Blogger CloudFrontsbloggerEdit Profile Summary Expense management processes in enterprise project environments often require strict documentation controls to ensure financial accuracy and compliance. One common requirement is the mandatory attachment of receipts when submitting expense entries, especially for specific expense categories such as airfare, accommodation, or high-value reimbursements. My blog describes how a project-driven organization streamlined its expense submission workflow using Canvas Apps integrated with Dynamics 365 Project Operations. The solution I had implemented automates the validation and submission process for expense entries while ensuring that receipt files are attached before submission. By combining form validation logic in the Canvas App with backend automation using Power Automate, the organization eliminated the manual process of attaching receipts and creating notes in the system. The result was a seamless, user-friendly expense submission experience that enforces compliance while significantly improving operational efficiency. Table of Contents 1. Customer Scenario 2. Solution Overview 3. Understanding the Expense Data Structure 4. Canvas App Validation Logic 5. Expense Creation and Submission Process 6. Automating Receipt Handling with Power Automate 7. Enforcing Mandatory Receipts for Specific Categories 8. Business Impact 9. Solution Walkthrough 10. Final Thoughts 1. Customer Scenario A Texas based Cyber Security organization managing multiple client engagements relied on Dynamics 365 Project Operations to track project expenses incurred by consultants and field staff. While the system allowed users to create draft expense entries, the process of submitting those expenses required additional manual steps. To submit an expense, users had to: Create the expense entry in draft mode. Upload the supporting receipt manually. Navigate to the expense record. Create an associated Expense Receipt record. Attach the receipt file under Notes (Annotations). Convert the file into the required document format stored in the system. Update the expense status to Submitted. This workflow introduced several challenges: Users frequently forgot to attach receipts. Manual creation of Notes records was error-prone. Finance teams had to follow up for missing documentation. Expense approvals were delayed due to incomplete submissions. Employees found the process unnecessarily complex. The organization needed a simpler, controlled way to ensure receipts were always attached when expenses were submitted, without requiring users to understand the underlying system structure. 2. Solution Overview To address these challenges, a custom expense submission experience was built using Canvas Apps integrated working in conjunction with D365 Project Operations. The solution introduced a dynamic expense entry submission interface where users can: Create expense entries Upload receipt files Submit expenses directly from the app Figure: Canvas App interface enabling dynamic expense entry submission with receipt attachment. Figure: Canvas App interface enabling dynamic expense entry submission with receipt attachment. Behind the scenes, the application automatically: Creates the expense entry in Dataverse Generates the related Expense Receipt record Uploads the receipt file to Notes (Annotations) as a document Updates the expense status to Submitted Figure: A Submitted Expense Entry Record. Figure: The Expense Receipt Record + Receipt PDF Annotation associated with the Expense, without which Submission won’t have been possible. This automation completely overrides the manual procedure of attaching receipts and creating notes, ensuring the process is both compliant and seamless for users. 3. Understanding the Expense Data Structure Within Dynamics 365 Project Operations, expense documentation follows a structured relationship model. The hierarchy looks like this: Expense ↓ Expense Receipt ↓ Notes (Annotation) ↓ Blob/Base64 File Storage of Expense Receipt. Figure: Implementation of the Expense Entry -> Expense Receipt -> Annotation -> Receipt File Workflow. In this structure: The Expense record stores the financial transaction. The Expense Receipt record acts as a container for receipt documentation. The Notes (Annotation) entity stores the actual file. The receipt file is stored as Base64 binary data (blob). While this structure is technically sound, it requires multiple manual steps when performed directly by users. The custom Canvas App abstracts this complexity and handles it automatically. 