Lab - Work with security

30 minutes

Read this first - before you start the lab!

Important

For this lab, you CAN'T sign in with your own credentials. Use the following steps to sign in to your lab environment with the correct credentials.

Ensure that you're signed in to Microsoft Learn.
Select Launch VM mode or Sign in to launch VM mode in this unit.
In the Resources tab on the lab side bar, select the T icon next to Password in the Finance and Operations box, to have the administrator password for the Virtual Machine (VM) entered for you.
Select Enter.
Microsoft Edge opens. Wait for it to navigate to the Sign in page for finance and operations. If you experience an issue with the Sign in page loading, try to restart the browser in the VM.
On the Microsoft Sign in page in finance and operations, place your mouse cursor into the Username field.
On the Resources tab of the lab side bar, below the Azure portal heading, select the T icon next to Username, then press Enter.
Your mouse cursor is now in the Password page.
On the Resources tab of the lab side bar, below the Azure portal heading, select the T icon next to select Password, then press Enter.
In the Save password window, select Never.
Select Accept in the Permissions requested page.
To see the lab instructions, select the Instructions tab on the lab side bar.

You can now begin your work on this lab.

Scenario - Create a new user and assign a security role

The HR department of company USMF has requested access to finance and operations apps for a new hired employee as an accounts payable clerk.

You must create a new user ID for the new hired employee and assign the default the company to USMF and associate the accounts payable clerk role.

Go to System administration > Users > Users.
Select New.
In the User ID field, enter a unique identifier for the user. A user ID is required.
In the User name field, enter John.
In the Company field, select the drop-down button to open the lookup.
In the list, select USMF.
In the Email field, enter "john@contoso.com".
Select Assign roles in the User's roles section.
In the list, find and select Accounts payable clerk.
Select OK.
Select Save.

Scenario - Import users in bulk as a batch job

The HR department of company USMF is hiring new employees for different roles in the next few weeks. The active directory user accounts will be created as part of onboarding process. You must import many users from Microsoft Entra ID into finance and operations apps.

Go to System administration > Users > Users.
Select Batch import.
Expand the Run in the background section.
Select Yes in the Batch processing field.
In the Task description field, type a value.
In the Batch group field, enter or select a value, such as 'DOMBatch'.
Select Yes in the Private field.
Select Yes in the Critical Job field.
In the Monitoring category field, select an option, such as 'Integration'.
Select OK.
After the batch job is completed, all new users from active directory will be imported in finance and operations apps.
Close the page.

Scenario - Assign users to security roles dynamically

The HR department of USMF has requested to dynamically assign users to the Accounting supervisor role based on a criterion defined by HR department. Associate the Accounting supervisor role based on the rule defined by the HR department to the selected employees.

Go to System administration > Security > Assign users to roles.
In the tree, select Accounting supervisor.
Select Add rule to open the drop dialog.
In the list, find and select the wanted query rule, such as 'FMDynamicRoleAssignmentWorkerTitle'.
In the list, select the link in the selected row.
Select Edit query. You can change the query as you desire.
Select OK.
Close the page.

Scenario - Exclude users from a role assignment

The HR department of USMF has requested to remove access for the Accounts receivable clerk role in finance and operations apps for an employee who has changed role.

Go to System administration > Security > Assign users to roles.
In the tree, select Accounts receivable clerk.
Select Manually assign / exclude users.
In the list, select a user.
Select Exclude from role to exclude the selected users from the role.
To remove exclusions, select the users that you want to remove exclusions for, and then select Reset status.
Close the page.

Scenario - Set up segregation of duties

The HR department of USMF has requested a rule for segregation of duties for the Access benefits workspace, and the Approve production journal. You must create the rule in finance and operations apps.

Complete the following procedure to create a rule. You must be a system administrator to complete the procedure. The demo data company used to create this procedure is DAT.

Switch to companyDAT in the top right corner of the page.
Go to System administration > Security > Segregation of duties > Segregation of duties rules.
Select New.
In the Name field, enter a name for the rule.
In the First duty field, select the drop-down button to open the lookup.
In the list, find and select the first duty that is controlled by the rule, Access benefits workspace.
In the Second duty field, select the drop-down button to open the lookup.
In the list, find and select the second duty that is controlled by the rule, Approve production journal.
In the Severity field, select the severity of the risk that occurs when the same user or role performs both duties.
In the Security risk field, enter a description of the security risk.
In the Security mitigation field, enter a description of the actions that you take to mitigate the security risk. For example, you can mitigate the risk by conducting more detailed reviews of the process, by conducting a monthly managerial review, or by sharing resources with other departments.
Select Save.
Close the page.

Close the lab environment

Select Done in the Instructions pane in the lab side bar.
In the Lab is complete window, select Continue, and then select Leave to return to the next unit in the module.