Segregation of duties conflicts (form)

Article
05/05/2014

Applies To: Microsoft Dynamics AX 2012 R3, Microsoft Dynamics AX 2012 R2, Microsoft Dynamics AX 2012 Feature Pack, Microsoft Dynamics AX 2012

Click System administration > Setup > Security > Segregation of duties > Segregation of duties conflicts.

–or–

Click System administration > Setup > Security > Segregation of duties > Segregation of duties unresolved conflicts.

Use this form to approve or reject role assignments that are in conflict, based on the rules for segregation of duties.

A conflict is logged when a rule for automatic role assignment attempts to assign a user to two roles that contain conflicting duties. In addition, conflicts are logged when you use the Verify compliance of user-role assignments with rules for segregation of duties form to verify whether existing role memberships comply with newly created rules.

The security administrator must allow or deny each assignment that causes a conflict.

Note

To verify whether security roles comply with the rules for segregation of duties, use the Segregation of duties rules form.

Task that uses this form

Identify and resolve conflicts in segregation of duties

Navigating the form

The following tables provide descriptions for the controls in this form.

Buttons

Button	Description
Deny assignment	For pending role assignments, reject the assignment of the user to the security role. If you deny an automatic role assignment, the user is marked as excluded from the role. The excluded user is not granted the access associated with the role, and the user cannot be assigned to the role until the administrator removes the exclusion. For existing role assignments, select this option to remove the user from the selected role.
Allow assignment	Allow the user to be assigned to conflicting security roles. When you override a conflict, you must enter a reason in the Reason for override field.

Deny assignment

For pending role assignments, reject the assignment of the user to the security role. If you deny an automatic role assignment, the user is marked as excluded from the role. The excluded user is not granted the access associated with the role, and the user cannot be assigned to the role until the administrator removes the exclusion.

For existing role assignments, select this option to remove the user from the selected role.

Allow assignment

Allow the user to be assigned to conflicting security roles. When you override a conflict, you must enter a reason in the Reason for override field.

Fields

Field	Description
Rule	The name of the rule that segregates the duties that are involved in the conflict.
Existing role	The currently assigned security role that is involved in the conflict. This role contains a duty or privilege that conflicts with a duty or privilege in the pending role assignment.
Existing duty	The duty or privilege in the currently assigned role that conflicts with a duty or privilege in the pending role assignment.
New role	The pending role assignment that is involved in the conflict. This role contains a duty or privilege that conflicts with a duty or privilege in a currently assigned role.
New duty	The duty or privilege in the pending role assignment that conflicts with a duty or privilege in a currently assigned role.
Assignment mode	Indicates whether the user was assigned to the role manually or automatically.
Resolution	Indicates whether the role assignment is allowed or denied.
Reason for override	If the role assignment is allowed, enter the reason for the override of the segregation of duties conflict.

Segregation of duties conflicts (form)

Task that uses this form

Navigating the form

Buttons

Fields

See also

Additional resources