4. Canvas App Validation Logic To ensure all required data is captured before submission, the Canvas App includes dynamic validation logic. The application checks whether essential fields are populated before allowing the expense to be saved or submitted. These validations include fields such as: Transaction Date Project Expense Category Reimbursable Indicator External Comments Unit Quantity Unit Price If any required field is missing, the user receives an immediate notification explaining what needs to be completed. Example logic used in the application: If( Or( IsBlank(DatePicker2_5.SelectedDate), IsBlank(Project_Combobox_5.Selected), IsBlank(ExpenseCategory_Combobox.Selected), IsBlank(Dropdown1.Selected.Value), IsBlank(External_Input_7.Text), IsBlank(Project_Combobox_6.Selected), IsBlank(NumberInput2.Value), IsBlank(NumberInput2_1.Value) ), Notify(“Required fields are missing.”, NotificationType.Error) ) This validation ensures data completeness before the expense record is created. 5. Expense Creation and Submission Process Once validation passes, the Canvas App uses a Dataverse Patch operation to create or update the expense record. The logic dynamically calculates financial values such as the subtotal based on quantity and unit price. Example logic: Set( varSavedExpense, Patch( Expenses, Defaults(Expenses), { ‘Transaction Date’: DatePicker.SelectedDate, Project: Project_Combobox.Selected, ‘Expense Category’: ExpenseCategory_Combobox.Selected, Quantity: Value(NumberInputQuantity.Value), ‘Unit Price’: Value(NumberInputPrice.Value), Subtotal: Value(NumberInputQuantity.Value) * Value(NumberInputPrice.Value) } ) ); ‘SubmitExpense(CanvasApp)’.Run( varSavedExpense.Expense, First(fileupload.Attachments).Name, First(fileupload.Attachments).Value ); Notify( “Expense submitted successfully.”, NotificationType.Success ) This creates the draft expense entry in the system. 6. Automating Receipt Handling with Power Automate After the expense entry is saved, the Canvas App triggers a Power Automate flow. The flow receives: Expense record ID File name Receipt file content The flow then performs the following steps automatically. Step 1: Create Expense Receipt Record A new Expense Receipt record is created and linked to the expense entry. Step 2: Upload Receipt as Note The receipt file is stored as a Note (Annotation) associated with the expense receipt. This note contains: File Name Document Type Base64 encoded file content MIME type Step 3: Update Expense Status Finally, the expense record status is updated from Draft to Submitted. This ensures the expense becomes available for approval workflows and financial processing. 7. Enforcing Mandatory Receipts for Specific Categories An important requirement D365 PO is ensuring that certain expense categories cannot be submitted without receipts. Examples include: Airline tickets Travel expenses Accommodation High-value reimbursements The Canvas App logic ensures that a receipt file must be attached before submission is triggered. If the … Continue reading Dynamic Expense Entry Submission with Receipt Attachments in Power Apps: A Practical Implementation for a Texas-Based Operational Technology Security Organization →

Summary Designed and deployed a mobile-first Power Apps Canvas App for a Texas-based industrial cybersecurity firm specializing in operational technology (OT) security for oil and gas infrastructure. Unified time tracking, expense management, material consumption logging, and approvals into a single experience integrated with Dynamics 365 Project Operations. Eliminated fragmented desktop-based workflows that delayed project reporting, approvals, and billing. Automated expense receipt processing through Power Automate, improving compliance and reducing manual effort. Implemented project-scoped approval routing to ensure submissions were reviewed only by authorized stakeholders. Enabled real-time project visibility through structured Dataverse-driven workflows and lifecycle tracking. Provided mobile approvals and submission monitoring, dramatically reducing turnaround times. Improved data accuracy, audit readiness, and billing efficiency across field operations. Table of Contents Introduction Requirement & Business Scenario Solution Implementation Implementation Gallery Outcome FAQs Conclusion 1. Introduction Field-driven organizations live and die by the accuracy and speed of their project data. For a company securing critical infrastructure like oil rigs, every hour an engineer spends fighting with a clunky time-entry screen is an hour not spent on the job site — and every delayed expense submission is a delay in client billing and financial reporting. This is the story of how a Texas-based cybersecurity firm moved away from a fragmented, desktop-oriented workflow inside Dynamics 365 Project Operations and adopted a unified, mobile-first Canvas App that brought time tracking, expense submission, and material logging into one place, with built-in compliance controls and project-specific approval routing. The Goal: Build a unified mobile-first experience that allows field engineers to submit time, expenses, and materials from anywhere while ensuring compliance, controlled approvals, and real-time project visibility. 