Microsoft Dynamics 365 User Management Guide

• Model type: hybrid
• Description: Dynamics 365 (Customer Engagement apps: Sales, Service, etc.) uses a role-based access control (RBAC) model with security roles composed of granular entity-level privileges (Create, Read, Write, Delete, Append, Append To, Assign, Share) scoped by access level (User, Business Unit, Parent Business Unit, Organization). Business Central uses permission sets (predefined or custom collections of object-level permissions). Both products support custom roles/permission sets. Access can also be granted via Teams (owner teams or access teams) in Customer Engagement apps.
• Custom roles: Yes
• Custom roles plan: Available on all paid Dynamics 365 licenses; no premium tier required for custom security roles.
• Granularity: Entity-level (table-level) with per-privilege (CRUD + Append/Assign/Share) and per-scope (user/BU/org) control in Customer Engagement apps. Object-level (table, page, report, codeunit) with read/insert/modify/delete/execute permissions in Business Central.

1. Assign the appropriate Dynamics 365 license to the user in the Microsoft 365 Admin Center (https://admin.microsoft.com) under Users > Active Users > [User] > Licenses and apps.
2. Wait for license propagation (can take up to 15 minutes; user must exist in Azure Active Directory / Microsoft Entra ID).
3. Navigate to the Power Platform Admin Center (https://admin.powerplatform.microsoft.com).
4. Select Environments > [Target Environment] > Settings > Users + permissions > Users.
5. Click 'Add user' and search for the user by name or email.
6. Select the user and click 'Add'.
7. After the user is added to the environment, assign one or more security roles: select the user, click 'Manage security roles', check the desired roles, and save.
8. (Business Central only) In Business Central, go to Settings > Users, select the user, and assign permission sets and user groups as needed.

Required fields: Valid Microsoft 365 / Azure AD account (user must exist in the tenant), Dynamics 365 license assigned in Microsoft 365 Admin Center, At least one security role assigned within the environment

Watch out for:

• License must be assigned in Microsoft 365 Admin Center before the user can be added to a Dynamics 365 environment. Users without a valid license will appear greyed out or cannot be added.
• Adding a user to the environment and assigning a security role are two separate steps; a user added without a security role has no functional access.
• Users are sourced from Azure AD (Entra ID); external users (guests) require Azure AD B2B guest accounts and may have restricted access depending on environment settings.
• In Customer Engagement apps, users are associated with a Business Unit at creation. Changing a user's Business Unit later can affect record ownership and access.
• For Business Central, user creation is triggered automatically when a licensed user first signs in, or can be done manually via the Users page in Business Central administration.

• Can delete users: No
• Delete/deactivate behavior: Users cannot be permanently deleted from a Dynamics 365 environment. The supported action is to disable (deactivate) the user within the environment. This prevents login and removes active access while preserving all records owned by or associated with that user. The underlying Azure AD account can be deleted at the tenant level, which will also disable environment access, but the user record remains in Dynamics 365 in a disabled state.

1. Navigate to Power Platform Admin Center (https://admin.powerplatform.microsoft.com).
2. Select Environments > [Target Environment] > Settings > Users + permissions > Users.
3. Locate the user (filter by 'Enabled' status if needed).
4. Select the user's checkbox.
5. Click 'Disable' (or 'Manage user' and set status to Disabled).
6. Confirm the action. The user's status changes to 'Disabled' and they can no longer log in.
7. (Optional) Remove the Dynamics 365 license from the user in Microsoft 365 Admin Center to free the license seat for reassignment.

Watch out for:

• Disabling a user in the Dynamics 365 environment and removing their license in Microsoft 365 Admin Center are two separate actions; both are required to fully offboard and reclaim the license seat.
• Workflows, Power Automate flows, and integrations that run in the context of the disabled user will break immediately upon disabling. Audit and reassign these before deactivating.
• Records owned by a disabled user remain assigned to them and may become inaccessible to other users depending on security role scoping (e.g., if other users only have 'User' level read access). Reassign ownership proactively.
• If the Azure AD account is deleted before the Dynamics 365 user is disabled, the user record in Dynamics 365 will show as disabled automatically, but owned records and the above issues still apply.
• In Business Central, disabling a user is done within Business Central's own Users page (Settings > Users > select user > set State to Disabled), separate from the Power Platform Admin Center.

