For each user, you can monitor the accessed securable objects. You can compare the accessed securable objects with the allocated securable objects. To limit license costs, you can remove permissions for not-accessed securable objects.

Standard procedure

1.	Click Security management.
2.	Click Security explorer.
3.	On the Action Pane, click View access details.
4.	By default, all users, as defined in D365 F&SCM, are shown in the Users list. The users that are not enabled, are highlighted. You can choose to only show enabled users in the Users list.
	Select the Show enabled users only check box.
5.	Select the securable object type for which you want to monitor user access details.
	In the Security object field, select an option.
	Note: For roles, privileges, or duties, the access details are based on the accessed related entry points. For example, if an entry point is linked to two roles, both roles appear in the Roles accessed grid when the user accessed that entry point.
6.	For each user, you can compare the accessed entry points with the permitted entry points.
	In the Users list, find and select the desired user, and compare the permitted entry points with the accessed entry points.
	Note: In the Access pane, by default, the accessed menu items are shown in descending order, first by the Last accessed on field and then by No. of access field. This helps you quickly see which entry points the selected user uses most and least. You can use this information to adjust roles or permissions based on usage patterns.
7.	Close the page.
8.	Close the page.

Notes

To compare user accessed entry points with the permitted entry points, in the Security and compliance studio parameters, on the Logs tab, set the Enable continuous user logging field to Yes. As a result, each time a user accesses an entry point, this is logged in the User continuous log. The data as shown on the View accessed entry points page is based on the User continuous log.