2. Requirement & Business Scenario The firm manages multiple concurrent field engagements using Dynamics 365 Project Operations as its system of record. Consultants and field engineers were expected to log three categories of activity against active projects: Time entries for hours worked Expense entries covering travel, accommodation, airfare, and related costs Material usage logs for equipment, parts, and consumables The core issue was that the underlying system was built for desktop use, not for engineers working on-site at remote rig locations. This created several compounding problems: Field staff had no efficient way to submit entries from a mobile device, so submissions piled up until they were back at a desk. Time, expense, and material tracking lived in separate workflows, forcing users to context-switch between screens for what should have been a single daily task. Expense compliance was inconsistent — receipts were sometimes attached, sometimes forgotten, and the process for linking a receipt to an expense record involved several manual, error-prone steps behind the scenes. Approvals had no project-level boundaries, making it hard to guarantee that only the right project stakeholders could review and approve specific submissions. Project managers lacked real-time visibility into resource usage, which meant billing and client reporting cycles were consistently delayed. Left unaddressed, these gaps were directly affecting data accuracy, audit readiness, and the speed at which the business could invoice clients. 3. Solution CloudFronts designed a unified mobile experience using Power Apps Canvas Apps layered on top of Dynamics 365 Project Operations and Dataverse, built around one guiding principle: One App. All Submissions. Controlled Approvals. Real-Time Visibility. For field users, the app became the single place to submit time entries on a daily or weekly basis, create expense entries with automatic receipt handling, log material consumption against the correct project, and track the live status of every submission. For project approvers, the same app surfaced only the entries tied to projects they were actually responsible for, let them approve or reject submissions directly from their phone, and preserved a clean, audit-ready trail for every decision. Day Mode and Week Mode Users could switch between a detailed single-day entry view, useful for precise logging and corrections, and a bulk weekly view that sped up repetitive data entry — letting each person work the way that suited their role. Calendar-Based Swipe Navigation A Dynamics-style calendar with swipe gestures let users move quickly across days and weeks, reviewing or correcting historical entries without friction. Stage-Aware Interface Every record followed the same lifecycle — Submitted, Pending, Approved, Rejected, Recall Requested, Recall Approved, Recall Rejected — and the UI adapted to whatever stage a record was in. Action buttons such as Submit, Approve, Reject, and Recall only appeared when they were actually valid, significantly reducing user confusion and accidental actions. Conditional Receipt Enforcement Rather than requiring a receipt for every expense category, the app applied compliance rules selectively. Receipts were mandatory for airfare and OT hardware purchases, while remaining optional for lower-risk categories such as meals and local transportation. 4. Implementation The technical implementation centered on a unified Dataverse data model and a set of automations that removed manual work from both the field user and the back office. Unified Data Model Time, expense, and material entries were all structured in Dataverse and linked back to the relevant project, resource, approval record, and — for expenses — supporting documentation. Every submission created a record with a clearly defined lifecycle stage, ensuring all three entry types behaved consistently even though their underlying business logic differed. Validation Before Submission The Canvas App enforced field-level validation before allowing a record to be saved, checking that essentials such as transaction date, project, category, quantity, and cost information were populated. If( Or( IsBlank(DatePicker.SelectedDate), IsBlank(ProjectCombobox.Selected), IsBlank(CategoryCombobox.Selected), IsBlank(QuantityInput.Value), IsBlank(PriceInput.Value) ), Notify(“Required fields are missing.”, NotificationType.Error) ) Patch-Based Record Creation Once validation passed, the application used Dataverse Patch operations to create records and calculate derived values such as expense subtotals dynamically based on quantity and unit price. Automated Receipt Handling For expense submissions, the previously manual chain of creating an Expense Receipt record, attaching a file as a Note, converting it to the correct document format, and updating the status to Submitted was fully automated. The Canvas App passed the expense ID, file name, and file content to a Power Automate flow, which created the Expense Receipt record, stored the file as a Note (Annotation) with the correct MIME type, … Continue reading How an Industrial Cybersecurity Company in Texas Improved Field Time and Expense Tracking with Microsoft Power Apps and Dynamics 365 Project Operations →

