We’re having a persistent issue where users cannot access the asset management module even though they’re correctly assigned to the appropriate Azure AD security groups. The role mapping appears to be configured properly in D365, but users keep getting access denied errors when trying to view or manage assets.
Our Azure AD groups are synced with D365 security roles, and we’ve verified that the Asset Manager role is properly mapped to our AD group. Other modules work fine for these same users - they can access inventory and procurement without issues. It’s specifically the asset management functionality that’s blocked.
We’ve tried removing and re-adding users to the groups, and even recreated the role mapping, but the problem persists. The security role configuration shows all the necessary privileges for asset tracking and lifecycle management. Has anyone experienced similar role assignment or permission sync issues with asset management?
I’ve solved this exact issue multiple times, and it’s almost always a combination of three factors that need to be addressed together.
Azure AD Role Mapping:
The mapping between Azure AD groups and D365 security roles needs to be bidirectional and explicit for asset management. Go to System Administration > Security > Map roles to Azure AD groups. Verify that:
Your Azure AD group ObjectID is correctly entered (not the display name)
The Asset Manager role is explicitly selected in the mapping
The mapping is set to “Automatic” assignment mode
Save and then trigger a manual sync using “Synchronize all user information”
Permission Sync Issues:
Asset management has a known quirk where role assignments don’t immediately grant access due to cached security contexts. After confirming role assignment, you need to:
Have affected users completely sign out of D365 (close all browser tabs)
Clear browser cache and cookies for the D365 domain
Run the security sync batch job: System Administration > Periodic tasks > Security > Update security
Wait 10-15 minutes for the security cache to refresh
Users should then sign back in
The Update security batch job is critical - it rebuilds the security privilege cache that asset management relies on. Without running this, the role assignment exists but isn’t active in the security context.
Security Role Configuration:
Asset management requires not just the Asset Manager role but also proper configuration of data security policies. Navigate to:
System Administration > Security > Security configuration
Expand “Asset management” node
Verify these privileges are enabled: AssetTable (View/Maintain), AssetBook (View/Maintain), AssetGroup (View), AssetLocation (View)
Check that no restrictive duty segregation rules are blocking access
Ensure the role includes the “Asset management user” duty
The most common root cause is that while Azure AD sync assigns the role, the security privilege cache isn’t updated. Running the Update security batch job manually forces D365 to rebuild all security contexts and typically resolves the access denied errors immediately. After implementing these steps, test with one user first before rolling out to the entire group.
This draft is based on general Microsoft Dynamics 365 knowledge. It has not been verified against your specific version and environment. Practitioners: verify the steps and share your experience below.
This sounds like a permission sync timing issue. Azure AD group membership changes can take up to 24 hours to fully propagate to Dynamics 365, especially if you’re using incremental sync. Have you checked the actual security role assignments in D365 directly (not just the AD group)? Sometimes the mapping exists but the sync job hasn’t run to apply it to individual users.
We’ve waited well beyond 24 hours and the issue persists. When I check individual user records in D365, I can see the Asset Manager role is listed under their security roles, but they still can’t access asset management features. It’s strange because the role appears to be assigned correctly in the system.
I’ve encountered this before. The problem might be that asset management has additional data security policies beyond basic role assignment. Check if there are any organization-level or legal entity restrictions configured for the asset management module. Users might have the role but be restricted at the data access level. Also verify that the users have access to the specific legal entities where assets are registered.
Have you checked the Azure AD provisioning logs? Sometimes the sync fails silently for specific modules due to attribute mapping issues. Asset management requires certain user attributes to be present for role assignment to work properly. Look for any provisioning errors or warnings related to these users in your Azure AD enterprise application logs.
Another thing to check - are you using custom security roles or out-of-the-box roles? If custom, make sure all the necessary privileges for asset management are included. Sometimes when roles are cloned or customized, certain privileges get missed. The Asset Manager role needs specific privileges like AssetTable view/maintain, AssetBook access, and AssetTrans permissions. One missing privilege can cause access denied errors even though the role is assigned.
Confirmed this resolves the issue — verifying the Azure AD group ObjectID rather than display name in the D365 security role mapping was the critical fix.