> ## Content Index > Fetch the complete content index at: https://www.sajeedmullaji.com/llms.txt > Use this file to discover other available public pages before exploring further. # How to Split the D365 F&O System Administrator Role Without Breaking Batch Processing - URL: https://www.sajeedmullaji.com/split-system-administrator-d365-fo-sox-itgc/ - Published: 2026-08-23T01:19:41.000Z - Updated: 2026-08-30T13:57:05.000Z - Description: Learn how to split the D365 F&O System Administrator role safely to satisfy SOX ITGC requirements without breaking batch processing or causing operational downtime. - Author: Sajeed Mullaji - Tags: ITGC Audit, Security Architecture, D365 FO The external audit report just landed on the CFO's desk, and the finding is glaring. Too many IT and business users hold the System Administrator role in your production environment. The auditor is demanding immediate remediation to satisfy SOX ITGC logical access controls. But when the CFO hands the directive to the IT Director, panic sets in across the technology department. The IT operations team knows a dirty secret about ERP architecture. If they simply remove System Administrator access today, half the company's automated batch jobs will fail overnight. ## The Root of the D365 F&O System Administrator Role SOX ITGC Finding Auditors flag the System Administrator role because it violates the most basic principle of financial security: segregation of duties. This master role bypasses every security control, workflow approval, and data restriction in the system. From a CFO's perspective, a user with this access can alter vendor bank accounts, process a payment, and erase the system trace. That represents a material fraud risk that no external auditor will sign off on. To pass a D365 F&O privileged access audit, you must restrict this access to heavily monitored break-glass accounts. But you cannot simply strip the role from your IT staff without a replacement plan. ## The IT Operations Fear: Breaking the Business IT Directors push back against audit findings because they are measured on system uptime, not compliance checklists. They know that many background processes are tied to the user accounts that originally created them. I recently worked with a manufacturing client who tried to fix an audit finding by blindly removing the role from their IT team. The next morning, their Master Planning batch runs completely failed. The factory floor halted because the critical batch job was running under the credentials of an IT staff member who suddenly lacked permissions. To fix the compliance issue without breaking the business, you must split the role surgically. ## How to Split System Administrator D365 Access Safely You cannot run an enterprise ERP without IT support. The business relies on your technology team to monitor integrations, restart failed processes, and troubleshoot errors. Instead of granting one dangerous master key, you need to distribute specific operational duties across highly controlled custom roles. This protects the financial ledger while keeping the system running. Here are the three distinct roles you must build to replace the monolithic administrator assignment. ### 1\. IT Batch Operations Manager This role gives your IT operations team the exact access they need to keep the system heartbeat active. It allows them to schedule, monitor, and troubleshoot background jobs and server infrastructure. Crucially, it does not allow them to modify financial data, change security setups, or deploy code. It solves the operational bottleneck while providing a clean boundary for the auditors. Your IT staff can see that an invoice batch failed and restart it, but they cannot open the invoice and change the payment amount. ### 2\. System Support and Operations Specialist Helpdesk teams need to investigate user errors without having the power to change backend data. This role grants read-only access to system diagnostics, user setups, and workflow histories. Support staff can trace a failed workflow or check user permissions to troubleshoot tickets effectively. They have the visibility required to close support desk tickets quickly and accurately. The CFO sleeps well knowing the tier-one helpdesk cannot accidentally approve a purchase order or manipulate a vendor record. ### 3\. Emergency Break-Glass Admin Sometimes the system crashes, and you actually need full administrative power to save the day. The Break-Glass Admin is a dedicated, vaulted account used only for true emergencies. When IT uses this account, the system triggers an alert to the IT Director and records every keystroke. The auditors accept this because the access is temporary, justified, and fully documented. You tie this account to Entra ID Privileged Identity Management to enforce strict time limits and multi-factor authentication. ## The Exact D365 Batch Processing Permissions You Need Building the IT Batch Operations Manager role requires absolute precision. If you grant too much access, you fail the SOX audit again; if you grant too little, the batch jobs fail. You must map these exact D365 batch processing permissions to your new custom role. - **BatchJobMaintain:** Allows the user to create, modify, cancel, and monitor batch jobs. - **BatchJobView:** Grants read-only access to review batch history and active queue statuses. - **BatchServerGroupMaintain:** Permits the management of batch server groups and load balancing. - **SysServerConfigMaintain:** Enables backend server adjustments required for executing background threads. ## The 5-Step Process: Removing System Administrator in Production Executing this transition requires absolute precision. Follow this step-by-step blueprint to remove the System Administrator role from standard users while keeping your background processing entirely uninterrupted. ### Step 1: Create the Custom Batch Role You must first build the custom container that holds your operational batch permissions without granting access to transactional business data or system-level developer tools. 1. Navigate to **System administration > Security > Security configuration**. 2. On the **Roles** tab, click **Create new**. 3. In the slide-out dialog, enter the following details: - **Role name:** IT Batch Operations Manager - **Role identifier:** ITBatchOperationsManager 4. Select your new role in the list, navigate to the **Duties** tab in the details pane, click **Add references**, and add the standard duty: **Batch job maintenance (Maintain batch jobs)**. 5. Navigate to the **Privileges** tab under the role, click **Add references**, and explicitly grant the following five privileges: `BatchJobMaintain`, `BatchJobView`, `BatchServerGroupMaintain`, and `SysServerConfigMaintain`. 