Building a Controlled Booking-to-Time Entry Import Framework Inside Dynamics 365 Project Operations Summary Two Texas-based firms — one in Cybersecurity, another in Operational Security — required a streamlined and controlled Time Entry (TE) creation process inside Dynamics 365 Project Operations. Native D365 Project Operations limitations around Project Task visibility, booking-driven TE creation, and inconsistent resource submissions created operational inefficiencies. A fully customized solution was implemented directly inside Dynamics 365 CRM using HTML Web Resources, JavaScript, Dataverse Web API, Ribbon Enable Rules, and custom plugins. The solution centralized TE creation under Project Managers and Project Approvers, enabling controlled and secure booking-based TE management. A custom booking import framework dynamically surfaced only authorized projects and resources based on Project Approver relationships. Custom plugin logic and Resource Assignment–based task resolution automated Project Task mapping for accurate Time Entry creation. Key capabilities delivered included controlled booking imports, role-based visibility, automated task association, external comments support, and bulk TE creation. Dynamic filtering ensured Project Managers could only access resources and bookings associated with projects they were authorized to manage. The entire experience operated natively inside Dynamics 365 Project Operations without external portals, Power Apps screens, or third-party applications. The implementation reduced manual effort, improved TE submission reliability, increased operational flexibility, and enabled more accurate tracking of actual project work. Table of Contents Introduction The Business Problem & Pain Points The Solution Architecture Implementation Design Principles Business Impact Why This Approach Worked FAQs Conclusion 1 Introduction Two Texas-based firms operating in the Cybersecurity and Operational Security space relied heavily on Dynamics 365 Project Operations for project delivery tracking, resource management, and operational execution. As project operations scaled, Project Managers and Project Approvers required a faster and more controlled mechanism for creating Time Entries (TEs) directly from resource bookings. The organizations needed a solution that could simplify booking imports, improve Project Task mapping, enforce role-based visibility, and reduce the dependency on individual resources for manual TE submissions. Operationally, Project Managers were often responsible for validating and entering actual work performed, making the standard TE process inefficient and time-consuming. Key Challenges Standard Dynamics 365 Project Operations behavior did not fully support project-task-aware Time Entry creation from bookings. Project Task values were not consistently available across Resource Requirements and bookings in several PO environments. Resource-driven TE submission resulted in inconsistent and delayed operational reporting. Project Managers lacked centralized visibility and controlled access to resource bookings across approved projects. Native booking import and TE creation workflows lacked flexibility for operational governance and scalability. Goals of the Solution Centralize Time Entry creation under Project Managers and Project Approvers. Enable controlled booking imports with role-based project visibility. Automate Project Task association during TE creation. Allow bulk creation of booking-driven Time Entries directly inside CRM. Improve operational accuracy, flexibility, and governance without relying on external applications or custom portals. 2 The Business Problem & Pain Points 1. Native Booking-to-Time Entry Limitations Standard Dynamics 365 Project Operations behavior did not consistently expose Project Task information through Resource Requirements and Bookings. This created gaps in task-aware Time Entry creation and forced users to manually reconstruct operational context during the TE process. 2. Lack of Controlled Booking Visibility Default system behavior provided broader booking visibility than operationally required. The organizations needed a controlled access model where only designated Project Managers and Project Approvers could view and manage booking imports for authorized projects. 