Editar

Compartir a través de

Manage system access and security overview

  • Artículo

Applies to: Dynamics 365

This article describes the importance of managing system access and security when operating Dynamics 365 products.  

Managing system access and security in Dynamics 365 is paramount for organizations aiming to uphold operational integrity, protect sensitive data, and comply with regulatory requirements. Dynamics 365, as a cloud-based solution from Microsoft, offers robust tools and frameworks to ensure that system compliance aligns with legal, contractual, and corporate standards. This article delves into the critical aspects of managing system access and security within Dynamics 365, highlighting the roles and responsibilities of key stakeholders across the organization.

Ensuring the security of Dynamics 365 implementations is essential not only for safeguarding organizational data but also for maintaining trust with stakeholders. Define clear security policies, apply policies, and regularly audit user access and permissions to mitigate risks associated with data breaches and unauthorized access. Dynamics 365 operates within the Microsoft Trusted Cloud, emphasizing security, privacy, compliance, and transparency as foundational principles. This shared responsibility model between Microsoft and its customers ensures that both parties actively contribute to maintaining system integrity and data protection.

Effective management of system access and security within Dynamics 365 requires coordinated efforts from various stakeholders across the organization:

  • Executive leadership: CEOs, CFOs, and CIOs provide strategic oversight, aligning system security initiatives with broader organizational goals. Their guidance ensures that resources are allocated effectively and that security measures support business resilience.

  • IT management: Including CIOs, IT directors, and IT managers, this group plays a pivotal role in implementing technical security measures and integrating IT resources with overall organizational resilience strategies.

  • Data protection officers (DPOs) / privacy officers: With a focus on data privacy and protection, these stakeholders ensure that Dynamics 365 compliance measures align with relevant privacy laws. They manage data protection strategies, privacy impact assessments, and act as liaisons with data protection authorities.

  • Security officers / information security managers: Chief information security officers (CISOs) and information security managers are responsible for safeguarding systems and data against potential threats. They develop security policies, conduct risk assessments, and oversee incident response procedures.

  • Quality assurance (QA) and testing team: QA managers and test engineers validate security measures through rigorous testing of system functionalities and configurations. They identify and address compliance issues to ensure that Dynamics 365 implementations meet regulatory requirements.

  • Business process owners / functional leads: These stakeholders define the security requirements needed to execute business processes within Dynamics 365.

  • Internal auditors / audit committee: Internal auditors and audit committee members provide independent assurance on governance, risk management, and compliance. They assess the effectiveness of the security setup and recommend improvements.

Manage system access and security process flow

The following diagram illustrates the manage system compliance business process area.

Diagram of the Manage system access and security business process area, illustrating the connection between multiple business processes.

Manage system access and security flow

The diagram represents a sequence of steps in a process flow, starting from the top and moving downwards. It begins with a rectangular box labeled "Start," which leads to the first main step:

  1. Administer to operate - This is the initial action step after the start.

  2. Following this, there are 10 substeps, all part of managing system access and security:

    1. Review access policies: Review the security and access policies that were defined during the implementation to ensure that the existing policies are adequate, or make changes if needed.

    2. Onboard new users: Create new user accounts and assign them the appropriate permissions on an ongoing basis.

    3. Update user access: Update existing user access as needed to ensure daily activities can be completed.

    4. Revoke user access: Remove access from users when no longer required.

    5. Delete users: Remove user accounts that are no longer needed.

    6. Review audit logs: Review audit logs to ensure that security policies are being adhered to.

    7. Manage service accounts and certificates: Review permissions on service accounts to ensure that only necessary permissions are assigned, that credentials are still secure, and rotate certificates to prevent issues with expiry.

    8. Manage data security: Review data landscape to ensure that sensitive data can still only be accessed by necessary staff.

    9. Manage authentication: Review authentication methods and ensure that they're up to date with current system requirements.

    10. Manage Encryption

Additionally, there are arrows pointing outwards from the central process to various business processes listed on both sides of the diagram. On the left side, these include:

  • Acquire to dispose

  • Case to resolution

  • Concept to market

  • Design to resolution

  • Forecast to plan

  • Hire to retire

  • Inventory to deliver

And on the right side:

  • Order to cash

  • Plan to produce

  • Procure to pay

  • Project to profit

  • Prospect to quote

  • Record to report

  • Service to cash

These side processes are related to the central manage system compliance steps but aren't directly part of the sequential flow described. There are two large arrows circular displayed to indicate the process is iterative. All end to end business processes are displayed because managing system access and security is an integral part of all business processes.

Manage system access and security benefits

There are many key benefits that can be used to monitor and measure the success of implementing technology to support managing system compliance. The following sections outline the key benefits that an organization might monitor and measure for managing system compliance.

Enhanced data security and privacy

Dynamics 365 provides robust security features, including data encryption and access controls, ensuring that sensitive information is protected. This helps organizations comply with regulations such as GDPR and HIPAA, safeguarding customer data against breaches and unauthorized access.

Real-time monitoring and alerts

Dynamics 365 provides real-time monitoring and alerts for potential compliance issues, allowing organizations to address them promptly and reduce the likelihood of noncompliance and fines.

Comprehensive documentation and audit trails

Dynamics 365 maintains detailed records and audit trails of compliance-related activities, supporting audit readiness and transparency, and making it easier to demonstrate compliance with regulators and stakeholders.

Next steps

If you would like to implement Dynamics 365 solutions to assist with your manage system compliance business processes, you can use the following resources and steps to learn more (Links are added, when the articles are ready.)

  1. Define a business continuity plan

  2. Manage licensing and entitlements

  3. Administer system features

  4. Manage system access and security (the article you're currently reading)

  5. Train users and increase adoption

  6. Monitor systems, environments, and capacity

  7. Manage background jobs

  8. Manage notifications alerts

  9. Uptake software releases

  10. Manage data synchronization

  11. Manage system compliance

  12. Support systems

You can use the following resources to learn more about the manage system compliance process in Dynamics 365.

Contributors

This article is maintained by Microsoft. It was originally written by the following contributors.

Principal author:

Other contributors:

  • Harsh Birla | Principal Solutions Architect

  • Rachel Profitt | Principal Program Manager

  • [Pedro Ramalhinho](<https://www.linkedin.com/in/pedroramalhinho) | Senior Solutions Architect