Dynamics 365 Security Role Audit: IT Manager's Hardening Guide

Your Dynamics 365 environment is only as secure as the last person who left your organisation — and odds are, their access is still active. A Dynamics 365 security role audit is no longer an annual checkbox exercise reserved for compliance season. In 2025, with Microsoft Entra ID (formerly Azure AD) deeply entwined with Power Platform entitlements and SharePoint document libraries sharing record-level data, a single over-privileged service account or a forgotten Azure AD group assignment can expose your entire CRM estate.

This guide goes three layers deeper than the surface-level security posts you have already read. We cover role sprawl mapping, a framework-aligned audit checklist, the SharePoint ACL gap that almost every Dynamics 365 deployment ignores, and a Power Automate automation playbook that enforces quarterly hygiene at scale — without burning out your IT team.

Why Most Dynamics 365 Security Audits Fail Before They Start

The typical audit approach looks something like this: export the list of security roles, eyeball who has System Administrator, flag a few obvious outliers, and call it done. That approach misses three critical attack surfaces that adversaries — and auditors — will absolutely find.

None of these failure modes show up in a standard role export. You need a structured audit methodology — which is exactly what the rest of this guide provides.

Step 1 — Map Current Security Role Sprawl

Identify Over-Privileged Users

Start with the Dynamics 365 Security Role report available under Settings → Security → Users. Export every user alongside their assigned roles and business unit. Then cross-reference against the principle of least privilege: does a customer service agent really need the System Customizer role? Does a read-only reporting user need Sales Manager?

Use the following Power Shell snippet via the Microsoft.Xrm.Data.PowerShell module to pull a flat CSV of all user-role assignments programmatically:

# Connect to your Dynamics 365 environment
Connect-CrmOnline -ServerUrl "https://yourorg.crm.dynamics.com" -ForceOAuth

# Retrieve all system users with their security roles
$users = Get-CrmRecords -EntityLogicalName systemuser `
  -Fields fullname, domainname, isdisabled, businessunitid

$roleAssignments = @()

foreach ($user in $users.CrmRecords) {
  $roles = Get-CrmUserSecurityRoles -UserId $user.systemuserid
  foreach ($role in $roles) {
    $roleAssignments += [PSCustomObject]@{
      UserName     = $user.fullname
      DomainName   = $user.domainname
      IsDisabled   = $user.isdisabled
      BusinessUnit = $user.businessunitid.Name
      SecurityRole = $role.name
    }
  }
}

$roleAssignments | Export-Csv -Path "D365_RoleAudit_$(Get-Date -Format yyyyMMdd).csv" -NoTypeInformation

Filter the output for IsDisabled = True immediately. Every disabled user with an active role assignment is a ghost account risk. Escalate these for licence revocation and role removal before anything else.

Uncover Azure AD Group Conflicts Across Business Units

Dynamics 365 supports assigning security roles to Microsoft Entra ID (Azure AD) groups — a powerful feature that also creates hidden entitlement chains. An individual may sit in five Entra groups, each mapped to a different Dynamics 365 role, across two business units. The cumulative permission set is almost never intentional.

To surface these conflicts, pull the group-to-role mappings from Entra ID and cross-reference against Dynamics 365 team membership. Look specifically for groups used primarily for non-CRM purposes (Teams channels, SharePoint sites, Power BI workspaces) that have been inadvertently mapped to Dynamics 365 security roles. This is the most common source of privilege creep in mature Microsoft 365 tenants.

Step 2 — Build Your RBAC Audit Checklist (NIST + ISO 27001 Aligned)

Generic RBAC checklists do not account for Dynamics 365's layered security model — organisation, business unit, team, user, and field-level security all interact. The following control points map to NIST SP 800-53 AC-2 (Account Management) and ISO 27001:2022 Annex A 5.15 (Access Control) while addressing Dynamics 365-specific architecture.

Step 3 — Close the SharePoint Document Library Permission Gap

This is the architectural gap that most Dynamics 365 security posts acknowledge but never resolve. Here is the definitive answer.

When Dynamics 365 integrates with SharePoint (Server-Based Authentication), it automatically creates a document library per entity (Accounts, Opportunities, Cases, etc.) and generates a folder per CRM record beneath it. Access to those folders is controlled by SharePoint permissions — not Dynamics 365 security roles. The two systems are connected at provisioning time but diverge the moment anyone touches SharePoint permissions manually.

The Three Divergence Scenarios

The Architectural Fix

The correct remediation has three components:

This three-component fix closes Scenario A, B, and C simultaneously. Without it, your Dynamics 365 security role audit is incomplete — no matter how thorough the role matrix review was.

Step 4 — Automate Quarterly RBAC Hygiene with Power Automate + Entra Access Reviews

Manual audits decay within weeks. The only sustainable approach is an automated enforcement playbook that runs continuously and escalates exceptions to humans only when decision-making is genuinely required.

Configure Microsoft Entra ID Access Reviews

Entra ID Access Reviews (available with Entra ID P2 or Microsoft 365 E5) allow you to schedule recurring reviews of group memberships — including the groups mapped to Dynamics 365 security roles. Configure the following:

Power Automate Enforcement Flow

Layer a Power Automate flow on top of Access Reviews to handle the Dynamics 365 side of the cleanup — because Access Reviews remove group membership in Entra but do not automatically update Dynamics 365 team assignments or trigger licence reallocation.

Build a scheduled cloud flow (weekly) with the following logic:

Trigger: Recurrence — Every Monday 06:00 UTC

Action 1: HTTP — GET /api/data/v9.2/systemusers
  ?$filter=isdisabled eq true
  &$select=systemuserid,fullname,domainname

Action 2: Apply to Each (disabled user)
  → HTTP DELETE role assignments for systemuserid
  → HTTP PATCH systemuser: islicensed = false
  → Post Teams adaptive card to IT-Security channel
    with user details + action taken

Action 3: HTTP — GET /api/data/v9.2/systemusers
  ?$filter=accessmode eq 0
  &$expand=systemuserroles_association($select=name)
  &$select=fullname,domainname

Action 4: Filter Array — roles containing "System Administrator"

Action 5: If array count > threshold (configurable)
  → Send approval email to IT Manager
  → Log to SharePoint audit list with timestamp

This flow handles ghost account cleanup automatically, flags System Administrator proliferation for human review, and creates an immutable audit log in SharePoint — satisfying both NIST AC-2 logging requirements and ISO 27001 evidence collection for external audits.

Building Your Ongoing Compliance Evidence Pack

Decision-makers undergoing SOC 2, ISO 27001 certification, or internal IT audits need to produce evidence — not just assurances. Structure your audit artefacts as follows:

Conclusion: Depth Wins Audits — and Protects Organisations

A Dynamics 365 security role audit that stops at the role export level is not an audit — it is a false sense of security. The organisations that pass compliance reviews and genuinely protect customer data are the ones who map Entra group conflicts, close the SharePoint ACL gap architecturally, and automate enforcement so hygiene does not depend on someone remembering to run a script.

At CRMONCE, we implement this exact hardening framework for clients across regulated industries in India and globally. Whether you are preparing for an ISO 27001 audit, responding to a security incident, or simply trying to get control of a Dynamics 365 environment that has grown organically for years — a structured, framework-aligned RBAC audit is where sustainable security begins.

Ready to run this audit against your own environment? Contact the CRMONCE team for a scoped security review engagement, or explore our related guides on SharePoint Permissions in Dynamics 365 and Security Roles vs Azure AD Groups to go deeper on the individual components covered here.