What’s Changing?

Until now, Microsoft operated on an “honor system” for D365 F&O licensing. While customers were technically required to license users based on role, there was no technical enforcement. That ends November 1.

The rollout consists of two phases:

• September 1, 2025 – Soft Block:
  Users without proper licenses will see in-app warnings, and admins will have access to enhanced license usage reports via the Power Platform Admin Center.
• November 1, 2025 – Hard Block:
  Any unlicensed users will be locked out of Dynamics 365 F&O. No access to financials, procurement, inventory, HR, or supply chain functions.

Who’s Affected?

All customers using Dynamics 365 F&O and related modules:

• Dynamics 365 Finance & Finance Premium
• Supply Chain Management & SCM Premium
• Commerce
• Human Resources
• Project Operations

If a user has multiple security roles tied to multiple modules, each license must be assigned accordingly (e.g. Finance Base + SCM Attach).

External/guest users not active in production are generally excluded but double-check Microsoft’s definition of external access.

What Happens If You Don’t Act?

Here’s what we’re seeing:

• Access Disruption: Users without licenses will be blocked from November 1. They risk month-end close, delayed shipments, payroll issues, and more.
• Unexpected Costs: Misconfigured security roles can trigger the need for thousands of additional licenses. These must be bought urgently or risk non-compliance.
• Audit Risk: Microsoft may backdate charges or enforce penalties during renewals (EA or CSP).
• IT Overload: In-app warnings will flood your support team unless your license setup is fixed in advance.

How to Check If You’re Compliant

Here are the immediate steps your team should take:

1. Run a License Self-Assessment

Go to:

• Power Platform Admin Center → Billing → Licenses → Finance & Operations

Here, you’ll find dashboards showing:

• Licensed vs. unlicensed users
• Required license SKUs based on role
• Exportable data for deep dives

⚠️ These reports are known to have discrepancies. Don’t assume they’re 100% accurate.

2. Review Security Role Assignments

Licensing is enforced based on security roles, not just user count.

If your user holds multiple roles (e.g. Finance + SCM + HR), they may need:

• A Finance Base license
• SCM and HR Attach licenses

Licensing logic is privilege-based. Even “read-only” roles can trigger a full license requirement due to hidden permissions.

3. Update to the latest version of the F&O environment

This new update includes additional reporting options through the Microsoft Security Governance functionality. These new reports look very promising to check your license requirements. We’re currently working through these reports for some customers and we are accessing additional insights like active usage.

How to Prepare Before It’s Too Late

With just a few months to go, we recommend:

• Run a full license-to-role audit — including custom roles
• Clean up unused or outdated security assignments
• Estimate license needs and adjust budget if needed
• Use Microsoft tools (PPAC, LCS, User Security Governance)
• Consider a partner assessment for clarity and cleanup

What’s Still Unclear?

Even with updated guidance, some questions remain:

• Will Team Members and Operations Activity licenses be blocked the same way as Full Users?
• How will enforcement handle device-based roles (e.g. scanners)?
• Are sandbox/test environments subject to the same enforcement? This doesn’t seem likely, but the licensing document states you need to have sufficient licenses for your sandbox environments.

Microsoft has indicated production environments are first, but we expect non-production environments to follow.

Why License Misalignment Happens

Many customers are under-licensed because:

• There was no enforcement previously
• Role design was done pre-split (before Finance/SCM were separate SKUs)
• Use of custom roles where you are unsure what the underlying licensing requirements are
• Reporting tools were inconsistent or unreliable
• Roles evolved over time without license review

Now, Microsoft’s shift toward privilege-based licensing and active enforcement means you can’t rely on legacy setup or Dynamics AX practices.