3. High Manual Effort in Time Entry Creation Project Managers and operational teams spent significant time manually entering project references, tasks, durations, and external comments for each Time Entry. This increased administrative overhead and reduced operational efficiency. 4. Inconsistent Resource-Driven Submission Process The organizations faced reliability challenges with resource-submitted Time Entries, leading to delays, missing entries, and inconsistencies in operational reporting. Project Managers required centralized ownership over TE creation to ensure accurate work tracking. 5. Fragmented User Experience Users were required to navigate across multiple Dynamics 365 screens and entities to complete routine booking import and Time Entry operations, making the process cumbersome and inefficient for daily operational usage. 6. Scalability and Maintainability Concerns The firms required a lightweight and scalable solution that could operate natively within Dynamics 365 Project Operations without introducing unnecessary Power Apps layers, external portals, or high-maintenance custom applications. 3 The Solution Architecture Architecture Diagram and Flow Figure: Complete Frontend – Backend behaviour of the TE Automation Module. Dynamics 365 Ribbon Workbench A custom “Import Resource Bookings” ribbon action was introduced to provide controlled access to the booking import process only for authorized Project Managers and Project Approvers. JavaScript + Dataverse Web API JavaScript and Dataverse Web API were used to handle dynamic project filtering, approver validation, booking retrieval, task mapping, and automated Time Entry creation directly inside CRM. HTML Web Resources Two custom HTML-based interfaces were developed: Resource Selection Interface — controlled resource visibility and selection Booking Import & TE Creation Interface — booking imports, task selection, external comments, and bulk Time Entry creation Dataverse Plugin Layer A lightweight custom C# plugin was implemented to support Project Task resolution, task validation, and booking-to-Time Entry automation scenarios not fully supported natively in Dynamics 365 Project Operations. Dataverse Entities Involved The solution leveraged multiple Project Operations entities: msdyn_project msdyn_projectteam msdyn_resourceassignment msdyn_projecttask bookableresource msdyn_resourcerequirement bookableresourcebooking msdyn_timeentry Together, these entities enabled secure, project-aware, and task-aware operational workflows directly inside Dynamics 365 CRM. Entity Relationships Figure: Relationships and associations of the involved entities. 4 Implementation 1. Role-Controlled Ribbon Visibility A custom ribbon action was implemented to ensure only authorized Project Managers and Project Approvers could access the booking import functionality. Visibility was dynamically controlled based on project approval relationships inside Dynamics 365. Figure: Case 1: When Logged in as a Project Approver/Manager. Figure: Case 2: When NOT Logged in as a Project Approver/Manager. 2. Resource Selection Experience A custom resource selection interface was developed to display only eligible resources associated with projects managed by the logged-in approver. This provided secure and simplified operational visibility. Figure: Bookable Resource Selection from a list of Active Bookable Resources, which are under any Project, where the current … Continue reading Building a Controlled Booking-to-Time Entry Import Framework Inside Dynamics 365 Project Operations for Texas-Based Operational Security & Cybersecurity Firms →

Summary Designed a two-page Power BI Income Pipeline Report for a Texas-based Cybersecurity & AI Business Solutions firm using Microsoft Dynamics 365 Project Operations. Unified visibility across Opportunity, Unbilled Income, Billed Income, and Paid Income in a single view. Introduced Average Turnaround to forecast realistic cash collection timelines based on actual payment behavior. Integrated Dynamics 365 Project Operations with QuickBooks to connect sales, delivery, invoicing, and cash collection. Enabled a 17-week rolling revenue forecast with week-by-week cash visibility. Provided dual invoice status for contractual vs realistic payment tracking. Table of Contents 1. Introduction 2. The Business Problem 3. Report Structure Overview 4. The Income Pipeline 5. Project Revenue Forecast 6. Design Principles 7. Business Impact 8. FAQs 9. Conclusion 1. Introduction Managing revenue across a professional services firm is rarely straightforward. When your business spans cybersecurity assessments, AI-driven solutions, and long-term managed services engagements, the gap between work being delivered and cash actually landing in the bank can be wide — and costly if left unmonitored. This is precisely the challenge we set out to solve for a U.S.