Pay for the licence users need.
In D365 F&O, one role with one page too many can push a user from a Team Members or Activity licence to a full one. Security X-ray shows, for every user, the licence their access requires and the role that drives it, so you know exactly where a licence can be saved.
- Licence review per user
- Read-only
- Side panel free
- No D365 data leaves your browser
| User | Access | Through |
|---|---|---|
| Anna Jansen | Change | Accounts receivable clerk |
| Ben Peeters | Read | Sales clerk |
| Carla De Smet | Blocked | Deny on CustTable · Auditor (custom) |
| Daan Maes | Read | Collections agent |
| Eva Claes | Change | Credit manager · USMF only |
| Femke Wouters | Read | Sales manager |
| Gert Hermans | Change | Accounts receivable manager |
| Hanne Mertens | Read | Customer service rep |
Who can open this page, how, and the one role that quietly blocks it.
Find the role that makes a user expensive.
Microsoft checks whether every user has the licence their roles require. When roles have grown over the years, the cheaper answer is often to trim the role, not to buy the bigger licence.
At Microsoft’s list prices, the step from a Team Members or Activity licence to a full Finance or Supply Chain Management licence is well over €100 per user, per month. Moving one user down pays for a year of Security X-ray. Your own prices depend on your agreement with Microsoft or your partner.
- 01 · Per user
The licence their access requires
For every user, the licence the pages in their roles need, from the View and Maintain licence of each menu item. Someone who only looks at a page often needs a lighter licence than someone who changes it.
- 02 · The cause
The one role that pushes them up
Usually not the whole setup, but one role or a few pages in it: a power-user role given to everyone, a standard role broader than the job, change access where view would do. Security X-ray names the role and the pages that need the higher licence.
- 03 · The fix
A lighter role that still covers the work
Find the right role takes the pages someone really uses and returns the existing roles that cover them with the lowest licence, or the smallest set of standard duties for a new role.
The licence review is an estimate from the standard licence of each page and the access each role grants. Use it to find where to look; User security governance and the Power Platform admin center decide what Microsoft counts.
Three questions, answered next to D365.
Who can open it, and why?
Users with read or change access, the role, duty and privilege that grant it, roles limited to other legal entities, and a Deny on the page’s main table that blocks it even when the menu item is granted.
What can this person do?
Roles with their company scope, the pages they reach, the licence those pages need and which role drives it. Search any user or role from the panel.
What does this role really grant?
Sub-roles, duties, privileges and privileges assigned directly, compared with the standard role. Custom roles are explained too, once you import your security export.
Not a security administrator? The panel switches to My access: what you yourself can open on this page and which of your roles gives it, so you know what to ask for.
The whole tenant, on one page.
- Licence reviewThe licence each user’s pages need, and the one role that pushes a user to a higher licence: where a licence can be saved, user by user. Exported as a list for the licence conversation with your partner.
- Find the right rolePick the pages someone needs, or import a task recording, and get the existing roles that cover them with the lowest licence, or the smallest set of standard duties for a new role.
- Overview and hygieneSystem and security administrators, Entra apps running as admin, disabled users with roles, custom roles nobody has, roles with a Deny, external users.
- Segregation of duties14 starting rules (vendor master and payments, customer master and free text invoices, journals and bank reconciliation, …) checked on effective page access, so custom roles and directly assigned privileges are caught too.
- Snapshots and driftSave the security setup as a file, compare it with today or with another environment: roles, assignments and grants that changed. Optionally pseudonymised.
- ExportsCSV of every list, for the audit file or the access review.
- Custom security explainedImport the security configuration export from Data management, and your own roles and duties get the same role › duty › privilege paths as the standard ones.
- Built on the standardThe Security Atlas indexes the standard 10.0.49 security metadata: 271 roles, 2,976 duties, 20,706 privileges, with the View and Maintain licence of every menu item.
Live data decides, the Atlas explains. Who has access is always read from your environment; the standard metadata only explains the path. The licence figures are an estimate: User security governance and the Power Platform admin center remain authoritative.
The panel is free. The workspace is per person.
The side panel (this page, this user, this role, My access) costs nothing. The workspace, with the licence review, starts with a 5-day trial in the extension, with no credit card. One user moved to a lighter licence usually covers the yearly price.
per person per month, excl. VATper person per year, excl. VAT · save 17%
- The workspace: overview, licences, segregation of duties, find role, snapshots
- CSV exports
- Up to 2 browsers per person
- Cancel any time, from your customer portal
per year for 5 people, excl. VAT
- Everything in Individual
- One key for the team, 5 people, 2 browsers each
- About €100 per person per year
Larger teams or a purchase order? Annual invoice, your own terms of payment.
Ask for a quote →Before you ask.
Can Security X-ray change roles or assignments?
No. It only reads, through your own D365 session: read requests to the data entities, plus two D365 services that only answer questions (which pages you can open, which configuration keys are on). A check in the build fails if any code tries anything else. See Security.
What rights do I need?
To see other users, the rights to read the security entities, as a system or security administrator has. Without them, Security X-ray shows My access: your own access to the page you are on.
Does our security setup leave the browser?
No. Users, roles and permissions are read and analysed in your browser, and cached there for a few hours. Snapshots and exports are files you save yourself. Only the licence check of the paid workspace talks to our server, with your email, licence key and environment name.
We have custom roles and ISV solutions. Are they covered?
Who has access is read live, so custom roles count everywhere: on the page, in the licence review and in segregation of duties. To also see their duty and privilege paths, import the security configuration export from Data management; it is processed in the browser.
How much can we save on licences?
It depends on how your roles were built. The savings are usually in a few patterns: one power-user role given to a whole department, standard roles that grant more than the job needs, and change access where the user only needs to look. The licence review names, for each user, the role that pushes them up, so you can see which roles affect the most users and start there. Whether a user can really move down is a decision for you and the business: check that they keep the access they need.
Is the licence review exact?
It is an estimate from the standard licence of each page and the access each role grants. Use it to find where to look; User security governance and the Power Platform admin center decide what Microsoft counts.
How do the trial and the licence work?
The side panel needs no licence. For the workspace, start the 5-day trial in the extension with your work email, no credit card. After buying you receive a licence key by email; enter it under Settings in the extension. A licence works on up to two browsers per person and keeps working offline for up to 14 days.
Who sends the invoice?
Payments are handled by Link, Stripe’s merchant of record. Link sends the receipt and the invoice, charges VAT where it applies and handles reverse charge when you enter your VAT number. You manage the subscription in the customer portal.