Dynamics 365 Finance and Operations cross-app: Role-based access controls for ERP agents

🚨 The Signal: Dynamics 365 now allows granular, role-based access controls for ERP agents, enabling administrators to define narrower permissions for agent-initiated requests than for direct user access. This reduces the attack surface when agents interact with sensitive ERP data.

The Impact

Security teams and Dynamics 365 administrators are affected, reducing the risk of over-privileged AI agents accessing sensitive ERP data.

• Security teams: Reduced risk of data exfiltration via over-privileged agents.
• Dynamics 365 administrators: New controls to enforce least privilege for agents.
• Compliance officers: Improved auditability of agent access to sensitive ERP data.

The Action

1. Review existing Dynamics 365 ERP agent integrations and their current permissions.
2. Identify agent-specific roles, duties, and privileges required for each agent function.
3. Create new, or modify existing, security roles in Dynamics 365 Finance and Operations.
4. Assign these agent-specific roles with the principle of least privilege.
5. Test agent functionality to ensure operations are not disrupted by reduced permissions.

Domain: Agentic-AI · Impact: high · Workload: Other · Essential Eight: Restrict Administrative Privileges · ISM: ISM-0445, ISM-1175, ISM-1380, ISM-1507, ISM-1508, ISM-1509, ISM-1647, ISM-1648, ISM-1650, ISM-1686, ISM-1688, ISM-1689, ISM-1883, ISM-1897, ISM-1898