Dynamics AX 2012 restricted system administrator

Question

Is it possible and (recommended as well) to restrict access on certain AX data to be secured from System Administrator role?

The case is that a company don't want to give access to its financial transactions, also for the employee payroll data, and some other classified information that System Administrator should not be accessed because of irrelevancy.

but, this particular administrator is performing development tasks on forms and reports, also playing the role of SQL DBA who is actually responsible for data maintenance, indexing, mirroring, backups...etc.

so, if we managed to restrict his access on data from AX client, he still can have access on SQL back-end, how can we restrict/encrypt data on SQL itself then?

Any suggestions highly appreciated!

Answer 1

What you're asking is incredibly difficult. It also could/would prevent him from functioning well as a developer.

What I've seen other companies do, and would make the most sense to me is to divide your infrastructure into Production and Test/Dev systems.

You would then backup your Production data and restore that data to Test and scrub the private financial info at the same time.

You would the give him access to Test/Dev systems only for development and SQL changes. Any dev or SQL changes that need to be made to the Production system, which has the sensitive data, would be performed by another person who is allowed to interact with the sensitive data.

Somebody has to have access to the data from SQL. You can't feasibly have accountants and controllers have the only access to the data. So whomever you were planning to have restrict his access...this would be a good candidate.