> ## Documentation Index
> Fetch the complete documentation index at: https://docs.eftsureinsided365fo.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Eftsure Users, Roles, and Duties Setup for D365 F&O

> Configure Eftsure users, assign D365 and portal roles, manage duties and permissions, and keep both systems in sync for consistent access control.

Since the introduction of Eftsure API v2, the key user is responsible for maintaining all users in **both** the Eftsure portal and Dynamics 365 Finance & Operations. Getting this right from the start ensures a clean audit trail, consistent access control, and predictable behaviour across both platforms.

## User Configuration

### Eftsure Users

Eftsure has its own security and segregation-of-duties model that lets you configure user access directly within the portal. The administrator can create multiple users with different permission levels, and those permissions affect the options available in both the Eftsure portal and D365 FO.

<Note>
  Although you can create a single generic Eftsure user shared by multiple D365 users, we strongly recommend creating **one Eftsure user per D365 user**. This gives you maximum granularity and consistent history tracking on both sides.
</Note>

### Generic Service Account

In addition to individual users, configure a generic Eftsure service account in the parameters form. The generic user handles all Eftsure batch jobs and common actions that do not require specific or elevated permissions.

After saving the service account credentials, use the two connection tests to validate your setup:

* **Ping** — confirms that the Eftsure service is up and reachable.
* **Login** — validates the user credentials against the Eftsure cloud.

### Request API Permissions

<Warning>
  If a username does not have API access configured in the Eftsure portal, **all requests will fail** for that user. API permissions cannot be granted by the administrator — contact Eftsure Support to have API access granted to one or more users.
</Warning>

## Roles

The Eftsure extension ships with two types of user roles:

* **Standard extended roles** — existing D365 roles that are extended with Eftsure duties.
* **Eftsure-specific roles** — new roles introduced by the extension.

<Note>
  We recommend assigning standard extended roles wherever possible, because these are typically already in place before an Eftsure project starts. Users will inherit the new Eftsure permissions automatically. If your organisation uses custom D365 roles, you can map the Eftsure duties to those roles instead.
</Note>

### Standard Extended Roles

The extension adds Eftsure duties to the following built-in D365 roles:

| D365 Role Name                        | Description                     | Eftsure Duties / Permissions                                         |
| ------------------------------------- | ------------------------------- | -------------------------------------------------------------------- |
| **CompanyChiefExecutiveOfficer**      | Chief Executive Officer         | Manager view                                                         |
| **CompanyChiefFinancialOfficer**      | Chief Financial Officer         | Configure, Maintain, Payment limit, Self certification, Manager view |
| **PaymAccountsPayablePaymentsClerk**  | Accounts Payable Payments Clerk | View                                                                 |
| **VendInvoiceAccountsPayableClerk**   | Accounts Payable Clerk          | View                                                                 |
| **VendInvoiceAccountsPayableManager** | Accounts Payable Manager        | Manager view, Payment limit, Self certification                      |
| **VendPurchasingAgent**               | Purchasing Agent                | View                                                                 |
| **VendVendorAccountManager**          | Vendor Account Manager          | Manager view                                                         |
| **VendVendorContactExternalAdmin**    | Vendor Admin (External)         | External vendor collaboration                                        |

### Eftsure-Specific Roles

The extension also introduces the following new roles:

| Role Name         | Description            | Duties / Permissions                                                                         |
| ----------------- | ---------------------- | -------------------------------------------------------------------------------------------- |
| **Admin**         | Eftsure Administrator  | Maintain bank accounts, Configure, Maintain, Payment limit, Self certification, Manager view |
| **Key User**      | Eftsure Key User       | Maintain bank accounts, Key user, Key user support                                           |
| **Manager**       | Eftsure Manager        | Maintain bank accounts, View, Manager view, Payment limit                                    |
| **SelfCertifier** | Eftsure Self-Certifier | View, Self certification                                                                     |
| **Support**       | Eftsure Support        | Read-only access to all vendor and Eftsure modules and tracing                               |
| **User**          | Eftsure User           | Maintain bank accounts, View                                                                 |

