https://mbs2.microsoft.com/Knowledgebase/KBDisplay.aspx?scid=kb;EN-US;2995611

Security Configuration
MDM requires multiple security settings to work correctly, ensure that the following user accounts have correct privileges.

AOS service account permission for Data Import/Export service
The AOS service account that runs import/export must be part of Data Import/Export Framework Users local group. If you get a security exception when validating DIXF, it is mostly likely that AOS user (usually Network Service) is not part of the group. Make sure that you add AOS user to the group in Computer Management. Restart AOS.

Verify: Open Data import/export framework > Setup > Data import/export framework parameters, and then click Validate.
If the connection is configured correctly, the box will turn green.

Grant the DIXF service account permission to the SQL Server Master Data Services web service and database

Master Data Services Web Application

The Data import/export service account must be configured to have function permissions in Master Data Services so that it can push and pull data and create schemas. To enable these permissions, perform the following procedure:
1. Open the Master Data Services web application.
2. Click Users and Group Permissions.
3. Add the DIXF service account user.
4. Select the DIXF service account user.
5. Click Functions.
6. Click Edit.
7. Assign the following functions:

• System Administration
• Version Management
• Integration Management
• Explorer

Best Practices: In a production environment with all entities configured, we recommend that you remove the functions from the service account, and instead assign specific model permissions for reading and writing data to models.

• Assign Update permissions for each model in environments in which you both pull and push data.
• Assign Read-only permissions for each model in environment in which you only pull data.

Verify: Log in with the DIXF service account on the local machine, and open the Master Data Services web application and verify that the user has access.

Master Data Services SQL Server database
Assign the following database roles to the DIXF service account in the Master Data Services database:

• MDM_Exec
• MDS_Exec
• DB_DataReader
• DB_DataWriter
• DB_DDLAdmin

Verify: Connect to the Master Data Services database using SQL Server Management Studio and the DIXF service account to validate database connectivity.

A hotfix has been issued for this problem. Please download it from the following locations.

Ax 2012: https://support.microsoft.com/hotfix/KBHotfix.aspx?kbnum=2957068
Ax 2012 R2: https://support.microsoft.com/hotfix/KBHotfix.aspx?kbnum=2957067

Note that the fix is already built into AX 2012 R3 and no seperate patch will be required for that version.

Thank you for your patience on this issue and let us know if there are any more questions or concerns.

• In a global deployment consisting multiple instances of AX, sharing master data like customer, vendors and products between all instances.
• Sharing master/reference data across two or more legal entities.
• Synchronizing product, and pricing information that originates from master instance to other shared instances.
• Sharing data with systems that do not implement Microsoft Dynamics AX, like CRM, pricing engine etc…
 
Starting with Microsoft Dynamics AX 2012 R3, we are happy to announce support for master data management feature. This builds on top of Data Import Export Framework (DIXF) that shipped in R2, and extends the concept of entities, transformation, and staging to enable configurable data synchronization capabilities. Some of the key capabilities supported with this release are
 
Capabilities
• Data synchronization across multiple instances of Microsoft Dynamics AX 2012 R3, or across multiple legal entities (or partitions) within the single instance.
• Five of the most requested entities ships ready for MDM – Customers, Vendors, Employees, Party, and Product.
• Ability to extend existing DIXF entities or add new entities through customization
• Configure selective synchronization of record set or field set by adding import or export filters
• Support single/multi-master record management scenarios
• Ability to centrally detect conflicts automatically and resolve manually.

This just a quick introduction of upcoming foundation feature in Microsoft Dynamics AX, I intend to publish further details in our blog post, so stay tuned. Also I am doing a session at Convergence 2014, if you are attending please do stop by.

This was identified as a bug and has been fixed in AX 2012 R2. Now each license signed by X509 certificate is generated with a timestamp. When customers import ISV license signed by certificate, we check validity to make sure certificate was valid during the time of creation only, rather than time of usage. This ensures license to be valid beyond time of certificate expiration. This code base was fixed in R2 only, for this to work both AXutil.exe and AOS service must be R2.

Here is how the new support for number sequences per operating unit type would work.

Step 1:
When configuring the segments, select the checkbox in the image below. If there are existing number sequences for organizations, you'll have to delete them

Step 2:
Create a new number sequence. Select the scope and the operating unit type. In this example, we have chosen Value Stream to be our operating unit type. Note that the operating unit type could be one of either the in-built operating unit types or any other custom operating unit type that you might have created.

In the above example, we reduced the alphanumeric size from 9 to 4 so that we don't exceed the total length of the number sequence string for operating units.
 
Step 3:
In the same form, add a reference to the organizations and also reduce the number allocation to match the alphanumeric length

Step 4:
Create a new operating unit. In this example, you’ll notice that a new operating unit of the type Value Stream is created. Its id, per the number sequences associated with it, is VS-001

Alternate method

A simpler way to generate default number sequences for each type of operating units would be to run the number sequence wizard. Running the Generate wizard will generate a number sequence of each operating unit type when launched with a standard template. The defaults include the following prefixes for each of the operating unit types. Department will start with “Dept”, Cost center with “CC” etc.

All in all, this should give customers and partners the flexibility to have number sequences set up per type of operating units rather than having a non-granular bulk number sequence covering all operating unit types.

These were made available in the following hotfix release: https://blogs.technet.com/b/dynamicsaxse/archive/2013/06/28/announcing-cumulative-update-6-for-microsoft-dynamics-ax-2012-r2.aspx 

Note: Number sequence values are still shared across operating units even if you configure them per operating unit type. for eg. if I had one number sequence for Cost centers and another for departments and both had the same format, say ###-###, then 123-456 can only be used in one and not the other. One way to get around this would be to use prefixes for your number sequence formats, similar to the way we do when we auto-generate number sequences.

