Making Microsoft licensing simpler and more affordable.
Manage device-based user access in Dynamics 365 Finance & Operations
Microsoft's strengthened license enforcement has changed how users access Dynamics 365 Finance & Operations. Users without an assigned user license can no longer access Finance & Operations applications, even if they previously relied on shared devices. While this change is straightforward for most employees, one area has been particularly unclear for many organizations. How to manage users who access Finance & Operations through licensed devices?
To address this, Microsoft has introduced temporary device-based security roles. Understanding, when to use these roles, and just as importantly, when not to use them, is essential for maintaining both user access and licensing compliance.
Why has Microsoft introduced device-based security roles?
Most Dynamics 365 users require a standard user license to perform their daily work. However, some frontline workers only access Finance & Operations from shared devices located on the production floor, in the warehouse, or in retail stores. These users typically don't require the same level of access as office employees, and organizations have traditionally licensed the device rather than each individual user.
As Microsoft strengthens license validation, these users would otherwise lose access. To avoid disrupting business operations, Microsoft has introduced temporary device-based security roles, until full device license validation becomes available.
Which users are affected?
Microsoft has identified three job functions, that may qualify for device-based access:
Production floor workers
Warehouse workers
Retail store managers
These users may occasionally need to access Finance & Operations functionality beyond the specialized applications they normally use.
For example:
A production floor worker may need functionality beyond the Production Floor Execution interface.
A warehouse worker may require access beyond the Warehouse Management mobile app.
A retail store manager may need functionality beyond the Point of Sale application.
Only these scenarios are intended to use the temporary device-based security roles.
When should you not use these roles?
This is, where many organizations become uncertain. Device-based security roles are not intended as an alternative to normal user licensing. If a user already has a Dynamics 365 user license, there is no reason to assign a device-based security role. Likewise, if a worker only performs tasks within the standard Production Floor Execution interface, Warehouse Management mobile app, or Point of Sale application, Microsoft does not expect the device-based security role to be assigned.
The temporary roles should only be used for users, who:
Don't already have a user license.
Perform one of the supported job functions.
Require additional Finance & Operations functionality beyond the dedicated frontline applications.
These roles are only temporary
Microsoft has made it clear that these security roles are a transitional solution. At a later stage, Microsoft will introduce device license validation directly within Finance & Operations. Once that happens, Microsoft will verify, that access originates from an appropriately licensed device. The temporary security roles will then be deprecated and eventually removed. Organizations should therefore avoid building long-term security models around these roles.
Microsoft is monitoring usage
Microsoft has also confirmed that organizations using device-based security roles will be monitored to ensure the licensing requirements are being followed. If Microsoft identifies users who appear to be accessing functionality beyond the permitted scope, organizations may be contacted to provide additional information or acquire the appropriate user licenses. For this reason, device-based security roles should only be assigned where they clearly meet Microsoft's licensing requirements.
What should administrators do now?
Organizations should review users, who currently rely on shared devices and determine, whether they genuinely qualify for device-based access.
This review should include:
Identifying eligible production floor workers, warehouse workers, and retail store managers.
Confirming that these users don't already have a Dynamics 365 user license.
Verifying that they require functionality beyond the dedicated frontline applications.
Assigning the appropriate temporary device-based security role only where necessary.
Taking these steps now will help avoid unnecessary access issues, while preparing for Microsoft's future device license validation.
Final thoughts
Microsoft's updated license enforcement has removed much of the flexibility organizations previously had around unlicensed users accessing Finance & Operations. While the introduction of temporary device-based security roles provides a solution for specific frontline workers, these roles are intended for a very limited set of scenarios. Organizations should treat them as a temporary bridge to Microsoft's future device validation model rather than a replacement for standard user licensing. By carefully reviewing which users genuinely qualify, administrators can maintain compliance while ensuring business-critical users continue to have the access they need.
Share the post:
Get In touch
We can help you
Contact us for a "no cure, no pay" session. Keep Finance, Supply Chain, Commerce, Project Ops, and HR online when enforcement begins.
Related articles
Ready for the new Microsoft Dynamics 365 licensing rules?
Microsoft’s latest change to Dynamics 365 Finance & Operations licensing enforcement looks like a reprieve at first glance. But it is not a simple price change.
The one dashboard CFO's need to control Microsoft Dynamics 365 F&O license spend
If you have ever tried to answer, “What are we paying per Dynamics 365 Finance & Operations user?” you know the pain.
Procurement’s fastest route to Dynamics 365 savings
Procurement leaders are under pressure to find savings even as Microsoft licensing grows more complex. The good news: a handful of procurement-owned actions can unlock double-digit savings without touching code.