Dynamics 365 Commerce: Omnichannel commerce - Streamline mass price updates using attribute-based pricing

🚨 The Signal: Dynamics 365 Commerce now allows mass price updates using attribute-based rules. This streamlines pricing changes but increases the attack surface for financial manipulation if not properly secured.

The Impact

Dynamics 365 administrators are affected by new configuration options, increasing the risk of unauthorized financial changes if access controls are not rigorously applied.

• Dynamics 365 administrators: New configuration options require careful permission management.
• Security teams: Increased attack surface for financial data manipulation.
• Auditors: New areas for review regarding pricing integrity and access controls.

The Action

1. Review and update role-based access controls (RBAC) for Dynamics 365 Commerce pricing managers.
2. Implement segregation of duties for creating and approving price changes.
3. Audit logs for price changes should be regularly reviewed for anomalies.
4. Ensure least privilege is applied to all users with access to pricing configuration.

Domain: Other · Impact: medium · Workload: Other · Essential Eight: Restrict Administrative Privileges · ISM: ISM-0445, ISM-1175, ISM-1380, ISM-1507, ISM-1508, ISM-1509, ISM-1647, ISM-1648, ISM-1650, ISM-1686, ISM-1688, ISM-1689, ISM-1883, ISM-1897, ISM-1898