Capabilities, limitations of Microsoft’s native SoD tool

How to set up the SoD tool

Image

1. Define the SoD rules that determine what is considered an SoD risk (e.g., maintain vendor master and maintain vendor payments).
2. SoD rules are defined at the duty level. Map two duties so that a user does not have have access to both.
3. Enter the SoD rule severity, risk description and mitigation (if applicable).
4. To evaluate SoD risks at the role level, click ‘validate duties and roles’ to check if existing security roles violate the defined SoD rules. To evaluate SoD risks at the user level, navigate to ‘verify compliance of user-role assignments.’

Any organisation that does not have any other support tools may want to leverage this functionality to provide some initial insights. However, there are limitations to the tool that need to be considered to determine how much reliance can be placed on its insights to support organisational needs and security environments.

Limitations of the SoD tool

1. Microsoft does not provide template SoD rules. It is up to the business and information security personnel to define the SoD rules.
2. SoD rules are defined at the duty level. However, the lowest level of the security hierarchy is securable objects (role > duty > privilege > securable object). It is recommended to map SoD rules at the securable object level to obtain an accurate SoD evaluation.
   • Mapping SoD rules at the duty level does not provide the level of detail required to pinpoint the access that needs to be removed to resolve the SoD risk. At the duty level, it is likely that too much access will be removed as a result.
   • Duties can be modified and as a result if a duty changes, the ruleset also needs to change.
   • D365 will report a risk even if the duty does not have any underlying security assigned aka the duty is not providing any access in D365.
   • Mapping at the duty level will skip over scenarios where privileges are assigned directly to security roles.
   • There is an increased level of effort required to upkeep the SoD rules when a duty is created or deleted.
3. Mitigating controls are a critical element of SoD. D365 does not provide a central repository to store mitigating control data effectively.
4. Role SoD risks appear as banner notifications and user SoD risks appear in the action center, which does not allow for easy reporting.

In summary, the D365 SoD tool can be a good starting place, but organisations may need to incorporate other processes and capabilities to effectively manage SoD risks. Tools such as Fastpath provide extensive SoD reporting capabilities and can be customised to fit different business’ needs. Protiviti has partnered with Fastpath since 2012 and has executed over 100 assessments in Fastpath. Through this experience, Protiviti has developed a D365 leading practice SoD and sensitive access (SA) risk rulesets with over 250 SoD rules defined that can be customised to fit any business.

To help clients begin their journey towards a robust, compliance-oriented security with the aid of the Microsoft Dynamics 365 for Finance and Supply Chain Security role templates, Protiviti has developed Microsoft Dynamics 365 Finance and Supply Chain Security Role Templates. Learn more here.

To learn more about our Microsoft consulting solutions, contact us.