D365 Finance & Operations and Dynamics AX Forum

View Only

Back to discussions

Expand all | Collapse all

Limiting Users to Specific Sites or Warehouses

1. Limiting Users to Specific Sites or Warehouses

0 Like
Matthew Segee
Posted Mar 02, 2020 01:20 PM
Hello

We had an employee accidentally cancel all in process work for our entire company. This was a disaster and required an all night keying session to correct.
Is there a way to limit employees to specific warehouses for the desktop version? This is easily achievable for the mobile devices but I cannot find where to do so for desktop users.

------------------------------
Matthew Segee
Reily Foods Company
New Orleans LA
------------------------------
2. RE: Limiting Users to Specific Sites or Warehouses

0 Like
SILVER CONTRIBUTOR

Andreas Mörker
Posted Mar 03, 2020 03:45 AM
Matthew

No security pro yet but you can access the current settings of the workers role in this menu: &mi=SysSecConfiguration

When selecting his role, you have the possibility to view privileges:

When sure which permission is granting too much access, you can create a new custom role with limited user rights. The new role needs the newly created privilege next to the other needed requirements to keep on working.

I assume then, the newly created privilege will limit the user to the tables granted in security settings.

I hope the usual MS pros will confirm my assumption.

If you have a testing environment or a dev box I recommend exploring the security settings. Start of with creating a dupe to work on the dupe to not destroy something you didn't document. It's easier to create another dupe than to create a new environment due to accidental deletion of a user role :)

Hope my two cents could help a bit!

Best
Andreas

------------------------------
Andreas Mörker
Global Master Data Manager
SIGVARIS
------------------------------

Original Message
3. RE: Limiting Users to Specific Sites or Warehouses

1 Like
TOP CONTRIBUTOR

Corey Vantilborg
Posted Mar 03, 2020 08:03 AM
Matthew,

It is not easily achievable and is a development effort. What you need to look into are Extensible Data Security Policies. These policies allow query-based security, you can define a query based on a user's login and limit the data they can access.

Unfortunately, there doesn't seem to be a Microsoft document on it for D365 but if you search you can find a number of blog posts about how the framework functions.

Regards,

------------------------------
Corey Vantilborg
ERP Analyst
Tigercat International Inc.
Brantford ON
------------------------------

Original Message
4. RE: Limiting Users to Specific Sites or Warehouses

1 Like
Alex Meyer
Posted Mar 03, 2020 09:29 AM
Edited by Alex Meyer Mar 03, 2020 09:30 AM
Matthew,

Corey is exactly correct, anytime you are looking to restrict access to a particular subset of a particular object XDS is the functionality to use. I wrote about this topic here:

https://alexdmeyer.com/2019/02/20/extensible-data-security-xds-framework-in-d365fo/

Feel free to reach out with any questions.

------------------------------
Alex Meyer
Director of Dynamics AX/365 for Finance & Operations Development
Fastpath
Des Moines, IA
------------------------------

Original Message
5. RE: Limiting Users to Specific Sites or Warehouses

1 Like
MICROSOFT MVP

André Arnaud de Calavon
Posted Mar 03, 2020 10:56 AM
Hi Matthew,

I did create an example how to restrict warehouses (and sites) using XDS. You can read my blog and download the example: https://dynamicspedia.com/2018/07/extensible-data-security-examples-secure-by-warehouse/

------------------------------
kind regards,

André Arnaud de Calavon
Product manager, Microsoft MVP - Microsoft Dynamics Business Solutions
------------------------------

Original Message
6. RE: Limiting Users to Specific Sites or Warehouses

0 Like
Tony Zeigler
Posted Mar 03, 2020 02:53 PM
Unfortunately, app security defaults to let you specify a user's legal entity, but not down to the warehouse.
You would have to implement row level security, which is quite a bit more difficult to setup. (It could be it's own little mini-project, as opposed to just a simple config)

------------------------------
Tony Zeigler
Senior Consultant
Strategic Solutions NW, LLC
Beaverton OR
------------------------------

Original Message