Microsoft Entra ID

Microsoft Entra ID is Microsoft's cloud identity service — the rebrand of Azure Active Directory (Azure AD) announced in 2023. Every Dynamics 365 user signs in through Entra ID, regardless of which Dynamics 365 product they use. Entra also authenticates service-to-service API calls between integrations and Dynamics 365 via app registrations with delegated or application permissions. Tenant-level identity policies — MFA, Conditional Access (block risky sign-ins, restrict by location, require compliant devices), and named locations — apply automatically to Dynamics 365 access. Modern Dynamics 365 security relies on Entra; protecting Entra is protecting the platform.

In practice, this means Dynamics 365's own security model (Dataverse security roles, Business Central permission sets) only ever governs what a signed-in user can do — it assumes Entra has already answered whether this is really who they say they are, and a weak Entra posture (no MFA, no Conditional Access) undermines even a perfectly-designed Dataverse security model, because a compromised credential simply walks through the front door. This is why a security review of a Dynamics 365 estate has to start at the tenant's Entra configuration, not at the app's own role assignments.

Where confusion arises: an app registration used for a service-to-service integration is a separate identity from any human user, with its own permissions and its own credential (a client secret or certificate) to rotate — a common and costly mistake is granting an integration's app registration broader Dataverse or Business Central access than the specific integration actually needs, on the theory that it's "just a service account" and therefore lower-risk, when in fact an over-permissioned service identity with a long-lived secret is often the softer target, not a safer one.