<Warning>
  Granting different permissions in D365 and the Eftsure portal causes inconsistencies. For example, if a user holds the CFO role in D365 but a lesser role in the Eftsure portal, the self-certify button will appear enabled in D365 but the self-certification action will fail due to portal security restrictions. **The Eftsure administrator is responsible for keeping permissions in sync between both systems.**
</Warning>

<Warning>
  The **Eftsure Admin** role is intended for Eftsure support engineers troubleshooting issues in **UAT and Dev environments only**. It includes the `SysTracingPane` privilege (granted via code) to allow trace captures during investigations. If this privilege is not appropriate for your organisation, you can remove it manually via **System > Security > Security Configuration**, or review the security artifacts for all roles.
</Warning>

<Note>
  The Eftsure Admin role does **not** include self-certification permission to prevent unintended certifications during support sessions.
</Note>

## Duties

The following duties are available for you to assign to users and roles. A user with none of these duties assigned will not see any Eftsure fields, buttons, tabs, or menu items in D365 FO.

| Duty Name           | Label                 | Description                                                                                                                                                                                                                                                   |
| ------------------- | --------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **PESView**         | Eftsure View          | Grants permission to view all Eftsure information (excluding Highest Previous Payment), including onboarding information, Eftsure fast tabs in vendor details and payment journals, and grid icons.                                                           |
| **PESMaintain**     | Eftsure Maintain      | Grants permission to view Highest Previous Payment, edit all editable Eftsure information, send onboarding invitations and verification requests, create vendors from onboarding, copy vendors and bank accounts across legal entities, and run mass updates. |
| **PESConfigure**    | Eftsure Configure     | Grants permission to configure the Eftsure module and run mass updates.                                                                                                                                                                                       |
| **PESSelfCertify**  | Eftsure Self-Certify  | Allows the user to bypass Eftsure verification and self-certify a vendor, enabling payments regardless of the vendor's verification status.                                                                                                                   |
| **PESPaymentLimit** | Eftsure Payment Limit | Allows the user to change the payment limit per vendor.                                                                                                                                                                                                       |

## User List

The **User list** screen displays all active Eftsure users in your current D365 environment. All Eftsure user management must be performed directly in the Eftsure online portal — the D365 list is read-only and reflects the portal state.

<Tip>
  You can manage the user list directly from Excel using the standard D365 Excel add-in integration.
</Tip>

## Customise User Role Configuration

D365 system administrators can customise user roles based on available privileges — for example, to enable or restrict the vendor creation button for specific Eftsure users.

### Enable Vendor Creation for Eftsure Users

By default, Eftsure users may not have the option to create vendors. To enable the **Vendor** button for Eftsure users, follow the steps below.

<Steps>
  <Step title="Open Security Configuration">
    Navigate to **System Administration > Security > Security Configuration**.
  </Step>

  <Step title="Locate the relevant role or privilege">
    Find the Eftsure role you want to modify, or locate the specific privilege you want to change.
  </Step>

  <Step title="Add the vendor creation privilege">
    Add the appropriate privilege to the selected role to enable the vendor creation button.
  </Step>

  <Step title="Save and publish">
    Save your changes and publish the updated security configuration.
  </Step>
</Steps>

<Note>
  If you modify a privilege directly rather than at the role level, the change will apply to **all roles** that include that privilege. Only modify at the privilege level if that is your intention.
</Note>


## Related topics

- [Security Architecture and Configuration in Eftsure](/admin/security.md)
- [Eftsure Workspace: AP Control Centre in Dynamics 365](/get-started/workspace.md)
- [Eftsure Admin Setup Guide for D365 Finance and Operations](/admin/setup.md)
- [Supplier Communication Tools in Eftsure Inside D365 FO](/user/supplier-communication.md)
- [Release Notes — Eftsure inside D365 FO (2024–2025)](/help/release-notes.md)