> ## Content Index > Fetch the complete content index at: https://www.sajeedmullaji.com/llms.txt > Use this file to discover other available public pages before exploring further. # D365 F&O External Access — How to Make Vendor Accounts Self-Destruct in 30 Days - URL: https://www.sajeedmullaji.com/d365-fo-entra-id-entitlement-management-access-packages/ - Published: 2026-09-24T13:55:50.000Z - Updated: 2026-09-24T13:55:50.000Z - Description: Your implementation partner left three months ago. Their consultants still have D365 access. Discover how Entra ID Entitlement Management makes external vendor accounts self-destruct automatically after 30 days — with CFO approval and zero IT helpdesk tickets. - Author: Sajeed Mullaji - Tags: D365 FO, Entra ID, Security Governance, ITGC Audit, The D365 Governance Roadmap Most IT teams treat external system access like a permanent tattoo. When an external consultant, developer, or auditor needs access to Dynamics 365 Finance & Operations, the process is always the same. IT creates a helpdesk ticket, provisions a guest account, and assigns a highly privileged security role. They also consume an expensive enterprise license to make it happen. Then, the project ends. The external vendor moves on. And IT completely forgets to remove the access. Six months later, that external auditor or implementation partner still holds active, licensed access to your live financial environment. This is the exact scenario that causes Chief Financial Officers to fail ITGC audits. It is also a massive, hidden drain on your monthly licensing expenditure. Relying on IT helpdesk tickets and human memory to govern external access is a guaranteed failure. Humans forget. The access stays open indefinitely. Today, we are permanently removing human memory from the external access lifecycle. We are going to walk through the exact, pre-configured architecture for **Entra ID Entitlement Management D365**. I have already built and executed this complete workflow in our environment. Let me walk you through each architectural decision we made. I will show you exactly how we built a self-destructing access package that governs external consultants automatically. ### **Step 1: Creating the Governance Catalog** We started the configuration inside the Entitlement Management module by creating a Catalog. Here is the catalog we created, named "D365 External Access." Think of a catalog as a secure container. It houses all of our external vendor and auditor access packages in one organized location. Crucially, we explicitly enabled this catalog for B2B external users. This is the foundational requirement for true **D365 B2B access control**. ![](https://storage.ghost.io/c/86/1f/861f43cb-a69d-4876-ae5d-bd42db276850/content/images/2026/09/1-10.png) **D365 External Access catalog — dedicated container for all external vendor and auditor access packages — explicitly enabled for B2B external users outside the organization**. ### **Step 2: Building the Access Package** Inside that catalog, we created the actual Access Package. We named this package "External Auditor - D365 Read Only 30 Days." The description clearly states the terms: "Grants 30-day read-only access to D365 F&O — requires CFO approval — automatically revokes on expiration." This package acts as a logical wrapper. It bundles the exact permissions the external auditor needs, tied to a strict time limit. ![](https://storage.ghost.io/c/86/1f/861f43cb-a69d-4876-ae5d-bd42db276850/content/images/2026/09/2-6.png) ****External Auditor D365 Read Only 30 Days Access Package — governance written into the system — 30 day access — CFO approval required — automatic revocation on expiration**. ### **Step 3: Configuring Resource Roles and License Reclamation** This step is the absolute core of the architecture. Here, we defined what the access package actually grants. We selected our specific Entra ID security group, named "D365\_External\_Auditor\_ReadOnly", and mapped it as a Member. This security group acts as the bridge between Entra ID and your financial system. When the access package is approved, the external user is automatically added to this group. Group-based licensing instantly assigns them a D365 license and their ERP security role. When the 30 days expire, Entra ID removes them from the group. The ERP access is severed, and the license is returned to your available pool automatically. This is true **D365 vendor license reclamation**. Zero helpdesk tickets required. ![](https://storage.ghost.io/c/86/1f/861f43cb-a69d-4876-ae5d-bd42db276850/content/images/2026/09/2.1.png) ****D365\_External\_Auditor\_ReadOnly security group mapped as Member — bridge between Entra ID and D365 — approval adds user to group — expiry removes user and reclaims license automatically.