14 Jul 2023
Securing sensitive business data and critical operations is of utmost importance for businesses and service providers alike.
Dynamics 365 Finance and Operations stands as a prime target for attackers, since it holds critical business functions like finance, procurement, operations, and supply chain management, and houses sensitive data such as payments, orders, and supplier information. Microsoft Sentinel for Dynamics 365 Finance and Operations is Microsoft's answer: Sentinel is Microsoft's cloud-native SIEM (security information and event management) platform, and the Dynamics 365 F&O connector plugs your ERP's activity and audit logs directly into it.
In this guide, we'll cover how Microsoft Sentinel for Dynamics 365 monitors, detects threats, and responds to incidents in your F&O environment, including what's changed since this solution moved from preview to general availability.
Dynamics 365 Finance and Operations Security: Why It's a Target
Microsoft Dynamics 365 Finance and Operations is a robust ERP solution that offers a wide range of financial and operational capabilities. It serves as the backbone for critical business processes such as finance, procurement, operations, and supply chain management.
- Streamlined Operations: Combines financial and operational capabilities, enabling businesses to streamline workflows and automate tasks.
- Valuable Insights: Provides actionable insights into operational performance, enabling businesses to make informed decisions and drive growth.
- Critical Business Processes: Handles sensitive data such as payments, orders, and account receivables, making it an attractive target for cybercriminals.
Dynamics 365 F&O security also has to account for who's actually running the system day to day: these environments are typically administered by staff who aren't security specialists, accessed by a wide range of internal and external users, and integrated with numerous adjacent systems; all of which widens the attack surface beyond what a typical finance application faces.
Given its pivotal role and the sensitivity of the data it handles, securing Dynamics 365 Finance and Operations becomes essential. Breaches in these systems can lead to dire consequences, including customer data exposure, disruption of vital processes, revenue loss, and significant damage to reputation. This is where solutions like Microsoft Sentinel come into play.
Don’t Wait for a Security Incident to Expose the Gaps
Dynamics 365 F&O is too critical to your business to rely on reactive security. With the right monitoring strategy, your team can identify suspicious activity earlier and respond with greater confidence.
Addressing Security Risks with Microsoft Sentinel Solution
Dynamics 365 security monitoring has to solve for a specific gap: these business applications are often administered by non-security experts, accessed by a wide range of internal and external users, and integrated with numerous other systems — all of which makes effective, centralized monitoring hard to bolt on after the fact.
Leveraging the power of Microsoft Azure, Microsoft Sentinel security monitoring gives you the following essential capabilities for your Dynamics 365 F&O environment:
Dynamics 365 F&O Security Monitoring: Enhanced Visibility
Visibility into user activities and system actions is crucial for effective security. Dynamics 365 F&O security monitoring through Microsoft Sentinel gives you continuous visibility into user logins, sign-ins, and Create, Read, Update, and Delete (CRUD) operations. It goes beyond user actions to also track configuration changes and activity from external applications and APIs.
By having a comprehensive view of these activities, you can spot anomalies or potential security risks as they emerge, instead of finding them during a post-incident review.
Dynamics 365 Threat Detection: What Sentinel Actually Flags
Dynamics 365 threat detection through Sentinel works off built-in analytics rules tailored for F&O, using pattern matching and anomaly detection to catch specific, named behaviors rather than generic "suspicious activity." In the current GA release, common detection patterns include:
- Unauthorized access: suspicious logins, especially outside normal hours or from unexpected locations.
- Permission and SoD violations: illegitimate changes to user permissions, or actions that bypass segregation-of-duties policies.
- Data exfiltration: unusual volumes of data export or mass record access.
- Identity misuse: sign-ins using stale or overprivileged service accounts; a detection pattern shared across the broader Business Applications solution.
- Policy circumvention: configuration or control changes that weaken existing security policies.
You can also tailor or create your own analytics rules on top of these, rather than relying solely on the built-in set.
