One assignment that skips every segregation of duties check in F&SCM

How SoD rules evaluate a role

F&SCM security is a hierarchy. Roles contain duties, duties contain privileges, privileges contain permissions on menu items, tables and fields. Segregation of duties rules are declared between two duties. When the system checks a role or a user assignment, it compares the duty names on that role against the rules.

Microsoft’s role-based security documentation confirms that the shortcut is possible: “Although you can assign privileges directly to roles, assign only duties to roles.” The word “although” is doing real work. The system allows it, even though it is not the recommended path.

Microsoft’s security governance FAQ goes further. Asked whether there is a supported scenario where a role gets privileges directly instead of through duties, the answer is simply no, not for that feature.

Why the shortcut is invisible to the rule engine

When a privilege sits on a role with no duty around it, there is no duty name for a rule to match. The access is real and usable. But the rule meant to catch “this privilege combined with that one” has nothing to evaluate, because it was written in terms of duties.

Now multiply that by a few go-live shortcuts, consultant access requests and temporary fixes that outlive the project. An environment can build up a meaningful amount of access that its own SoD program never had a chance to see.

Why it stays that way

The SoD rules page still shows every rule as satisfied. Validate duties and roles and Verify compliance of user-role assignments come back clean too, because they use the same duty-based rules as their baseline. Nothing is logged as a violation because nothing was ever evaluated as one.

That is what makes this gap different from a misconfigured rule. It is not a failure of the rule. It is a category of access the rule was never built to check.

Signs you probably have this problem

• Your implementation had a busy go-live or hypercare period with many urgent access fixes.
• Custom roles were built by copying standard roles and then topped up with extra privileges.
• Nobody owns a record of why each custom role differs from the standard role it came from.
• Your SoD rules have not changed since go-live, while your roles have.

How to find direct privilege assignments

With standard F&SCM tools

• Security role access report (System administration > Inquiries > Security). It gives a flattened list of effective permissions per role across sub-roles, duties and privileges. Useful for reviewing one role in depth, but you still have to spot which permissions came in without a duty.
• Role configuration. Open a role in the security configuration and look at the privileges listed directly on it. This works for a handful of roles, not for a full tenant.
• Privilege separation validation. Under the security tasks of the process hierarchy, Microsoft offers a check that focuses on privileges assigned to roles and validates the percentage of overlapping privileges after you create a task and assign entry points. It is separate from the standard SoD pages and few organizations have it set up.

With Authorization Monitoring

F&SCM Authorization Monitoring from 2-Controlware analyzes the Security Objects directly: roles, duties, privileges and what they grant. Direct privilege assignments are part of that analysis, so a privilege sitting on a role outside any duty shows up in the results. Critical Permissions, such as who can process payment to a vendor, are answered on actual access rather than duty names, and Conflicts between Critical Permissions are detected automatically.

A simple clean-up routine

1. Freeze new direct privilege assignments. If one is truly needed, create or extend a duty instead, even a narrow one.
2. Inventory every role that holds privileges directly.
3. For each one, move the privilege into an appropriate duty, or remove it if the reason has expired.
4. Re-run Validate duties and roles and Verify compliance of user-role assignments after the move, because a privilege that now sits inside a duty can suddenly trigger a rule.
5. Repeat the inventory after each go-live, upgrade or large support batch.

If a consultant added a privilege directly to a role during your last go-live, would your current SoD setup have caught it? Request a demo to see what is sitting in your roles today.