Dynamics 365 Field Service: Work with Subcontractors without additional licenses

🚨 The Signal: Dynamics 365 Field Service now allows subcontractors to update work via email without a D365 license. This introduces a new email-based agent for external collaboration, potentially expanding the attack surface for impersonation and data integrity risks.

The Impact

External subcontractors and internal dispatchers are affected, with a security risk of unauthorized data modification or information disclosure via email.

• Subcontractors: Risk of email account compromise leading to unauthorized work updates.
• Internal Dispatchers: Risk of processing fraudulent updates from compromised subcontractor emails.
• Security Teams: New attack surface to monitor for email-based impersonation and data manipulation.
• Data Owners: Risk of integrity compromise for Field Service operational records.

The Action

1. Review and configure approved sender identities for the Subcontractor Agent in Dynamics 365 Field Service.
2. Implement strong email authentication (e.g., SPF, DKIM, DMARC) for all subcontractor domains.
3. Establish clear internal processes for dispatchers to verify email-based updates before applying changes.
4. Monitor audit logs for the Subcontractor Agent for unusual activity or failed submissions.
5. Educate internal staff on phishing risks targeting subcontractor email communications.

Domain: Other · Impact: high · Workload: Other