• While XDS policies are a very powerful tool to meet your data security needs at all entry paths to the Server, do not expect to be able to secure every table in the system unless you’re willing to pay a big performance penalty. Strategically target the tables you want to protect.

• Reduce the number of joins you are adding to the query when applying the XDS policies. As you add more joins, the performance will degrade.

• One trick to reduce the number of joins is to use ‘MyConstructs’ in the policy query. They are temporary tables of type TempDB and are populated using a table method called XDS().  This method is available for developers to write X++ logic to populate the temporary table. After the temporary table is populated, subsequent policy queries will use the temporary table.

• In MyConstructs, you have the ability to refresh the data either PerSession or PerInvocation. Unless required otherwise, choose the per session caching for optimal performance

• Test the XDS policies for performance on a large volume of data before putting it to production use.

• XDS policies offer three levels of control. You can apply based on a particular security role, apply it to more than one security roles or on the basis of an application context that is secured by code or on metadata in the case of queries. You can use these knobs to fine tune and control when the XDS policy is applied

• Besides the three levels mentioned above, another knob is the operation. The XDS policy can be applied for a given operation. For eg. you might choose to filter when a select operation is done on a table, but perhaps not when the update is done. This is configurable in the XDS policy metadata. The choices of operation(s) for which the policy can be applied are Select, Insert, Update, Delete , (Insert, Update and Delete) or All operations

Detailed instructions on development and debugging of XDS can be found in a whitepaper that can be found her: https://www.microsoft.com/en-us/download/details.aspx?id=3110

XDS is a powerful mechanism that allows the ability to express and implement complex data security needs. Hopefully, some of these best practices and suggestions will help in your implementation of XDS policies. As always, feedback is welcome.

Security in AX 2009

Security in AX 2009 for a user starts with his or her membership in a user group. By adding a user to a group, you grant that user all the permissions assigned to that group. Domains enable you to restrict permissions to user groups to a single company, or to set up user groups that have permissions to data across companies. 

Furthermore, access of users to system elements (such as forms, menu items, and tables) is controlled using security keys. These settings are set by managing user group and domain combinations. Lastly, the security keys themselves can have child security keys. Ultimately, they control access to a securable object, set with an access level.

Security in AX 2012

Security in AX 2012 for a user starts with his or her being assigned one or more security roles. Security roles themselves contain duties, privileges and permissions. The permission is a combination of a securable object and an access level. Privileges contain a combination of an entry point and an access level. At runtime, the appropriate permission is picked up and given to the user.

Approach to security upgrade

Access to data within the system for an AX user flows through an entry point like a menu item. The algorithm essentially looks for entry points in the legacy system, looks at it access level and find privileges that map to the entry point and access level. The steps can be iteratively described with the following picture

 
 
 Here is a rule of thumb to follow: “If you find direct mapping between user group and “out of box” role that’s always better because the roles have been functionally tested”. If you cannot use out of the box security roles that AX 2012 ships with, you can map user groups to custom security roles that should have equivalent security settings compared to legacy systems.

The match process essentially works on the principle that for a given entry point in AX 2009, it will try to find a privilege in AX 2012 that contains the same entry point. The second level of matching is done for the access level. Based on whether the access level is exactly the same or varies slightly, the administrator running this tool would be asked to review a match or create new privilege. The following table explains all the cases with illustrative examples.

The Security Upgrade Advisor Tool is available from the InformationSource services download page. Documentation for the tool can be found at this link: https://technet.microsoft.com/en-us/library/hh394895.aspx

Note that this tool should work on both AX 4.0 and AX 2009 and also with AX 2012 and AX 2012 R2. Do try this tool out and give us your feedback.

1. Downloading and installing root certificates from the CA.
Each CA like VeriSign, GoDaddy, GeoTrust, etc… allows you to download their root certificate from their website. Simply go to your CA and download the root and install it in Certificates (MMC) -> Local Computer -> Trusted Root Certification Authorities folder. (See instruction below)

2. Installing ISV certificate with public key only (.cer extension) into trusted root.
Another approach is to take the ISV certificate with public key from the ISV, the same one that is used to sign the license file and install it in the Certificates (MMC) -> Local Computer -> Trusted Root Certification Authorities folder

Installing Certificates
1. Launch MMC.exe
2. Go to - File > Add/Remove Snap in
3. Certificates > Add
4. Select “Computer Account” from the form
5. Click Next & Finish
6. Click Local Computer > Trusted Root Certification Authorities > Certificates > Import
7. Follow the wizard to import the certificate.

 1. In the AOT, for a given table, set the AOSAuthorization property to CreateReadUpdateDelete (as shown below)

Note that there are other possible values for this property, but this is the only value for which field level TPF is activated.

 2. Save the changes to the table

 3. Create a new field or open an existing field. You’ll notice that the AOSAuthorization property becomes available and its value can now be set.

 A user accesses data from a table through the various privileges that he has. In a given table, certain fields may be marked such that the user does not have access to them. If such a table is TPF (with CreateReadUpdateDelete) and the AOSAuthorization property for a field is set to Yes, then the data from the fields is trimmed if the user does not have access
to that field. To be specific, if the field is set to Yes and user does not have access to that field then 

a) data will be trimmed when sending table buffer to client
b) any query that tries to filter data based on that field will be rejected

If the field is set to No, then no special processing is done for the field and no trimming is done on the field.