Security expectations have changed a great deal since most companies first installed Microsoft Dynamics GP. Today, auditors, insurers and IT teams all ask the same two questions about any system that holds financial data: do users sign in with their company identity? and is multi-factor authentication (MFA) switched on?
For modern cloud applications, the answer is usually a simple yes. For GP, the answer is more nuanced. GP was designed in a different era, and its sign-in model reflects that. The good news is that there are still real, practical ways to strengthen access to GP.
In this article, we explain in plain terms what single sign-on (SSO) and MFA mean for GP, what the product supports on its own, what you can add around it, and when it makes more sense to look at a modern platform instead.
Why Single Sign-On and MFA Matter for Your ERP
Your ERP system holds some of the most sensitive information in your organization: bank details, vendor payments, payroll, customer records and your full financial history. That makes it a natural target.
Single sign-on means users access the system with the same company account they already use for email and other applications, usually managed in Microsoft Entra ID (formerly Azure Active Directory). This brings several benefits:
- Fewer passwords for staff to remember, and fewer passwords written down.
- One place to disable access when someone leaves the business.
- Consistent password rules across every system.
Multi-factor authentication adds a second check, such as an approval on a phone app or a one-time code, on top of the password. Even if a password is stolen, the attacker still cannot get in without the second factor.
Together, they are now considered basic hygiene. Many cyber insurance policies and audit frameworks expect to see them, and it is worth recognizing that a gap here can affect your premiums, your audit findings and, most importantly, your risk.
How Sign-In Works in Dynamics GP Today
To understand what is possible, it helps to know how GP handles sign-in.
In the standard GP desktop client, each person has a GP user ID and password. Behind the scenes, that GP user is linked to a SQL Server login, because GP connects directly to its SQL databases. When a user signs in, GP passes those credentials to SQL Server.
This has a few consequences:
- The GP sign-in is separate from the user’s Windows or Microsoft 365 account, so the desktop client does not offer true single sign-on on its own.
- There is no built-in MFA prompt in the desktop client.
- Password rules can be enforced through SQL Server’s password policy option in GP User Setup, which applies your Windows domain rules for length, complexity and expiry.
In short, the desktop client protects access well enough with strong passwords and good administration, but it was not built for modern identity standards.
What Is Possible Natively in Dynamics GP
GP does include a few features that move it closer to modern identity management. Many businesses simply do not realize they exist.
Single Sign-On Through the GP Web Client
The Dynamics GP web client lets users work in GP through a browser. When it is deployed, it supports two authentication types beyond the standard GP login:
- Windows accounts, where users sign in with their Active Directory credentials.
- Organizational accounts, where users sign in with their Microsoft Entra ID account.
With organizational accounts, an administrator registers the GP web components as an application in Entra ID and then maps each GP user to their organizational account in GP User Setup. Once this is done, users sign in with their company identity, and any MFA or Conditional Access policies you apply in Entra ID also apply to that sign-in. This is the closest GP comes to genuine single sign-on with MFA.
There are some points to keep in mind. The web client requires additional infrastructure, including a web server and SSL certificates, and not every third-party add-on or customization works in the browser. It is worth testing your key processes before committing to it.
Modern Authentication and MFA for GP Email
Since the October 2020 release (version 18.3), GP can send emails, such as invoices, statements and workflow notifications, through Microsoft 365 using modern authentication with MFA. This uses an app registration in Microsoft Entra ID. It does not protect the GP sign-in itself, but it removes the need to keep older, less secure email authentication switched on, which is an important improvement in its own right.
Practical Ways to Add MFA Around Dynamics GP
For most organizations using the desktop client, the practical approach is to protect the route into GP, rather than GP itself. If every path to the GP client requires MFA, you achieve much the same outcome.
Common approaches include:
- Remote Desktop with MFA: Many companies run GP on Remote Desktop Services. By placing an RD Gateway in front and connecting it to Entra ID MFA, every remote session requires a second factor before anyone can even see the GP sign-in window.
