> ## Documentation Index
> Fetch the complete documentation index at: https://docs.eftsureinsided365fo.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Security Architecture and Configuration in Eftsure

> Understand Eftsure's security architecture — secrets encryption, TLS, OAuth 2.0, antivirus scanning, and role-based access control in D365.

Eftsure inside D365 Finance & Operations is built with security as a foundational concern. This page describes the technical security measures in place — from how credentials are stored and how data travels between D365 and Eftsure, through to how you configure role-based access and segregation of duties for your users.

## Secrets Encryption

All Eftsure secrets (such as API credentials and client secrets) are encrypted inside the D365 database. This prevents anyone — including system administrators — from reading the deciphered values. Encryption is implemented using:

* **Microsoft SQL Server Transparent Data Encryption (TDE)** — performs real-time encryption of data written to disk at rest.
* **Azure Storage encryption** — encrypts data stored in Azure at rest.

All changes to secrets are automatically logged in the `SysEncryptionLog` table. Secrets are:

* Not exposed in any data entities, public or private.
* Obfuscated in all system logs.

<Warning>
  When you move an environment database to another environment (for example, copying Production to UAT), the deciphering key changes. The target environment will **no longer be able to decipher the existing secrets** — you must reset all Eftsure secrets in the target environment after any database move.
</Warning>

For further reading, see [Encryption in Microsoft Dynamics 365](https://learn.microsoft.com/en-us/purview/office-365-encryption-in-microsoft-dynamics-365) and [Encryption in finance and operations apps](https://learn.microsoft.com/en-us/dynamics365/fin-ops-core/dev-itpro/sysadmin/encryption).

## Web Services Security

All communication between D365 FO and the Eftsure cloud uses HTTPS with TLS encryption. No unencrypted channels are used for any Eftsure API calls.

### HTTPS

Every outbound call made by the Eftsure extension enforces **HTTPS**. HTTPS is an extension of HTTP that uses TLS to encrypt communication, providing:

* **Authentication** of the Eftsure service endpoint.
* **Confidentiality** — data cannot be read in transit.
* **Integrity** — data cannot be tampered with in transit.

### TLS

The extension enforces TLS over HTTPS and supports both **TLS 1.2** and **TLS 1.3**, depending on the availability of TLS 1.3 in the target environment.

<Warning>
  TLS 1.3 support varies by environment. See [Supported TLS Versions](https://learn.microsoft.com/en-us/dynamics365/fin-ops-core/dev-itpro/sysadmin/encryption#supported-tls-versions) for details. If TLS 1.3 is unavailable, the extension falls back to TLS 1.2.
</Warning>

<Info>
  To enable TLS 1.3 on a development or sandbox server, use [IIS Crypto](https://www.nartac.com/Products/IISCrypto) to manually enable TLS 1.3 cipher suites on the Windows Server. This is only necessary on development environments where TLS 1.3 is not already enabled.
</Info>

### OAuth 2.0 Client Credentials

The Eftsure extension authenticates with the Eftsure API using the **OAuth 2.0 Client Credentials** grant type. This flow is designed for server-to-server communication and works as follows:

* The extension sends its `client_id` and `client_secret` directly to the Eftsure authorisation server's token endpoint.
* An access token is returned and used for subsequent API calls.
* No user interaction, browser redirection, or user consent is required.
* Refresh tokens are not issued — when the access token expires, the extension requests a new one.

This approach is appropriate because D365 is a confidential client that can securely store its client secret, and the extension accesses resources that belong to the client application itself rather than to an individual user.

## Antivirus Scanning

D365 supports native virus scanning on file attachments — including documents uploaded by vendors during the onboarding process. The extension uses the D365 delegate mechanism to plug in your organisation's chosen scanning software.

Use the following delegates to wire in antivirus scanning:

* `Docu.delegateScanDocument()` — scans documents when they are attached.
* `Docu.delegateScanDeletedDocument()` — handles scanning on deletion events.

<Warning>
  D365 Finance & Operations does **not** include antivirus scanning out of the box and does not recommend specific scanning software. Your organisation is responsible for selecting a file scanning solution and adding the appropriate code to the delegate handlers to integrate it. Do not assume attachments are scanned unless you have explicitly implemented delegate handlers.
</Warning>

## Security Artifacts and Role-Based Access

The Eftsure extension ships with a set of security artifacts — privileges, duties, and roles — that you can use as-is or incorporate into your organisation's existing custom D365 roles.

### Assigning Eftsure Duties to Custom D365 Roles

If your organisation uses custom D365 security roles rather than the standard built-in roles, you can assign Eftsure duties directly to those custom roles:

<Steps>
  <Step title="Open Security Configuration">
    Navigate to **System Administration > Security > Security Configuration**.
  </Step>

  <Step title="Locate your custom role">
    Find the custom role to which you want to add Eftsure permissions.
  </Step>

  <Step title="Add the required Eftsure duties">
    Add one or more of the Eftsure duties (`PESView`, `PESMaintain`, `PESConfigure`, `PESSelfCertify`, `PESPaymentLimit`) to the custom role, depending on the access level required.
  </Step>

  <Step title="Publish the security configuration">
    Save and publish the updated security configuration. Users assigned to the custom role will immediately inherit the new Eftsure permissions.
  </Step>
</Steps>

For a full description of each duty and what it controls, see [Users & Roles](/admin/users-and-roles).

## Segregation of Duties

Eftsure has its own permission model in the Eftsure portal that operates independently of D365. You must keep both systems in sync.

<Warning>
  Granting a user a higher-privilege role in D365 than in the Eftsure portal will cause inconsistencies. For example, a user with the CFO role in D365 but a lower-privilege role in the Eftsure portal will see enabled controls in D365 (such as the self-certify button) that will fail when actioned, because the portal will reject the request due to insufficient permissions. **The key user is responsible for ensuring D365 and Eftsure portal permissions remain consistent for every user.**
</Warning>

<Warning>
  The **Eftsure Admin** role should be assigned in **UAT and Dev environments only**, for use by Eftsure support engineers during troubleshooting. Do not assign the Eftsure Admin role to users in Production. If the `SysTracingPane` privilege included in this role is not appropriate for your organisation, remove it via **System > Security > Security Configuration**.
</Warning>


## Related topics

- [Eftsure Users, Roles, and Duties Setup for D365 F&O](/admin/users-and-roles.md)
- [Supplier Onboarding: Invite and Verify New Vendors](/workflows/onboarding.md)
- [Release Notes — Eftsure inside D365 FO (2024–2025)](/help/release-notes.md)
- [Vendor Group Configuration in Eftsure D365 Parameters](/admin/vendor-groups.md)
- [Vendor Payments: Eftsure Validation in Payment Journals](/workflows/payments.md)