Daily Defender News
Aboutmerill.net
Microsoft Sentinel
Architecture and deployment

Deploy for Dynamics 365 Finance and Operations

4 September 2026Doc update+27 / −32 lines

In brief

The article’s wording, formatting, and deployment step descriptions were updated, and the publication date and metadata were revised. The documented prerequisite remains Dynamics 365 Finance version 10.0.33 or later.

What Defender admins need to know

Administrators can use the clearer instructions when deploying the Microsoft Sentinel solution; no action is required.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

Deploy for Dynamics 365 Finance and Operations

This article describesshows how to deploy the Dynamics 365 Finance and Operations content withinin the Microsoft Sentinel solution for Microsoft Business Applications. The solution monitorshelps monitor and protectsprotect your Dynamics 365 Finance and Operations system:system. It collects auditsaudit and activity logs from the Dynamics 365 Finance and Operations environment, and detects threats,threats and suspicious activities, illegitimate activities, and more.actions. For more details, see the Dynamics 365 Finance and Operations solution overview.

Before you start, make sure you meetreview the prerequisites, including. You need a configured Microsoft Sentinel workspace and Dynamics 365 Finance version 10.0.33 or above.later.

Prerequisites

Before you begin, verify that:

  • The Microsoft Sentinel solution for Microsoft Business Applications solution is enabled.

  • You have a defined Microsoft Sentinel workspace and have read and write permissions to the workspace.

  • Microsoft Dynamics 365 Finance version 10.0.33 or above is enabled and you have administrative access to the monitored environments.

  • You can create Data Collection Rules/Endpoints with the permissions:

    • Microsoft.Insights/DataCollectionEndpoints, and Microsoft.Insights/DataCollectionRules

Collect the environment URL from your Finance and Operations cloud environment

To find and confirm the environment URL and version information for your Finance and Operations environment, complete the followingfollow these steps:

  1. Open your Dynamics 365 project in Microsoft Dynamics Lifecycle Services (LCS) and select the specific Finance and Operations environment you want to monitor with Microsoft Sentinel.

  2. In the Environment version information section, make sure that you're using application release version 10.0.33 or above.

    :::image type="content" source="media/deploy-dynamics-365-finance-operations-solution/environment-version-information.png" alt-text="Screenshot of the Finance and Operations environment version information." lightbox="media/deploy-dynamics-365-finance-operations-solution/environment-version-information.png":::

  3. To collect your environment URL, select Log on to environment and save the URL in the browser to use in the Deploy the data connector step. For example:step; for example, https://sentineldevc055b257489f70f5devaos.axcloud.dynamics.com. 

:::image type="content" source="media/deploy-dynamics-365-finance-operations-solution/environment-details-new.png" alt-text="Screenshot of the Finance and Operations environment details.":::

Deploy the solution and enable the data connector

To install the Microsoft Business Applications solution from Content hub, follow these steps:

  1. Go to the Microsoft Sentinel service.

  2. Select Content hub. In the search bar, search for Microsoft Business Applications.

  3. Select Microsoft Business Applications.

  4. Select Install.

    For more information about how to manage the solution components, see Discover and deploy out-of-the-box content.

Deploy the data connector

After installing the solution, use the following steps to open the Dynamics 365 Finance and Operations data connector:

  1. Once the solution deployment is complete, return to your Sentinel workspace and select Data connectors.

  2. In the search bar, type Dynamics 365, and select Dynamics 365 Finance and Operations.

  3. Select Open connector page.

Configure the data connector

To enable data collection, you create a new role in Finance and Operations with permissions to view the Database Log entity. The role is then assigned to a dedicated Finance and Operations user, mapped to the Microsoft Entra client ID of an app registration.

  1. Store the client secret in a secure location for use in the next steps.

Create a role for data collection in Finance and Operations

  1. In the Finance and Operations portal, navigate to Workspaces > System administration, and select Security Configuration.

  2. Select the new role from the list of roles, and select Privileges > Add references.

  3. Select Database log Entity View from the list of privileges.

  4. Select Unpublished objects, and select Publish all to publish the role.

Create a user for data collection in Finance and Operations

  1. In the Finance and Operations portal, navigate to Modules > System administration, and select Users.

  2. Create a new user and assign the role you created in the Create a role for data collection in Finance and Operations step to the user.

Register the app registration in Finance and Operations

  1. Create a new entry in the table:

Enable auditing on the relevant Dynamics 365 Finance and Operations data tables

|Bank | BankAccountTable | |Not specified | SysAADClientTable |

Enable auditing on tables using the Database log setup wizard in the Finance and Operations portal.

  • In the Tables and fields page, you might want to select the Show table names checkbox to make it easier to find your tables.
  • To enable auditing of all fields in the selected tables, in the Types of change page, select all four check boxes for any relevant table names with empty field labels. Sort the table list by the Field label column in ascending order (A-Z).

For more information, see Set up database logging.

Enable data collection in the connector

  1. Run activities (create, update, delete) on any of the tables you enabled for monitoring in Enable auditing on the relevant Dynamics 365 Finance and Operations data tables.

  2. Wait up to 15 minutes for Microsoft Sentinel to ingest the logs to the logs table in the workspace.

  3. Query the FinanceOperationsActivity_CL table in the Microsoft Sentinel workspace under Logs.

  4. Check that the table shows new logs that reflect the activities you executed in step 1 of this procedure.

    :::image type="content" source="media/deploy-dynamics-365-finance-operations-solution/query-finance-operations-table.png" alt-text="Screenshot of viewing a new Finance and Operations incident in Microsoft Sentinel.":::

Related content

In this article, you learned how to deploy Dynamics 365 Finance and Operations features included in the Microsoft Sentinel solution for Microsoft Business Applications.