Business Problem

Organizations operating multiple Legal Entities rely on Organization Assignments and role-based security to ensure users can only access data relevant to their assigned company.

Currently, users who are assigned to a single Legal Entity, can still view Purchase Requisitions created in other Legal Entities when accessing the All Purchase Requisitions page. Although access to transact may be restricted, the visibility of requisitions from other companies creates concerns around:

• Data segregation
• Confidentiality of procurement activities
• Compliance and governance requirements
• User confusion due to exposure to irrelevant records

We have validated that:

• Users are assigned to only one Legal Entity through Organization Assignments.
• Security roles and privileges are configured correctly.
• The behavior is reproducible across users.

Proposed Enhancement

Enhance D365 Finance & Operations so that Organization Assignments are automatically enforced when querying and displaying Purchase Requisitions in the All Purchase Requisitions view.

Specifically:

• Users should only see Purchase Requisitions belonging to Legal Entities to which they have been assigned.
• The application should honor Legal Entity restrictions consistently across procurement workspaces, inquiries, and lists.
• An optional system parameter could allow administrators to choose between:
• Current behavior (cross-company visibility)
• Enforce Organization Assignment filtering (recommended)

Expected User Experience

A user assigned exclusively to Legal Entity:

✅ Can view Purchase Requisitions created within his restricted Legal intity.

❌ Cannot view Purchase Requisitions belonging to other Legal Entities.

This behavior should be consistent with the organization's security model and user expectations.

Business Value

• Strengthens data security and segregation between legal entities.
• Supports regulatory and audit requirements in multi-company environments.
• Reduces the risk of exposing procurement-related information across legal entities.
• Aligns system behavior with customer expectations when Organization Assignments are configured.
• Minimizes the need for custom security policies, development effort, or workarounds.

Impact

Many multinational organizations deploy D365 Finance & Operations with multiple Legal Entities and depend on Organization Assignments for operational segregation. When users can see Purchase Requisitions outside their assigned entity, organizations must implement additional controls or customizations to achieve the expected security boundary.

Providing native support for Legal Entity-aware filtering of Purchase Requisitions would improve security, simplify administration, and increase customer confidence in the platform’s multi-company governance capabilities.

Question for Product Group

Can Microsoft confirm whether the current cross-company visibility of Purchase Requisitions is by design? If so, please consider introducing a standard capability that enforces Legal Entity restrictions based on Organization Assignments for Purchase Requisition visibility and related procurement workspaces.