How to lower your D365 F&O user licence costs
Microsoft now validates that every user has the licence their security roles require. That makes your role design a licence bill: one role with one page too many can turn a Team Members user into a full licence. The good news is that the same mechanism tells you exactly where to save.
How D365 decides which licence a user needs
The licence is not chosen per user; it follows from the security roles assigned to them.
- Every menu item has a licence requirement per access level: viewing a page can need a lighter licence than changing it.
- A role needs the licence of the most demanding menu item it grants. A user needs the highest licence of all their roles: that becomes their base licence, and it covers the lower roles too.
- A user who needs two apps, for example Finance and Supply Chain Management, needs a base licence plus an attach licence.
- The System administrator role is exempt from licence requirements.
With per-user licence validation, a user without the required licence assigned in the Microsoft 365 admin center cannot sign in to production. Sandboxes are not affected.
Where licence money leaks
| Pattern | What happens |
|---|---|
| One role for a whole department | A power-user role, built for the key user, given to everyone who works in the area. |
| Change access where view would do | People who only look up information, holding roles that let them maintain it. |
| Standard roles broader than the job | The standard Accountant role for someone who only enters expenses or checks balances. |
| One stray privilege | A custom role that is fine except for one menu item added for a one-off task, years ago. |
| Two apps by accident | A single page from another app turns a user into base plus attach. |
| Users who no longer work here | Enabled accounts with roles, still counted. |
The standard tools
- User security governance › License usage summary (System administration › Security › Security governance), once the feature is turned on in Feature management. The User role licenses tab shows the licence each user needs per role; Role licenses shows the minimum licence per role, with the security objects that are Entitled or Not entitled. Duties and privileges have their own tabs.
- Security analysis in the same workspace finds every role that contains a given entry point; Security configuration is where you change roles.
- User License Consumption in the Power Platform admin center (Licensing › Finance and Operations): the tenant-wide view, with the required, assigned and missing licences per user, a role licence matrix, and CSV export. It refreshes every 4 to 12 hours.
- User activity aging report, to find accounts nobody uses.
Changes to roles take 2 to 8 hours to show up in the security governance reports, so plan your checks with that delay.
A role-by-role method
- Clean up first. Disable users who left or no longer sign in. It is the cheapest saving and needs no role work.
- List the expensive users. Everyone who needs a full licence or an attach licence. Group them by department or job.
- Find the role that drives it. For each group, the role that sets the licence, and inside it the menu items that are Not entitled for the lighter licence. Usually it is one role, and a handful of pages in it.
- Ask the business, not the system. Does this person really change those records, or only look at them? Do they still do that task? A role is often wider than anyone remembers asking for.
- Choose the smallest change. Give a lighter existing role; build a view-only variant of the role without the maintain privileges; or split the role so only the few people who need the expensive part get it.
- Test in a sandbox. Let a real user run their daily and month-end tasks with the new role before production. Breaking someone's month end saves nothing.
- Verify and assign. After the report refresh, check that the users now need the lighter licence, then adjust the assignments in the Microsoft 365 admin center. Keep a log of who changed from what to what, and why.
Traps
- Segregation of duties. Splitting or merging roles changes who can do what. Check that a lighter role does not quietly combine duties that should stay separate.
- Updates move the goalposts. Microsoft updates the licence mapping of menu items, and custom roles may need another look after an update. Make the review a routine, not a one-off.
- Your price list, not the list price. What a licence step is worth depends on your agreement with Microsoft or your partner. Start with the roles that affect the most users.
The quick way: Security X-ray
Security X-ray is a browser extension built for exactly this review. The workspace shows the licence each user’s pages need and the one role that pushes a user to a higher licence, so you see where a licence can be saved, user by user, and export the list for the conversation with your partner.
Find the right role handles step 5: pick the pages someone really uses, or import a task recording, and it returns the existing roles that cover them with the lowest licence, or the smallest set of standard duties for a new role. Snapshots let you compare the security setup before and after the change, and segregation of duties rules check that the lighter role did not create a conflict.
The free side panel answers the same question from any page: who can open this page, through which role, and which licence it needs. Security X-ray only reads, with your own D365 permissions, and everything is analysed in your browser. Its licence figures are an estimate from the standard licence of each page; the License usage summary and the Power Platform admin center decide what Microsoft counts.
Make it a routine
Review once a quarter and after every major update: new users, new roles and changed licence mappings all add up. A review that took a week the first time takes an afternoon the next, because the roles are already right.
Menu names and behaviour can differ between D365 versions and your own setup. Check in your environment before you act.