Last Updated: October 2026

Most fraud inside an accounting system needs one thing: a user with more access than the job requires and nobody watching what that user does with it. Dynamics GP security roles control who can create vendors, change vendor bank details, post payments, and edit setup in Microsoft Dynamics GP. To prevent fraud, give each user only the roles their job needs, keep vendor maintenance separate from payment processing, take POWERUSER out of daily use, and review user access every quarter.

Here’s the thing: at many companies, nobody has reviewed GP security since go-live. Access gets added in a hurry, copied from user to user, and never removed. This post covers the duties to separate, the built-in controls that add a second set of eyes, and a five-step access review.

Key Takeaways

  • Dynamics GP security roles group security tasks and are assigned per user, per company.
  • Keep vendor setup and EFT bank details separate from payment processing.
  • POWERUSER bypasses GP security and does not appear on standard security reports, so keep it out of daily use.
  • Approval workflows, Activity Tracking, and batch approval add oversight with no add-ons.
  • Run a Dynamics GP user access review every quarter and whenever someone is hired, changes jobs, or leaves.

What Are Dynamics GP Security Roles?

Dynamics GP security roles are named groups of security tasks that define which windows, reports, and files a user can open in a specific company. Microsoft’s Dynamics GP Security Planning guide describes three layers, all set up under Microsoft Dynamics GP >> Tools >> Setup >> System:

  • Security tasks grant access to specific windows, reports, and files, such as Vendor Maintenance.
  • Security roles bundle the tasks that match a job, such as AP clerk or payroll manager.
  • User security assigns one or more roles to a user, one company at a time.

Since GP 10.0, a new user can open nothing until roles are assigned, as CAL explained in two common questions about Dynamics GP security. Security is also company-specific, per Microsoft’s role-based security FAQ. A user locked down in your live company can still be wide open in a test company.

 

 

 

 

 

 

 

 

Why Do Dynamics GP Security Roles Matter for Fraud Prevention?

User access controls matter because most internal fraud depends on one person who can both record a transaction and release the money. The Association of Certified Fraud Examiners’ Occupational Fraud 2024: A Report to the Nations found that a lack of internal controls contributed to 32% of frauds and an override of existing controls contributed to another 19%.

Data reveals where the money goes. Billing schemes appeared in 22% of cases (median loss $100,000) and check and payment tampering in 11% (median loss $155,000). Both run through accounts payable, which is where Dynamics GP user access does the most work.

Which Duties Should You Separate in Dynamics GP?

Segregation of duties in Dynamics GP means no single user can complete a financial transaction from start to finish alone. The table below lists five duty pairs that should belong to different people, the risk each pair creates, and the GP control that covers the gap when a small team cannot split them.

 

 

 

 

 

 

 

Look, if one AP clerk can change a vendor’s routing number on Tuesday and run the EFT batch on Wednesday, your controls depend entirely on that one person. When a small team cannot split a pair, turn on the control in the right column and have someone outside the process review it.

Where Do Dynamics GP Security Gaps Usually Hide?

Security gaps in Dynamics GP usually build up after go-live. Four show up again and again:

  • POWERUSER in daily use. POWERUSER bypasses GP application security, and its users do not appear on standard security reports. Microsoft MVP David Musgrave notes on the Dynamics Community forum that it should never be used day to day because it cannot be audited.
  • Default roles that bundle too much. Some out-of-the-box roles (the ones ending in an asterisk) grant more than their names suggest. The Microsoft GP team recommends creating custom roles and tasks rather than editing the defaults.
  • Copied user security. Copying an existing user also copies every extra permission that user collected.
  • Stale accounts. Former employees, temps, and consultants keep active logins long after the work ends.

 

 

 

 

 

 

 

Which Dynamics GP Tools Prevent Unauthorized Changes?

Dynamics GP includes four built-in controls that add approval and an audit trail on top of security roles. What’s included:

  • Vendor approval workflow. New or changed vendors must be approved before anyone can post against them, per Microsoft’s Payables Management documentation. Since GP 2018, the workflow can include EFT bank fields such as bank name and account number, per Microsoft’s GP 2018 release notes.
  • Security role and task approval workflows. Added in the October 2019 release, these hold role and task changes until an approver signs off, as covered in this CAL post.
  • Activity Tracking. Set up under Microsoft Dynamics GP >> Tools >> Setup >> System >> Activity Tracking, it logs logins, failed logins, window access, master file changes such as vendor cards, and postings.
  • Batch approval. Posting Setup can require approval before any batch posts, putting a second set of eyes on every payment run.

*NOTE: GP application security only covers what happens inside GP. SQL Server logins, SSRS reports, and integrations follow their own rules. CAL’s post on Dynamics GP security blind spots covers those layers.*

How Do You Review Dynamics GP User Access?

A Dynamics GP user access review is a scheduled check that every active user’s roles still match that person’s current job. Run one at least quarterly, and any time someone is hired, changes jobs, or leaves. The review takes five steps:

  1. Pull every user’s role assignments in every company, including test companies.
  2. Send each department manager their team’s list to confirm or correct.
  3. Disable logins nobody can vouch for, including former employees, temps, and consultants.
  4. Confirm who holds POWERUSER and who knows the sa password, and remove both from daily use.
  5. Review Activity Tracking for vendor and security changes since the last review, and keep the signed-off results for your auditors.

Microsoft’s Dynamics GP lifecycle page lists support through December 31, 2029, and CAL’s Dynamics GP end of life guide explains that critical security patches continue until April 2031. A documented role design will also speed your eventual move to Microsoft Dynamics 365 Business Central or Acumatica.

The Bottom Line on Dynamics GP Security Roles

Dynamics GP security roles are only as strong as the last time someone reviewed them. Split vendor maintenance from payments, retire POWERUSER from daily use, turn on the approval workflows, and schedule a quarterly access review. None of it requires new software.

If you want a second set of eyes on your GP security, CAL’s Dynamics GP team brings more than 40 years of experience. Contact CAL Business Solutions to schedule a security review.

Read next: 5 Signs Your Dynamics GP Database Needs Attention

Dynamics GP Security Roles: Frequently Asked Questions

What is the difference between a security task and a security role in Dynamics GP?
A security task in Dynamics GP grants access to specific windows, reports, and files. A security role groups tasks to match a job. Users receive roles, one company at a time.

Should anyone have the POWERUSER role in Dynamics GP?
POWERUSER in Dynamics GP should be limited to system accounts used for installation and maintenance. It bypasses GP application security and does not appear on standard security reports, so it is not suitable for daily work.

Can Dynamics GP show who changed a vendor’s bank account?
Dynamics GP Activity Tracking logs additions, changes, and deletions to master records such as vendor cards, with the user and date. Before-and-after field values typically require a third-party auditing tool.

How often should you review Dynamics GP user access?
Review Dynamics GP user access at least quarterly, plus any time an employee is hired, changes jobs, or leaves. Include every company database, test companies too.

CAL Business Solutions is a Microsoft Dynamics GP, Acumatica, and Microsoft Dynamics 365 Business Central implementation partner serving distribution, manufacturing, brick & block, and professional services businesses across the United States. For more than 40 years, our team has helped Dynamics GP customers design security, tighten internal controls, and plan their move to a modern cloud platform.