Skip to the content

Managing authorizations: what you know but probably don't do (efficiently)

Managing authorizations 2-Control

For as long as organizations have been using information technology, the granting of access to an organization’s information (authorizations) has played an important role. After all, information is a very important asset for most companies. It is therefore important that someone has access to the correct information and that unauthorized persons do not have access to information that is used for the control and execution of the primary processes.

In addition to getting authorizations in order, it is at least as important to keep these authorizations in order. Organizations need to know whether the granted authorizations are correct and have a good up-to-date overview of the granted authorizations. By means of authorization management authorizations can be cancelled or granted (temporarily).

This is important when you are saying goodbye to employees, in case of (maternity) leave or in case of job changes. By keeping the authorizations in order, you prevent fraud and errors and handing work over to a colleague becomes easier. It is therefore very important that the authorizations are set up in a clear and manageable manner in order to prevent errors in authorization management.

But when are authorizations set up in a clear and manageable manner?

Points of attention for setting up authorization management

Authorization management enables the verifiability of authorizations and the execution of these controls and therefore deserves attention. The following issues are important for the set-up of authorization management:

  • Clear working instructions. These must contain all the activities that apply to the management of authorizations.
  • Clear and consistent naming of permission sets and user groups or organization roles. Can someone who has no knowledge of authorizations understand what you want to achieve with the setup?
    • The naming must be comprehensible so that risk of errors is limited.
    • Use as many terms as possible that appear in the interface: this provides recognition.
    • Use function names as a name for user groups or organization roles.
  • No mixing or misusing the set-up to achieve a different purpose than that for which it is intended.
  • One person should be responsible for the management of authorizations.
  • Authorization management procedures should be the same for all Dynamics companies to avoid confusion.
  • Include authorizations in the change management for Dynamics NAV: when installing new objects, authorizations often have to be modified as well.
  • Test authorization set-up twice: yourself and a (key) user. The goal must be to remove as many errors as possible beforehand.
  • Record error messages in a ticket system including screenshots of the entire screen, user and what the user is trying to achieve. This is not always clear.
  • Log changes in the set-up as much as possible in tickets. Often a remark can be made at the setup, refer to the relevant ticket.
  • Documentation on the authorization structure must be complete and up-to-date.

Autorization request procedure

Requests for changes or new authorizations must follow a procedure. This is important in order to prevent the authorization structure from becoming cloudy and thus to avoid errors or unpleasant consequences. The authorization management procedure should contain at least the following points:

  • Authorization requests must be approved by at least one approver who is authorized to do so. Think of the CFO or the person in charge within controlling or HR department.
  • It should not be possible for users to approve their own requests. The responsibility for approving authorization requests should lie with a single responsible party.
  • Authorization requests must be archived or logged. It must be possible to track any changes to user authorizations.
  • Comments on authorization requests should also be archived or logged.
  • An authorization request does not have to be approved immediately. A note from the person responsible for approval is then required in order to justify the change at a later moment.
  • Authorizations that are temporarily granted to an existing user profile must be requested in advance with an end date. This prevents temporary rights from becoming permanent.
  • This also applies to authorizations granted to temporary employees. Holiday or interim employees are some examples of users who need permission sets with an end date.

Organigram Authorization Box

Autorization changes in Dynamics

When making changes to authorizations, it is important to take into account the impact that changes have on existing permission sets. Make sure that the procedure includes the following:

  • It is important to check the changes to the authorizations in order to be able to see whether the rights that are granted give users access to critical tables.
  • Authorization changes should be checked for segregation of duties. Due to changes, the segregation of duties within Dynamics may be compromised.
  • Major modifications of the authorizations should be tested on a test or acceptance environment if possible. This prevents that authorizations on a production environment can have negative consequences.

Employees who are allowed to approve authorization requests must be aware of the content of the authorizations. The officer must act in accordance with the authorization matrix set up and must ensure that the structure is clear, understandable and easy to 

Do you want more tips for authorizations in Dynamics? Request them here.

Efficient autorization management

Due to an increasingly complex application landscape, mergers and business requirements with regard to IT, it is a constant challenge for organizations to get and keep authorizations in order.

Professional management of authorizations in Dynamics NAV / Dynamics 365 Business Central will claim a large part of the work week from the person in charge.

We can solve this for you with Authorization Box. In this application authorizations can be assigned as well as managed. With the help of a visual organizational chart, management is quick and 

Assigning, modifying and analyzing is flexible and simple. Curious? Watch the video below and otherwise contact one of our authorization specialists.



Contact

Do you have a question? Get in touch with one of our IT audit professionals. We are pleased to help you.