• Where to check usage: Microsoft 365 Admin Center (https://admin.microsoft.com) > Billing > Licenses - shows assigned vs. available seats per license SKU. Power Platform Admin Center > Capacity > Add-ons also shows environment-level consumption. Microsoft 365 Admin Center > Reports > Usage provides last-activity data per user.
• How to identify unused seats: In Microsoft 365 Admin Center, go to Reports > Usage > Microsoft Dynamics 365 (if available) or use the 'Last sign-in' date visible under Users > Active Users to identify users who have not logged in recently. Alternatively, use Microsoft Entra ID sign-in logs filtered by the Dynamics 365 application to find inactive licensed users.
• Billing notes: Licenses are billed monthly or annually through Microsoft Volume Licensing, Microsoft 365 admin center (direct), or a Cloud Solution Provider (CSP). Annual subscriptions are typically discounted vs. month-to-month. License counts are managed at the tenant level in Microsoft 365 Admin Center; environment-level access is controlled separately in Power Platform Admin Center. Dynamics 365 licenses include use rights for Power Apps (limited) and Power Automate (limited); full Power Platform capabilities require separate licenses. Attach licenses (e.g., Customer Insights, Copilot) are available as add-ons to base module licenses.

Every app compounds the offboarding risk because disabling a user in the Power Platform Admin Center and revoking their license in Microsoft 365 Admin Center are independent actions - missing either step leaves the user partially accessible or wastes a paid seat.

Workflows and Power Automate flows running under a departing user's credentials break silently the moment that account is disabled, and the failures are difficult to trace back to the root cause.

Records owned by a disabled user remain assigned to them and can become inaccessible to teammates depending on security role scope, requiring proactive ownership reassignment before or immediately after deactivation.

Admins consistently flag the two-step license-then-role process as the top source of provisioning errors: a user added to an environment without a security role has zero functional access, and the UI does not warn you.

License propagation delays of up to 15–30 minutes after assignment in Microsoft 365 Admin Center are a recurring frustration, especially during time-sensitive onboarding.

The Team Member license use-right restrictions generate compliance risk - users frequently exceed permitted entity access without realizing it, and Microsoft can flag violations during audits.

Common complaints:

• Users frequently report confusion between the two-step process of assigning a license in Microsoft 365 Admin Center and then separately adding the user and assigning security roles in the Power Platform Admin Center or Dynamics 365 environment.
• Admins report that disabling a user does not automatically free the license, requiring a separate action in Microsoft 365 Admin Center, which is easy to overlook during offboarding.
• Workflows and Power Automate flows running under a specific user's credentials break silently when that user is disabled, causing integration failures that are difficult to diagnose.
• Record ownership is not automatically reassigned when a user is disabled, leaving orphaned records that may be inaccessible to other users depending on security role scope settings.
• The Team Member license use-right restrictions are reported as confusing and overly restrictive; users frequently exceed permitted entity access without realizing it, creating compliance risk.
• License propagation delays (up to 15–30 minutes after assignment in Microsoft 365 Admin Center) before a user can be added to a Dynamics 365 environment are a common source of frustration.
• Business Central user management is entirely separate from the Power Platform Admin Center, requiring admins to manage users in two different interfaces for organizations using both CE apps and Business Central.
• Custom security role creation is reported as complex due to the large number of entity-privilege-scope combinations, with no easy way to clone and compare roles in the standard UI.

Manual management is workable for organizations with low user churn and a single Dynamics 365 module. The overhead scales poorly once multiple environments (dev, test, prod) are in play, because security role GUIDs differ per environment and must be tracked separately.

Teams running Sales Enterprise or Customer Service alongside Business Central face the added complexity of two distinct permission models - RBAC with entity-level privileges in Customer Engagement apps, and permission sets in Business Central - with no unified admin view across both.

Bottom line

Dynamics 365 manual user management is functional but fragmented across at least two admin portals, with license assignment, environment access, and security role assignment each requiring a discrete action.

Every app in the suite inherits this split, meaning offboarding a single user correctly requires coordinated steps across Microsoft 365 Admin Center and Power Platform Admin Center - and Business Central adds its own Users page on top.

The silent failure modes (broken flows, orphaned records, unlicensed seats) make audit hygiene difficult to maintain at scale without automation.