-based Cybersecurity and AI Business Solutions firm running their operations on Microsoft Dynamics 365 Project Operations. The result was a two-page Power BI report — the Income Pipeline Report — that gives leadership a real-time, end-to-end view of every dollar moving through the business: from early-stage opportunity, through unbilled and billed income, all the way to cash collected. This post walks through how the report was built, how each data layer was modelled, and why the design decisions were made the way they were. 2. The Business Problem The firm needed clarity across four distinct but connected stages of their revenue lifecycle: Sales opportunities and pipeline value Delivered but unbilled work Outstanding invoices and expected payments Actual vs expected payment behavior This would answer as well as resolve the following questions – Where are active sales opportunities sitting, and how much pipeline value do they represent? Which project work has been delivered but not yet invoiced? Which invoices have been raised and sent to clients, and when are they realistically going to be paid? And finally, how does actual payment behaviour compare against what was expected? Each of these questions existed in isolation before. Project managers had partial visibility into their own contracts, and needed a comprehensive bird’s eye view of all of these together. Finance had QuickBooks data but lacked the context of the delivery pipeline. Leadership had no consolidated view. The Income Pipeline Report brought all of this together in a single, navigable Power BI experience. 3. Report Structure Overview The report consists of two pages: Income Pipeline Report — a high-level pipeline view across four stages: Opportunity, Unbilled Income, Billed Income, and Paid Income, each with summary cards and interactive donut charts. Project Revenue Forecast — a time-distributed breakdown of expected cash collection across a rolling 17-week horizon, organised by customer and contract. 4. The Income Pipeline The Four-Stage Pipeline Banner Across the top of the report, four chevron-style stage indicators guide the revenue journey: Opportunity → Unbilled Income → Billed Income → Paid Income Each stage includes a summary card showing record count and total value Provides immediate visibility into where revenue is sitting Highlights potential bottlenecks across the pipeline Stage 1 — Opportunity Data sourced from Dynamics 365 Sales using Business Process Flow (BPF) Uses active BPF stage (Develop, Propose, Close) instead of static fields Ensures accurate reflection of real sales progression Estimated revenue pulled directly from opportunity records Donut chart shows distribution across Develop, Propose, and Close stages Stage 2 — Unbilled Income Represents contracted or delivered work not yet invoiced Sourced from project contract lines in Dynamics 365 Project Operations Includes: Fixed Fee milestones (explicit values) Time & Material (T&M) estimates based on resource allocations T&M calculated as allocated hours × billing rate Clearly marked as estimated until billing run is executed Grouped into payment expectation buckets (30, 60, 90, 120, 180+ days) Uses Average Turnaround to forecast realistic payment timing Stage 3 — Billed Income (Confirmed Invoices) Combines Dynamics 365 Project Operations and QuickBooks data Tracks invoices that are confirmed and sent to clients Introduces Average Turnaround: Average days from invoice creation to payment Based on historical payment behaviour Each invoice has two statuses: Contractual (due date) Estimated (based on Average Turnaround) Provides realistic vs contractual payment visibility Includes: Due-date based categorisation Estimated overdue analysis Prevents misleading insights from strict payment terms alone Stage 4 — Paid Income Tracks fully collected invoices Uses QuickBooks for actual payment dates Groups payments by time bands (under 30, 60, 90 days, etc.) Enables comparison between actual vs estimated payment behaviour Continuously improves accuracy of Average Turnaround Tooltip Drill-Down Hover shows: Payment band Record count Total value Drill-through available for detailed record-level analysis 5. Project Revenue Forecast Overview Distributes expected cash collection across a rolling 17-week window Shifts view from pipeline stage to time-based forecasting Hierarchy and Structure Customer → Contract → Revenue Type Revenue types include: T&M run schedules Fixed Fee milestones Confirmed invoices Each row shows: Customer Contract Billing type Average Turnaround Value mapped to expected payment week Weeks range from Week 0 