Microsoft Dynamics 365 Finance and Operations (D365 F&O) prices its license based on the security objects assigned to a user. Each security object is associated with a user view or user maintenance license, indicating the license type required for either read access to the menu item or maintenance (anything above read permissions). A user will be associated with the highest license their roles contain. In other words, if you have one object driving the highest license, it will trigger that license to be charged. Licensing can add up quickly, however, there are a couple ways this model can be leveraged to help reduce costs.
Understanding Microsoft license structure
Tracking licensing
Tools such as Fastpath Assure and D365 standard reporting can be used to build PowerBi dashboards to monitor licensing costs and highlight potential reductions. Within D365, the standard user license count and user license estimator reports can be leveraged to see a high-level list and count of users who required a certain base and/or attach license. This is great for daily monitoring, however, to see a granular view of what objects/permissions are flagging a particular license, the “view permissions” form with security configuration is a helpful resource. We also recommend leveraging external tools such as Fastpath Assure, which can connect to your D365 environment for detailed reporting.
Steps to reduce licensing
Custom role build
When assigning standard out-of-box security roles, there may be additional viewing or maintenance access provisioned to the user that is not necessarily needed but is driving a higher licensing cost. When customizing security configuration, we can remove those objects flagging the operations or activity license, eliminating the higher license cost associated with the role and user assignment. Designing custom security roles is highly valuable exercise for the business and IT – it encourages controllers, business process owners, and IT to collaborate and increase visibility into current processes, areas for improvement and segregations of duties risks/controls. Additionally, it ensures roles are developed that target the functionality needed, resulting in reduced licensing costs. To streamline role provisioning, we recommend designing a full security model for each of the teams or job areas that utilize D365. Please see our Microsoft Dynamics Security – AX 2012 vs. D365 Finance article for more information.
For those who are ahead of the game and have already developed a custom security model, we recommend reviewing the Fastpath or D365 reporting to determine objects that are appropriate to remove from roles in order to reduce licensing. We recommend starting remediation by locating roles with few operations-licensed objects assigned to many users. This allows for the largest cost reduction impact. Once the objects are determined, we recommend duplicating the privilege(s) associated with the objects for removal and removing them from the newly created privilege. We then recommend associating it with a custom duty assigned to a targeted role. The previous privilege should be removed from the role’s duty to see licensing changes. We always recommend unit testing and user acceptance testing before migrating changes into production.
Licensing true-up
We recommend conducting a bi-annual licensing true-up that aligns with the Microsoft agreement date. The first step to this is to implement change management processes for deprovisioning inactive users. It is best practice to perform this process on a monthly basis to reduce risk and licensing impacts. Subsequently, there are two ways to look at how to reduce licensing on the user level – either by removing roles from users driving a higher license or removing objects from roles driving a higher license. While the latter may require additional efforts, it will create a more sustainable security model for future licensing true-ups.
Factors to consider
- Expect to see higher licensing costs for users in Accounting and IT roles.
- Custom objects or ISVs should not be associated with a license.
- Attached licenses can increase monthly costs by $30 per user.
- When assigning multiple security roles to one user, the highest user license type within their roles will be assigned to the user. Full user licensing (operations) is the highest type.
Leveraging Microsoft and Fastpath reporting tools can help businesses stay on top of licensing costs before their annual true-up. While it is important to continue monitoring licensing impacts as the business grows, the best way to stay ahead of licensing and risks is through a streamlined, custom security role model.
Read the results of our new Global IT Executive Survey: The Innovation vs. Technical Debt Tug-of-War.
To learn more about our Microsoft consulting solutions, contact us.