** ### **Step 4: Configuring Requests and Approvals** Next, we defined exactly who is allowed to ask for this access, and who holds the authority to grant it. We configured the policy so that external users who are not yet in our directory can request this package. Under the approval settings, we made two critical decisions. First, we set "Require justification" to Yes. External auditors must provide a mandatory business reason. Second, we set "Require approval" to Yes, and we designated the CFO as the sole approver. We explicitly bypassed the IT helpdesk. Financial access governance belongs to the business leaders who own the data, not the IT department. ![](https://storage.ghost.io/c/86/1f/861f43cb-a69d-4876-ae5d-bd42db276850/content/images/2026/09/2.2.png) ****External users can request access — CFO is the designated approver not IT helpdesk — mandatory business justification required — financial access governed by the business owner**. ### **Step 5: The Lifecycle Kill Switch** Finally, we configured the automated offboarding mechanism. Under the Lifecycle tab, we hard-configured a 30-day automatic expiration limit. We also specified that any timeline extension requires a formal re-approval from the CFO. This is where human memory is completely removed from the offboarding process. The system simply enforces the deadline, guaranteeing the access dies on time. ![](https://storage.ghost.io/c/86/1f/861f43cb-a69d-4876-ae5d-bd42db276850/content/images/2026/09/2.3.png) ****External users can request access — CFO is the designated approver not IT helpdesk — mandatory business justification required — financial access governed by the business owner**. ### **Step 6: The External User Experience** With the architecture built, let us look at the actual workflow execution. We tested this with a simulated external auditor. The auditor received the direct My Access portal link. They logged in with their own corporate credentials. The portal immediately forced them to submit a business justification before proceeding. Our test user typed: "Annual Q3 Financial Audit — PwC external review team." They clicked submit. At this stage, the status changed to "Pending approval." The access is entirely blocked until the business sponsor signs off. ![](https://storage.ghost.io/c/86/1f/861f43cb-a69d-4876-ae5d-bd42db276850/content/images/2026/09/2.4.png) ****30 day automatic lifecycle kill switch — hard configured — extension requires CFO re-approval — human memory completely removed from external access offboarding**. ### **Step 7: The IT Admin Reality (By Design)** While that request was pending, I logged into the Entra ID admin panel as an IT Administrator to check the status. When I viewed the pending request, there was no "Approve" button anywhere on my screen. IT can monitor the workflow, they can cancel stuck requests, and they can reprocess errors. But they CANNOT approve the access. This is by design. The system prevents IT from bypassing the business sponsor. The CFO retains absolute control over financial access decisions. ![](https://storage.ghost.io/c/86/1f/861f43cb-a69d-4876-ae5d-bd42db276850/content/images/2026/09/2.5.png) **External auditor self-service My Access portal — auditor sees exactly what access they are requesting and for how long — professional governed experience — no IT helpdesk ticket**. ![](https://storage.ghost.io/c/86/1f/861f43cb-a69d-4876-ae5d-bd42db276850/content/images/2026/09/2.6-1.png) ### **Step 8: The CFO Approval Workflow** Next, we executed the approval. The CFO logged into their own dedicated portal at myaccess.microsoft.com. This portal provides a professional, clean, self-service experience for business leaders. The CFO saw the pending request in their inbox. They reviewed the PwC justification submitted by the auditor. The CFO typed their own approval reason into the system and clicked the Approve button. This is one-click governance. There was zero friction, zero email chains, and zero IT involvement. ![](https://storage.ghost.io/c/86/1f/861f43cb-a69d-4876-ae5d-bd42db276850/content/images/2026/09/2.8.png) ![](https://storage.ghost.io/c/86/1f/861f43cb-a69d-4876-ae5d-bd42db276850/content/images/2026/09/2.9.png) ### **Step 9: The Forensic Audit Trail** The moment the CFO clicked approve, the external auditor was granted access. To prove this to your external audit team, we navigate to the Requests tab inside the Access Package. Here, you will see the request with a "Delivered" status. This screen provides a complete, timestamped workflow. It shows exactly who requested the access, their justification, who approved it, and the exact second it was granted. This is your unalterable ITGC forensic evidence. It proves your **temporary D365 access governance** is fully operational and securely logged. ![](https://storage.ghost.io/c/86/1f/861f43cb-a69d-4876-ae5d-bd42db276850/content/images/2026/09/2.15.png) ****Complete ITGC forensic audit trail — status Delivered — who requested — CFO approved — exact timestamp — zero IT helpdesk tickets — unalterable governance evidence for external auditor** ### **The CFO Cross-Examination** When I deploy **Entra ID Access Packages D365** for enterprise clients, executive leadership always challenges the operational realities. Here are the three specific questions CFOs and IT Audit Directors ask when evaluating this architecture. **Cross question 1: What if the audit takes longer than 30 days? Does their access just hard cut off and stop them from working?