- Azure Virtual Desktop: Hosting GP in Azure Virtual Desktop lets you use Entra ID sign-in, MFA and Conditional Access policies for every session.
- VPN with MFA: If staff connect to the office network through a VPN, enforcing MFA on the VPN adds a strong layer of protection for remote access.
- Windows sign-in protection: Features such as Windows Hello for Business add stronger authentication at the device level for users working in the office.
- Third-party security tools: Several independent software vendors offer add-ons for GP that add features such as Windows-based sign-in, additional audit trails or tighter session control. These can be useful, but they add another product to license and maintain.
Alongside these, good basic practice makes a real difference:
- Enforce the SQL password policy for all GP users.
- Remove or disable GP and SQL accounts for staff who have left.
- Review GP security roles regularly so people only have the access they need.
- Keep GP on the latest supported version, so you receive the latest security updates.
- Restrict direct access to SQL Server, so users cannot bypass GP.
If you would like help reviewing your current setup, our Dynamics GP support team carries out security reviews for GP customers.
The Limits You Should Recognize
It is important to be realistic. Even with these measures in place, GP has limits:
- The desktop client will always rely on GP users linked to SQL logins.
- MFA is applied to the network or session, not natively inside the desktop sign-in.
- Each workaround adds infrastructure that your IT team must maintain.
- Microsoft is not adding new identity features to GP. Product updates and technical support end on December 31, 2029, and security updates end on April 30, 2031.
We want to emphasize that this does not make GP insecure. Many organizations run it safely with the right controls. But it does mean that every year, more effort is required to meet standards that newer systems meet out of the box.
How Business Central Handles SSO and MFA
This is where Microsoft Dynamics 365 Business Central offers a clear difference.
In Business Central online, users sign in with their Microsoft Entra ID account by default. That means:
- True single sign-on with the same account used for Outlook, Teams and the rest of Microsoft 365.
- MFA and Conditional Access managed centrally, with rules based on location, device or risk level.
- One place to remove access when someone leaves the business.
- No SQL logins for users to manage, because Microsoft runs the infrastructure.
- Detailed permission sets and audit capabilities that help when summarizing and analyzing who did what.
Business Central on-premises can also be configured to use Entra ID authentication, so modern sign-in is available whichever deployment you choose.
For many of our clients, security is one of the strongest reasons to move. Instead of building extra layers around an older system, they get modern identity protection as part of the standard product. You can read more about this route on our Dynamics GP to Business Central migration page.
Frequently Asked Questions
Does Dynamics GP support single sign-on?
Partly. The GP web client supports sign-in with Windows accounts or Microsoft Entra ID organizational accounts, which provides single sign-on. The standard desktop client uses its own GP user ID and password, linked to a SQL login.
Can I turn on MFA for Dynamics GP?
Not directly in the desktop client. You can apply MFA through Entra ID when using the web client with organizational accounts, or protect the route into GP with MFA on Remote Desktop, Azure Virtual Desktop or your VPN.
Does GP’s email MFA protect my GP login?
No. The MFA support added in the October 2020 release applies to sending email through Microsoft 365. It is a useful improvement, but it does not change how users sign in to GP.
Is Business Central more secure than Dynamics GP?
Business Central was designed for modern identity standards, with Entra ID sign-in, MFA and Conditional Access built in. GP can be run securely, but it needs more effort and additional infrastructure to reach the same level.
How Nevas Technologies Can Help
At Nevas Technologies, we have more than two decades of experience with Microsoft Dynamics. Whether you want to strengthen security on your current GP system or plan a move to Business Central, our team can help you understand your options and choose the right path for your organization.
We can review your GP sign-in setup, recommend practical MFA options, and, when you are ready, guide you through a smooth move to Business Central with modern security from day one. Our Business Central consultants and training services make sure your team is confident with the new way of working.
Want to tighten security on GP or explore Business Central? Schedule a demo, or contact our team for a free consultation.
