Dynamics 365 IT Audit Software Consulting

Access ITGC testing for Dynamics 365 covers the full lifecycle: new-user role assignment, role changes tied to job transfers, and timely deprovisioning on termination. Dynamics 365 records role assignment events, but the request-and-approval trail behind a role grant — who requested it, who approved it, and why — typically lives outside the ERP in a service-desk or identity-governance tool, which means IT audit has to reconcile two systems rather than pull a single Dynamics 365 report. A common testing approach samples a population of role changes from the F&O security log and traces each one back to an approved request ticket, flagging any grant with no corresponding approval.

Deprovisioning testing is where Dynamics 365 environments most often fail ITGC testing, particularly when user identity is federated through Microsoft Entra ID. A termination processed correctly in Entra ID disables the user's sign-in, but stale security-role assignments can persist inside F&O and inside any connected Power Platform environments, and a same-day Entra ID disablement does not guarantee a same-day review of what roles that account still held. IT audit testing typically samples recent terminations and confirms both the identity-layer disablement and the F&O role-assignment removal, since the two are governed by different processes and can drift out of sync.

Change management ITGC testing for Dynamics 365 evaluates whether configuration and code changes — modified posting profiles, updated approval thresholds, custom extensions built on the platform — moved through a controlled process with segregation between the person making the change and the person approving it for production. F&O's database-level change tracking captures the technical record of what changed and when, but it does not capture whether that change was authorized; IT audit has to trace sampled change-tracking entries back to a change ticket or deployment record maintained in the organization's development lifecycle tooling.

The scope gap that recurring shows up in Dynamics 365 IT audit findings is that change management testing stops at the F&O application boundary and never extends into Power Platform. A Power Automate flow or Power App that reads from or writes to Dataverse tables underlying F&O is a change to the financially relevant environment just as much as a modified posting profile, but it is built and deployed through the Power Platform admin center and Power Apps maker portal, tools most ERP change-management processes were not originally designed to cover. IT audit test plans that only sample F&O change tickets will systematically miss this category of change.

System operations testing for a cloud-hosted Dynamics 365 F&O environment looks different from testing an on-premise ERP: backup and infrastructure resilience are largely managed by Microsoft under the Dynamics 365 service, so IT audit's testing effort shifts toward tenant-level configuration controls the organization does own — Data Loss Prevention policy configuration, environment strategy (which environments can host production financial data), and Purview audit log retention settings. Testing whether these tenant-level controls are configured, rather than testing infrastructure the organization does not directly operate, is the practical adaptation IT audit programmes have to make for a SaaS-delivered ERP.

Microsoft Purview audit log retention is itself an ITGC worth testing directly: if retention is configured for a period shorter than the audit cycle requires, evidence needed for a Section 404 test can no longer exist by the time testing occurs. IT audit test plans for Dynamics 365 should include a direct check of the configured retention period against the organization's evidence-retention policy, rather than assuming default retention settings are sufficient for SOX purposes.