6. Switch to the **Unpublished objects** tab at the top of the workspace. 7. Select your new role and its modified dependencies, then click **Publish selection** (or **Publish all**) to write the security metadata into the database. ### Step 2: Reassign Batch Job Ownership Batch jobs in Dynamics 365 Finance & Operations execute under the security context of the user listed in the **Run by** parameter. If that user loses permissions or their account is modified, the underlying AOS worker threads will throw authorization errors and fail. 1. Navigate to **System administration > Inquiries > Batch jobs**. 2. Filter the grid to review all recurring, critical business batch jobs (e.g., Master Planning, Ledger Posting, Recurring Data Integrations, Statement Posting). 3. Identify every batch job where the **Run by** field is assigned to an individual human IT user. 4. Select the batch job, click **Functions > Change status**, and set it to **Withhold**. 5. Change the **Run by** user ID from the individual user's account to a dedicated, non-interactive service account (e.g., `svc-d365-batch`). 6. Ensure this dedicated service account has the necessary application-level security roles required to process those specific business transactions. 7. Click **Functions > Change status**, and set the job back to **Waiting**. ### Step 3: Provision the IT Team Assign the operational roles to your IT engineering and support personnel before revoking any existing permissions. This avoids operational disruptions while the security architecture synchronizes across your AOS instances. 1. Navigate to **System administration > Security > Assign users to roles** (or go to **System administration > Users > Users**). 2. Locate and select the **IT Batch Operations Manager** role in the left-hand pane. 3. In the **Users assigned to role** section, click **Manually assign / exclude users**. 4. Select the user accounts of the IT operations engineers, batch managers, and integration leads who manage day-to-day background processing. 5. Click **Assign to role**. 6. Repeat this process for any secondary operational roles, such as the **System Support and Operations Specialist** role for helpdesk diagnostics. ### Step 4: Test in Your Sandbox Never deploy security changes directly to Production without validating batch ownership and execution in an identical Tier-2+ Sandbox environment. 1. Log in to your Sandbox/UAT environment with an Arnie account. 2. Navigate to **System administration > Users > Users**, select a designated IT test account, and remove the System Administrator role. 3. Verify that the test account has only the newly created **IT Batch Operations Manager** role assigned. 4. Have the test user log in to the Sandbox environment and perform standard operational tasks: - Navigate to **System administration > Inquiries > Batch jobs**. - Change a test recurring batch job status to **Withhold**, modify its recurrence schedule, and set it back to **Waiting**. - Trigger an on-demand batch process and confirm they can monitor the queue. - Navigate to **System administration > Inquiries > Batch job history** (or click **Log** on the batch job form) to confirm that background tasks execute successfully without security exceptions or runtime authorization failures. ### Step 5: Execute in Production Once validation is complete in Sandbox, migrate the security definitions and systematically revoke privileged access in Production. 1. In Sandbox, navigate to **System administration > Security > Security configuration**, select **Data > Export**, and save the XML security package. 2. In Production, navigate to **System administration > Security > Security configuration**, select **Data > Import**, upload the XML file, and click **Publish all**. 3. Navigate to **System administration > Security > Assign users to roles**. 4. Select the standard **System Administrator** role in the left pane. 5. In the assigned users list, select all standard IT staff, consultants, and business users, then click **Exclude** or **Remove**. 6. Retain the System Administrator role only on dedicated, vaulted Break-Glass emergency accounts protected by Microsoft Entra Privileged Identity Management (PIM) and multi-factor authentication. ## Passing the D365 F&O Privileged Access Audit Fixing the system configuration is only half the battle. You must prove to the external audit partner that the environment is genuinely secure. - Generate the **User Role Assignments** report and hand it directly to your auditor. Show them that zero standard human users hold the master administrative role in production. - Provide the security configuration matrix for your new **IT Batch Operations Manager** role. The auditor will review the specific batch privileges, verify the lack of financial access, and close the finding. You have now transformed a critical audit vulnerability into a mature, enterprise-grade IT operation. ## Secure Your ERP with Confidence Balancing strict audit requirements with the reality of daily IT operations is difficult, but it is not impossible. You do not have to figure out the exact privilege mappings alone. If your external auditors just handed you a material weakness finding, I can help you fix it permanently. We will engineer roles that protect your balance sheet without crippling your IT team. ## Frequently Asked Questions ### Q: Does removing the System Administrator role break recurring batch jobs tied to legacy sysadmin accounts? A: Yes, batch jobs scheduled under a user with System Administrator will fail once that role is stripped. You must reassign batch ownership to a dedicated service account assigned to the IT Batch Operations Manager role. ### Q: What duty and privilege must be isolated in the IT Batch Operations Manager role? A: Assign duties specifically tied to batch management — Maintain batch jobs and View batch jobs — while stripping all administrative entry points. This ensures users can monitor and execute jobs without possessing backdoor database or security modification rights. ### Q: How do you satisfy external auditors who challenge the removal of sysadmin oversight? A: Provide exported role assignment matrices showing SoD enforcement alongside the batch job history log tracking exact execution ownership and timestamps. This proves operational continuity while demonstrating strict least privilege compliance. Ready to fix your D365 security architecture? Visit **sajeedmullaji.com** or email **sajeed@sajeedmullaji.com** to discuss your specific environment. Let's audit-proof your environment with zero operational downtime.