User Licensing in Dynamics 365 for Finance & Operations
Alex Meyer
User licensing in Dynamics 365 for Finance & Operations is a uniquely complex topic that can be daunting and confusing to most people when they first encounter it. The idea of this blog post is to hopefully clarify how user licensing works and what tools and resources are available to help in your licensing journey!
Why is Licensing so Complex?
Licensing is complex within D365FO because it is tied not to what actions a user performs in the system but to what objects that user is assigned in the system. This is somewhat unique in the ERP world as most systems base licensing on what actions a user actually performs (ex: a user with a business license can perform 100 journal entries whereas a professional license lets you perform 1000).
This can lead to scenarios where a user is over-provisioned from a licensing standpoint as a user may be assigned more access than they need to perform their day-to-day operations in the system which causes their licensing requirements to be overinflated.
What User Licenses Exist Within D365FO?
There are 3 different levels of licenses within D365FO, structured in a hierarchical fashion:
- Operations
- Activity
- Team Members
In October 2019, Microsoft made a change to split licensing at the Operations level into the different modules within D365FO. The new licensing SKUs hierarchy looks like this:
- Finance, Supply Chain Management, Retail, Project Operations
- Activity
- Team Members
How is it Determined?
Microsoft uses a combination of two different methodologies when determining user licensing. The first is ‘entry point-based licensing’, which looks at the access a user has to entry points (ex: menu items) to determine the license requirements for that user. Each entry point has two different parameters associated with it:
- MaintainUserLicense
- ViewUserLicense
Each of these parameters has a license associated with it. If a user has Read access to the entry point, the license type in the license in the ‘ViewUserLicense’ parameter is required. If the user has Update, Create, or Delete permission to the entry point then the license in the ‘MaintainUserLicense’ parameter is required.
In the example below, a user with Read access to this entry point would need a ‘Team Members’ license (listed as Universal in the AOT). But a user with Update, Create, or Delete access would need an Operations level license (listed as Enterprise in the AOT).
The second licensing methodology used is based on the privileges assigned to a user. This ‘privilege based licensing’ is how Microsoft splits the ‘Operations’ license from the ‘entry point based licensing’ into the different license SKUs.
The privilege to license associations are stored in a database table named ‘LicensingServicePlansPrivilege’:
How Do These Different Licensing Methodologies Work Together?
To determine user licensing requirements, we have to combine both the ‘entry point-based licensing’ and the ‘privilege-based licensing’ ideas from above. This is done by first applying ‘entry point based licensing’ to determine if a user requires an Operations, Activity, or Team Members license.
If a user only requires an Activity or Team Members license, that is the license required by the user.
If the user requires an Operations license based on the ‘entry point based licensing’ methodology, then we apply the ‘privilege based licensing’ methodology and look at the privileges the user is assigned to see if there is an entry in the LicensingServicePlansPrivilege to determine the license requirements.
I’ve built a Visio diagram to show the decision tree of user licensing:
What if a User Needs Multiple Licenses?
Now that we’ve determined how licenses are determined, what happens if a user needs multiple license SKUs based on their privilege based licensing? Microsoft offers the idea of a ‘base’ and an ‘attach’ license, where a user would assign the first license as a ‘base’ and then would be able to ‘attach’ additional licenses to this.
In the Microsoft Dynamics 365 licensing guide, there is a table that shows the valid base/attach combinations:
What reports exist natively in D365FO to help?
There are a few reports available natively within D365FO to help with determining the licensing requirements of its users.
The first is the User License Counts report which is available at System Administration -> Inquiries -> License -> User License Counts. This report shows each user in the system and the ‘entry point-based license’ requirements for each user based on their role assignments.
The second report is the ‘User License Estimator’ report, which shows the ‘privilege based license’ requirements for the user. This report is available at System Administration -> Inquiries -> License Reports -> User License Estimator.
How Can We Effectively Reduce Licensing Costs?
The best way to reduce your license requirements is to apply ‘Least Privilege Security’, which is the process of ensuring that users are not provisioned with too much access within D365FO as well as performing periodic license reviews.
What Does the Future Hold for User License?
With the move to consolidate Dynamics 365 offerings under one solution (as we looked at in our previous blog post), how could this potentially impact licensing? That remains to be seen as we are very early in the process of combining platforms, but I do think that it will impact the licensing methodology used.
Are there resources to help?
Yes! Then list all of the blogs, whitepapers, YouTube videos I’ve created over the years about licensing.
