Microsoft Dynamics 365 Finance and Operations: Access
Developer series · Episode 2
Microsoft Dynamics 365 Finance & Operations: Prepare Identity, Subscription, and Access
Episode 1 covered the types of development environments. This time, we check the identity, subscription, and access you need before creating an Azure development VM, step by step.
Key points
- One sign-in account, but access is checked separately in Entra, Azure, and Dynamics 365.
- An Azure subscription is where costs are billed. Agree on a cost owner and budget alerts first.
- Azure access is a role (what) plus a scope (where).
- Access areas
- LCS sign-in
- Tenant and account
- Subscription and cost
- Access check
- Checklist
01Sign-in identity and service-specific access
Image description and source
One account, three separate access checks: Entra administration, Azure resources, and Dynamics 365 app roles. It is not a connection sequence.
Source: Microsoft Learn
- Entra roles manage company users and apps.
- Azure roles create and manage resources such as subscriptions and VMs.
- Dynamics 365 security roles open app pages and business functions.
· Tenant: the Microsoft space where an organization manages its user accounts and apps
· Microsoft Entra ID: the service that manages accounts and sign-in for a tenant (formerly Azure AD)
· Security role: a set of Dynamics 365 permissions that controls which pages and actions a user can use
02Sign in to LCS or PPAC
Image description and source
LCS manages development VMs and VHDs for existing projects. PPAC manages unified environments, licenses, and capacity. The windows are explanatory sketches, not portal screenshots.
Source: Microsoft Learn
- LCS manages development VMs and VHD files for existing projects.
- PPAC manages unified developer environments (UDE), licenses, and capacity.
- You only need the portal for the route you will use.
· LCS (Lifecycle Services): Microsoft's web portal for Dynamics 365 projects and environments
· PPAC (Power Platform admin center): the newer admin center for Dynamics 365 and Power Platform environments
· UDE (unified developer environment): a setup that connects Visual Studio on your PC to a cloud development environment
· VHD: a virtual machine's hard disk stored as a single file
LCS sign-in in seven steps (real screens)
Real screens from September 2024, with the account address, sign-in number, and profile picture hidden. Korean screen text replaced with English. Since February 16, 2026, new customers can't create LCS projects, so use this when you already have one.
Sign-in order ① Open LCS → ② Account → ③ Password → ④ Two-step approval → ⑤ Stay signed in → ⑥ Home (personal) → ⑦ Home (project account)
Go to lcs.dynamics.com and select Sign in.
Enter your organizational account (Microsoft Entra ID) and select Next.
Type your password and select Sign in.
Enter the number shown on screen in the Microsoft Authenticator app on your phone.
Choose Yes on a PC only you use, and No on a shared PC.
Because it is not a company account, only Preview feature management and Shared asset library appear.
More tiles appear, such as Organization users, Subscriptions Available, and Solution management.
Real JGS screenshots · September 2024 · Personal details hidden · Korean screen text replaced with English · Select an image to enlarge
Key point · The same LCS shows different tiles depending on the account (two in ⑥, eight in ⑦). After signing in, check that your project appears.
· Two-step verification: a sign-in that asks for a second approval in a phone app (Microsoft Authenticator) after the password
03Check the existing tenant and development account
- Consider a new tenant only when separation is required and you are eligible and permitted to create one.
- Not every developer needs Global Administrator or Owner.
Image description and source
Microsoft documentation example with Overview and Create highlighted. Check the existing tenant first and consider Create only when needed.
Source: Microsoft Learn
· Global Administrator: the top admin role that can change every setting in a tenant
· Owner: an Azure role that can create resources and also change other people's access
04Agree on the development subscription and cost monitoring
From Azure services you can go straight to Subscriptions, Cost Management, Cost Management + Billing, Resource groups, and Microsoft Entra ID. Recent items show the D365 subscription and resource group used for development.
Real JGS screenshot · September 2024 · Korean screen text replaced with English · Select the image to enlarge
Billing access and resource access are separate. Name a cost owner.
Caution · Budget alerts only notify you. Reaching the amount does not stop usage automatically.
· Subscription: the unit Azure bills against. VMs and disks are created inside it.
· Resource group: a folder that keeps related Azure resources (VMs, disks, networks) together
05Check your Azure access in IAM
Azure access combines a role (what) with a scope (where). A role on the development subscription does not carry over to another subscription.
Image description and source
Microsoft documentation example showing Access control (IAM), Check access, and View my access. No live access check or role assignment was performed.
Source: Microsoft Learn
If something is missing, ask an administrator with the task, scope, and duration.
· RBAC (role-based access control): Azure's way of granting access through roles and scopes
· IAM (Access control): the Azure menu where you check and change who has which access
· PIM (Privileged Identity Management): a Microsoft Entra feature that turns on admin roles only when needed
06Checklist before VM deployment
- □ Tenant and development account
- □ Azure subscription and its tenant
- □ Azure roles and scopes for each task
- □ Cost owner and budget alerts
- □ Dynamics 365 users and security roles
This is for an Azure development VM. Local VHD and UDE have their own prerequisites.
Documentation checked on October 17, 2026. This preparation article is based on documentation. No account creation, access change, VM deployment, or D365 execution was performed.
Source documents · Microsoft Learn
- Quickstart: Create a new tenant in Microsoft Entra ID
- How to create, invite, and delete users
- Azure roles, Microsoft Entra roles, and classic subscription administrator roles
- Quickstart: Check access for a user to a single Azure resource
- Billing accounts and scopes in the Azure portal
- Understand Microsoft Customer Agreement administrative roles in Azure
- Tutorial: Create and manage budgets
- Create new users
- Role-based security
- Overview of unified admin experience
- Lifecycle Services project creation freeze
- Deploy and access development environments
- Provision an environment with an ERP-based template
- Get subscription and tenant IDs in the Azure portal
The JGS Consulting team has been part of the journey from Dynamics AX 2009 and AX 2012 to Dynamics 365 Finance & Operations. Our team includes finance, costing, and tax specialists, the foundation of any ERP. We also handle logistics, manufacturing, and distribution systems as one team, from process design to development and operations, with expertise in system and development architecture. We continue our development series on the Microsoft ERP system.
Comments
Post a Comment