Securing a custom D365 F&O form: privilege, duty, role

In Dynamics 365 Finance & Operations you never grant access directly to a form: you grant access to an entry point, the menu item that opens it. The chain is: the menu item is added to a privilege with an access level (read, update, create, delete…); the privilege is grouped into a duty (part of a business process); the duty is assigned to a role; the role is assigned to users.

Microsoft recommends assigning duties to roles rather than standalone privileges, to simplify maintenance and enforce segregation of duties.

1. Create the display menu item that opens your form.
2. Create the privileges; a common convention uses two: a "View" one (Read access) and a "Maintain" one (Delete or Update access as needed). In each, add the menu item under Entry Points and set the access level.
3. Create a duty (or extend a standard duty) and add the privileges to it.
4. Add the duty to a role: a custom role, or an extension of a standard role.
5. Add the menu item to the module menu (menu extension).
6. Build, deploy, then check with a non-admin user.

The same principle applies to action menu items (classes, batch jobs) and output menu items (reports). The tables and fields the form uses are covered by the permissions tied to the entry point.

• Think "business task" for privileges and "process" for duties, not "technical object".
• Separate incompatible duties (creating and approving a payment, for example): the basis of segregation of duties required by some regulations.
• To restrict visible rows (by company, warehouse…), use extensible data security policies (XDS), which complement the role model.
• After each service update, review your custom roles against the standard ones, as Microsoft recommends.
• AI agents follow the same logic: an agent connected to F&O acts with its role's rights. See Dynamics 365 ERP MCP server.

• Testing only with an administrator: everything works, except for real users.
• Assigning the privilege directly to the role with no duty.
• Forgetting the access level on the entry point (form visible but not editable).
• Changing a standard role through over-layering instead of an extension or a custom role.
• Forgetting secondary menu items opened from the form (buttons, dialogs).

Privileges, duties and roles are part of a custom form's deliverable, just like the code. Skalp AI writes the specification, generates the X++ code and unit tests, compiles with a best-practice check, then delivers a pull request to your Azure DevOps: nothing is merged without your technical architect's approval. See CISO and custom D365 F&O extensions, the bigger picture in building X++ without a consultant in 2026, and the Basic, Pro and Max plans (1 credit, ≈ €400 on Basic, €200 on Pro, consumed only when the code is generated).

See also: Microsoft AI landing zone for ERP agents.

• Microsoft Learn, "Role-based security", updated 21 Jan 2026, accessed 18 Oct 2026.
• Microsoft Learn, "Security architecture", updated 21 Jan 2026, accessed 18 Oct 2026.