Create, Manage Domain In Dynamics AX

A domain in the Microsoft Dynamics AX system is a group of company accounts. Domains enable setting up specific user permission for a group of company accounts.

Just as user groups define sets of users, domains define sets of company accounts that are logically connected. You can set security permissions based on the combination of user groups and domain

By using domains, you could allow a conglomerate company that has several subsidiary businesses to share a single Microsoft Dynamics AX system. Each subsidiary can be represented by a domain, which in turn can limit access based on user group.

One domain, Admin, exists in the Microsoft Dynamics AX system by default. The Admin domain always includes all companies. You cannot remove the domain or delete any companies from this domain. Use the Admin domain for any user groups that need access to all companies.

Note: The domains feature requires a separate license. To obtain a license, contact your Microsoft Dynamics AX Partner.

If your organization or business has more than one company account, you can restrict account access by using domains. Domains restrict account access much like user groups restrict user access.

With the combination of domains and user groups, you can create a strict security policy where each user group in each domain is a distinct entity without any access between groups or domains.

You can also create a customized security policy where, for example, one group has account access to similar group data, forms, and modules across multiple domains. In this graphic the Engineering Africa group has access to all engineering data, forms, and modules across all domains.

Create a domain

1. From a Microsoft Dynamics AX Client, click Administration > Setup > Domains.
2. On the Domains tab, press Ctrl+N to add a new domain.
3. Enter an ID in the Domain ID field, such as Eur for Europe. This is required.
4. Enter a name in the Name field (required), such as Europe.
5. Click the Company accounts tab.
6. Select company accounts in the Remaining company accounts list and then click the left arrow (<) to move the selected company accounts into theSelected company accounts list. All accounts moved into the Selected company accounts list will be added to the current domain.
7. Press Ctrl+S to save changes.

Grant user groups access to a domain

By default, user groups do not have access to a new domain. You must grant access by using the following procedure.

Note : Before completing the following steps, determine which user groups require access to the new domain. Also, determine the necessary permissions for each user group. If you are uncertain about whether to grant access to a user group, deny access until you receive a request from a manager.

1. From a Microsoft Dynamics AX client, click Administration > Setup > Security > User group permissions.
2. On the Overview tab, select a user group. If you have to create a new user group for this domain, you should Manage user groups.
3. Select a domain.
4. Click the Permissions tab.
5. Set the desired permissions.
6. Press Ctrl+S to save changes.

Create domain administrators

Domain administrators have full administration rights to their domain. However, they have no rights to other domains.

Some customers who have many companies in Microsoft Dynamics AX have a requirement to keep the data in each company completely separate. In such large system environments the system administrator is not the person who grants permissions to the user or creates companies. The system administrator creates a role called the domain administrator to do this. Domain administrators have complete access to all resources within their domain, but do not have access to companies in other domains.

Create domain administrator user groups

Before the system administrator creates the domain administrators, the companies, domains, and users must be created in the Microsoft Dynamics AX environment. For instructions, see Manage company accounts, Manage domains, and Manage users.

1. From a Microsoft Dynamics AX client, click Administration > Setup > User groups.
2. On the Groups tab, create a Domain administrator user group for each domain in the Microsoft Dynamics AX system.
3. Select the new Domain administrator user group, and then click Permissions.
4. Select the Admin domain in the Domains pane, and then open the Permissions tab.
5. Select every security key and apply View access to them for the Admin domain.
6. Open the Overview tab again and select the domains in the Domains pane that this user group will administer.
7. Open the Permissions tab.
8. Click Set all to Full control.
9. In the Permissions tree, select Administration > Open domain access and apply No access.
   This restricts the Domain administrator from seeing data in other domains.
10. Close the form.
    This grants full rights to the Domain administrator user group for the selected domain.

Add domain administrators to the domain administrator user groups

After the Domain administrator user groups are created for each domain, the system administrator adds users to these user groups.

1. From a Microsoft Dynamics AX client, click Administration > Setup > User groups.
2. Select the Domain administrator user group that you just created.
3. Open the Users tab.
4. Select the users who will be the domain administrators for the domain represented by the user group, and then click the left-arrow (<) to move each user into the Selected user pane.
5. Open the Groups tab.
6. Select the Admin user group and any other unnecessary user groups.
7. Open the Users tab.
8. Select the users who are domain administrators, and then click the right-arrow (>) to move these users into the Remaining users pane.
   This makes sure that the Domain administrators do not have administrator rights over the whole system.