Incident investigation and response: Swift actions to mitigate security incidents
Timely and efficient response is crucial in the event of a security incident. With the Microsoft Sentinel Solution, you can effectively investigate and respond to such incidents.
If a security breach or suspicious activity is detected, the solution provides actionable insights and facilitates immediate response actions. This can include limiting user access, notifying relevant business administrators or security teams, and even rolling back unauthorized changes.
By enabling swift incident response, the solution helps mitigate the impact of security incidents and minimizes potential damage to your Dynamics 365 F&O environment.
Together, these elements of Microsoft Sentinel provide comprehensive security, ensuring the integrity of your critical business processes and safeguarding sensitive data in your Microsoft Dynamics 365 F&O environment.
Microsoft Sentinel Dynamics 365: What's Changed Since Preview
When this solution first launched, the Microsoft Sentinel solution for Dynamics 365 Finance and Operations was a standalone, public-preview offering. As of April 2025, it's been folded into the Microsoft Sentinel Solution for Microsoft Business Applications, now generally available in the Azure portal. This unified solution covers Dynamics 365 Finance and Operations, Dynamics 365 Customer Engagement, and Power Platform. It also includes Copilot Studio agents, apps, and flows. All of these are covered under one set of prebuilt detections and a single investigation experience. This eliminates the need for separate connectors and rule sets for each system.
For F&O environments specifically, this means the same visibility, threat detection, and incident response capabilities described below are now generally available and fully supported. They are no longer preview features. You can also extend the same monitoring to your Dynamics 365 CRM and Power Platform environments from the same Sentinel workspace.
Getting Started with Microsoft Sentinel: A Step-by-Step Guide
Here are the steps to follow to get started with the Microsoft Sentinel solution for Dynamics 365 Finance and Operations.
Step 1: Verify prerequisites
You must have Microsoft Dynamics 365 Finance version 10.0.33 or above to enable this solution. Then, ensure that you have enabled the Microsoft Sentinel solution, have a defined workspace, and administrative access to Dynamics 365 Finance and Operations. You should also be able to create an Azure Function App and Data Collection Rules/Endpoints with the required permissions.
Step 2: Collect the environment URL
Next, retrieve the URL of your Finance and Operations environment you want to monitor with Microsoft Sentinel, ensuring it meets the required version.
Step 3: Deploy the solution and enable the data connector
Once done, access Microsoft Sentinel through the Microsoft Defender portal. The Defender portal became the primary access point for Sentinel starting in July 2026. Search for the Microsoft Sentinel Solution for Business Applications, which includes the Dynamics 365 F&O connector. Install the solution and configure the data connector.
Step 4: Deploy the data connector
Navigate to your Sentinel workspace, select Data connectors, search for “Dynamics 365 F&O,” and open the connector page. Complete the necessary configuration steps.
Step 5: Configure the data connector
To configure the data connector, deploy the Azure Resource Manager (ARM) Template by following the installation wizard and providing the environment URL collected in Step 2.
Next, enable data collection by creating a role and user for data collection in Finance and Operations, registering the managed identity in Azure Active Directory, and enabling auditing on relevant data tables.
Step 6: Verify log ingestion
Lastly, confirm that logs are successfully ingested into Microsoft Sentinel by running activities on any of the tables enabled for monitoring and then querying the FinanceOperationsActivity_CL table.
Is Your Dynamics 365 F&O Environment Secure Enough?
Discover how Microsoft Sentinel can help you strengthen security visibility, detect suspicious activity, and respond to threats across your Dynamics 365 environment
Conclusion
Securing your Microsoft Dynamics 365 Finance and Operations environment is vital to protect your critical business processes and sensitive data. With Microsoft Sentinel for Dynamics 365 (now generally available as part of the unified Business Applications solution), you can proactively monitor, detect threats, and respond to incidents effectively. However, to fully capitalize on the benefits, it's crucial to implement the solution correctly, tailored to your specific requirements, objectives, and environment.
Schedule a personalized demo with our team of experts to begin your journey towards a more secure and resilient future with Microsoft Sentinel!
