User-based authentication

Seamless RSAT Sign-In After Certificate Retirement:

Microsoft is phasing out certificate-based authentication for Dynamics 365 F&O apps. Because the Regression Suite Automation Tool (RSAT) can’t authenticate with service principals, user-based sign-in is now only way. With a single Azure Key Vault and Microsoft Entra ID app, you can switch RSAT to the new model without breaking a single test case.

What’s changing—and why it matters:

• Existing RSAT certificates will stop working.
• RSAT doesn’t support app-only tokens, so test executions must impersonate actual users.
• Multi-Factor Authentication on test accounts causes silent failures; disable it for RSAT identities.

Prerequisites:

Configure the solution:

1️⃣ Prepare your Key Vault

1. Create a vault (or choose an existing one) in the same tenant as F&O.
2. Add a secret per test email id user Name pattern: strip symbols from the e-mail → john_doe@contoso.com → johndoecontosocom.
   Value: the exact password.
   3.Rotate secrets and account passwords on a schedule (e.g., every 180 days).

2️⃣ Register an Entra ID app

1. Go to Azure Portal → Entra ID → App registrations → New app.
2. Record the Application (Client) ID.
3. Create a Client Secret; copy the Secret ID and Secret Value.
4. In the vault, grant the app Get & List permissions for secrets (Access Policies or RBAC).

3️⃣ Point RSAT to the vault

1. Open RSAT → Settings → Authentication and choose User-Based.
2. Fill in:

• Tenant ID
• Key Vault URL
• Client ID
• Secret ID and Secret Value

1. Select or generate a local certificate thumbprint (RSAT uses this only to encrypt its config).

Best practices:

• Sandbox-only identities: never map RSAT to real production users.
• Tight RBAC: give the Entra ID app the minimum required Key Vault rights—nothing more.
• Secret expiry diary: add a calendar reminder a week before the client secret expires; update RSAT the same day you renew it.
• Audit regularly: verify that no test account has drifted into the PROD tenant or regained MFA.

By shifting RSAT to user-based authentication backed by Azure Key Vault, you stay compliant with Microsoft’s certificate retirement and keep test runs fully automated. Set it up once, rotate secrets on schedule, and your regression suites will continue to hum along—no certificates, no MFA roadblocks, just smooth continuous testing.

Reference : User-based authentication

Need help? Connect Atul

• Author
• Recent Posts

Atul Yadav

Lead Technical Consultant at Flight centre travel group

As a leading Dynamics 365 F&O Technical lead, Atul brings extensive experience in developing custom solutions that drive business efficiency. His skill set uniquely includes Azure DevOps for Dynamics 365 F&O, enabling efficient project management, automation, and deployment processes. Additionally, his expertise in Power Platform allows for the creation of powerful business solutions that leverage data analysis, app development, and automation.

His proficiency in Azure integration further distinguishes his capability, facilitating seamless connections with Dynamics 365 F&O and enhancing business operations. Committed to project success, he provides ongoing support and shares industry insights through his blog, contributing to the professional community's growth.

Latest posts by Atul Yadav (see all)

• User-based authentication - July 22, 2025
• Boost First-Load Performance in Dynamics 365 F&O with IIS Preload - July 15, 2025
• D365 Data entitiy Insert method COC - October 30, 2024