** Answer: Yes, the access will experience a hard cut off. However, the system is designed to prevent business disruption. The Entitlement Management system automatically emails the external auditor 14 days, 7 days, and 1 day before their expiration. These emails contain a direct link for the auditor to request an extension. That extension routes directly back to you, the CFO, for a one-click re-approval. Security remains absolute, but the business continues seamlessly without urgent IT tickets. **Cross question 2: We use expensive D365 Finance licenses. Does this actually save us money, or is it just for security?** Answer: It definitively saves you money. Because we mapped an Entra ID Security Group to this package, the licensing is entirely automated. The exact millisecond the 30-day lifecycle expires, the user is ejected from that security group. If your environment utilizes group-based licensing, ejecting them from the group instantly rips the D365 license away from their account. The license is immediately returned to your available pool. There is no helpdesk ticket required, and no wasted monthly cost. It is automatic license reclamation. **Cross question 3: Can we force the external vendor's manager to approve the access before it even reaches our CFO?** Answer: Yes. We can configure a multi-stage approval workflow to push accountability back onto the vendor. Stage 1 routes the approval directly to the external vendor's internal manager—the external sponsor. Only if that external manager approves the request does Stage 2 route the workflow to your internal CFO. You force the third party to validate their own employee's requirement for access before the request ever hits your desk. ### **Completing the Zero Trust Architecture** This Entitlement Management configuration represents a major milestone. This deployment completes the five-layer zero trust architecture we have built throughout our Phase 2 security series. First, our Conditional Access (CA01) policy guarded the external perimeter. Second, Privileged Identity Management (PIM) controlled elevated internal administrative rights. Third, Lifecycle Workflows automated our internal employee offboarding, closing the Friday afternoon leaver gap. Fourth, Continuous Access Evaluation (CAE) provided real-time session monitoring to kill stolen tokens. And now, Entitlement Management automates the governance, licensing, and lifecycle of every external vendor and auditor in your environment. To review the entire strategic implementation plan from start to finish, visit[ sajeedmullaji.com/tag/d365-governance-roadmap](https://www.google.com/search?q=https%3A%2F%2Fsajeedmullaji.com%2Ftag%2Fd365-governance-roadmap&ref=sajeedmullaji.com). If you are currently re-engineering your internal security roles and need standardized starting points, download my audit-ready matrices at[ sajeedmullaji.com/tag/templates](https://www.google.com/search?q=https%3A%2F%2Fsajeedmullaji.com%2Ftag%2Ftemplates&ref=sajeedmullaji.com). If you are tired of failing ITGC audits because orphaned vendor accounts are sitting active in your ERP, it is time to automate your governance. Reach out to me directly at sajeedmullaji.com to deploy this exact self-destructing access architecture in your Dynamics 365 environment. ### **Executive Q&A: Advanced Entitlement Mechanics** **Q: When the Access Package expires after 30 days, does the external user's guest account get deleted from our Entra ID tenant?** By default, the user simply loses access to the package resources, but their B2B guest account remains in your directory. However, you can configure Entitlement Management lifecycle settings to automatically block sign-in and delete the guest account if they have no other active access packages. This prevents your Entra ID tenant from becoming a graveyard of inactive guest accounts. **Q: Can we restrict the external vendor to specific IP addresses while they have this access package?** Yes, but not within the Access Package itself. The Access Package simply grants the user membership into a security group. You must then use Entra ID Conditional Access to target that specific security group. You can build a policy that forces members of the "D365\_External\_Auditor\_ReadOnly" group to only authenticate from a specific list of trusted IP addresses provided by the audit firm. **Q: How long are these access package audit logs retained for our annual ITGC review?** Entra ID audit logs, which contain the access package request, approval, and provisioning events, are retained for 30 days on standard tiers. Because you have an Entra ID P2 license, they are retained for 30 days natively. To satisfy annual ITGC audits, you must configure Entra ID Diagnostic Settings to export these audit logs to an Azure Log Analytics Workspace or an external SIEM. That is the only way to guarantee the logs survive until your year-end audit.