you a trustworthy number.
The exact Azure and F&SC configuration steps, what it costs against the free tier, and the two KQL scripts that turn telemetry into a license and user-activity report.
Identifying inactive users saves the most of any overlicensing strategy, but the built-in report alone misreads integration users. The two-source method and two exceptions that keep it accurate.
Contradictory Deny/Grant on the same entry point, and Correct or Invoke permissions granted without their prerequisites. Both pass an access review clean and still inflate license tiers.
A four-export, two-formula method for finding exactly which permissions drive each license on a role that requires three or more, plus a free downloadable workbook.
How D365 F&SC's role/duty/privilege security model works, the SoD conflict pairs that show up most often, and a walkthrough of running your own analysis.
Starting on each tenant's contract anniversary or renewal date after January 15, 2026, Microsoft will block unlicensed users from D365 Finance and Operations apps. Here's the timeline and how to prepare.
