Team Members vs. Sales Pro: the most common Microsoft license violation in the mid-market.

What Team Members allows

Microsoft lists the use rights in the Licensing Guide (pp. 42–43, plus Appendix D) explicitly. In the order they apply to CE modules (Sales, Customer Service, Field Service):

• Read-only access to all Dynamics 365 data
• Contacts, activities, and notes create, read, update, delete (full CRUD rights for these three entities)
• Update own employee data
• Capture time, materials, and expenses — your own, not on behalf of others
• Approvals for your own requests (expenses, time, materials)
• Approve your own expenses, time, and vendor invoices (within the scope of an approval role)
• Participation as a consumer of Dynamics 365 services — e.g., participate in Customer Voice surveys
• View reporting and dashboards

For Finance, Supply Chain Management, Commerce, and Project Operations there are additional special rights:

• Record any kind of time or expense
• Approve time, expenses, and vendor invoices (within scope of approval authority)
• Create requisitions
• Manage own employee data and HR-relevant activities for direct reports
• Use Human Resources Self Service

Microsoft refined the use rights again in November 2025 (change log, p. 71). The most important clarification: approval rights apply to one's own activity — not on behalf of others. This is where most violations happen.

Three typical compliance violations — from daily audit business

Violation 1: The secret power user

The classic. A person from sales management, formally licensed with Team Members — but assigning opportunities daily, changing pipeline stages, entering forecast comments. Justification: "I only use the app I was given." Microsoft says: whoever uses the function needs the license for it.

We saw this nine months ago in an audit preparation meeting at a mid-market industrial supplier — the person concerned had Team Members for two years. Theoretical license violation per year: USD 87 × 12 × 1 user = USD 1,044. Not dramatic. But in an audit, it's not just the difference that counts, but the backdating period plus interest plus contract penalties. From USD 1,044 it can quickly become USD 5,000 — per identified violation.

Violation 2: The overreaching custom app

An internal Power App that reads and writes to Dataverse tables. Microsoft allows Team Members the use of Power Apps — as long as the app stays within the use rights. But: if the app uses 25 custom tables (limit is 15), or if it implements full-user functions like creating sales opportunities, that is a violation.

This often happens in "internal tool" setups. A mid-market company builds a custom app that accesses D365 data, all staff get Team Members or an Office 365 license, and no one checks whether the app stays within the use rights. In the Microsoft audit, however, it is checked.

Violation 3: Multiplexing via external systems

Microsoft writes: "Multiplexing — using a separate set of intermediary devices, applications, or users to pool connections to Dynamics 365 — does not reduce the number of licenses of any type required to access the underlying Dynamics 365 functionality." (Licensing Guide p. 50)

Translated: if you build your own web frontend that writes data to Microsoft Dynamics 365 via API, and 100 staff use this frontend, all 100 need the appropriate Dynamics 365 license. It's not enough that a service account writes the data. Microsoft recognizes this and looks closely at audits.

We once saw a customer in such a setup — a self-built order entry app that pumped data into Business Central. 80 staff, one service account, 0 Team Members licenses. Microsoft would have flagged this immediately in an audit. We switched the setup to 80 Team Members licenses, checked the operations order lines variant (doesn't fit the workflow logic), and in the end the operations activity license was the right choice for a subgroup.

How arades checks this

Two tools:

1. Devonso audit module

Our internal Devonso tool has a license audit module that accesses the Microsoft Graph API and Dataverse activity logs. For each licensed user, we pull the activity profiles — which entities were written in the last 90 days, which were read, which Power Apps were used — and reconcile with the assigned license. The result is a risk matrix with three levels: compliant, borderline, clearly in violation.

Effort for a typical initial analysis: 4 to 8 hours, plus 1 day review meeting with the customer. We do this also without an ongoing advisory contract, at cost.

2. License Cost Calculator

Once the risk matrix is in place, it's about re-licensing. Which users need an upgrade? Which can stay in the cheaper license? What is the effect on the annual license spend? We calculate this in the License Cost Calculator — with all base-attach optimizations and Premium comparisons we have described in our Base + Attach and Copilot Credits articles.

In the majority of cases we have seen so far, re-licensing costs less per year than the compliance violation would have cost in the next audit. Sometimes the re-setup is even net cheaper than the current one, because base-attach optimizations are taken along in parallel.