to Week 16 Top row aggregates total expected cash per week Colour Coding Amber — Unbilled income Green — Invoice within terms Red — Overdue (based on estimated payment date) Drill-Through to Detail Click any row to view detailed breakdown Includes: Billed invoices with due and estimated dates Unbilled milestones and run schedules Connects high-level forecast to transactional detail 6. Design Principles Average Turnaround over payment terms Reflects actual customer behaviour instead of contractual assumptions. Dual invoice status Provides both contractual and realistic payment visibility. Consistent time buckets Ensures comparability across Opportunity, Unbilled, Billed, and Paid stages. Weekly forecasting instead of monthly Supports short-term cash flow planning aligned with operational rhythm. 7. Business Impact Improved cash flow predictability Earlier visibility of at-risk invoices Unified cross-team visibility Improved T&M billing discipline Increased accountability 8. FAQs What is Average Turnaround and why does it … Continue reading How we designed & deployed an Income Pipeline Report for a Texas, U.S. based Cybersecurity & AI Business Solutions Firm, via MS D365 Project Operations and Power BI. →

Summary A Houston-based cybersecurity firm eliminated report failures (~65%) by replacing SSRS with an Azure Function App pipeline. Dynamics 365 bound action ensured authentication stayed internal, bypassing Defender-related token failures. Integrated Power Pages, Power Automate, Dynamics 365, and Azure Functions for real-time PDF generation. Report generation time reduced from 3–8 minutes to under 15 seconds with zero infrastructure overhead. Table of Contents 1. About the Customer 2. The Challenge 3. The Solution 4. Technical Implementation 5. Business Impact 6. FAQs 7. Conclusion 1. About the Customer The client is a technology consulting and cybersecurity services firm based in Houston, Texas. They manage multiple concurrent client engagements using Dynamics 365 Project Operations as their core platform. Project managers and clients access live project data through a customer-facing portal built on Microsoft Power Pages. 2. The Challenge The organization needed one-click downloadable Project Status Reports from their Power Pages portal covering risks, issues, logs, and timelines. Their SSRS-based solution failed frequently due to authentication breakdowns caused by Microsoft Defender for Cloud Apps across multiple service boundaries. Key pain points: Silent authentication failures with no clear errors Retry delays of 60–90 seconds per attempt Separate SSRS infrastructure dependency Slow report customization cycle Project managers avoided generating reports during live meetings due to reliability concerns. 3. The Solution At Cloudfronts, while working on this project, I replaced the SSRS pipeline entirely with a synchronous, serverless architecture that keeps the authentication context inside the Dynamics 365 service layer. Technologies Used: Dynamics 365 Project Operations Power Pages Power Automate Plugins Azure Function Apps The solution generates fully formatted PDFs in real time using structured JSON payloads. This eliminated authentication failures while significantly improving speed and reliability. 4. Technical Implementation 1] Power Pages Button triggers Flow A “Download Report” button captures the project GUID and triggers a Power Automate flow with real-time progress feedback. 2] Dynamics 365 Plugin prepares JSON payload A bound action plugin retrieves all project data and converts it into a clean JSON payload for PDF generation. 3] Azure Function generates PDF The Azure Function processes the JSON and generates a formatted PDF, returning it as a Base64 string. 4] SharePoint Integration The generated PDF is automatically stored in the associated SharePoint document location linked to the project. This ensures centralized document management, version control, and easy access for stakeholders directly within the project workspace. 5] Portal PDF Preview The Base64 PDF is rendered directly in the portal using an iframe, allowing instant preview and download. Video: End-to-end implementation of real-time PDF report generation. 5. Business Impact 100% success rate — zero failures post deployment Under 15 seconds report generation time No infrastructure — fully serverless Zero authentication failures Faster iteration for report updates Project managers can now confidently generate reports during live client meetings. 6. FAQs Why not fix the SSRS authentication issue instead of replacing SSRS entirely? The authentication failures were a structural consequence of traversing multiple service boundaries in an environment with strict Defender for Cloud Apps session policies. Fixing them would have required either relaxing those policies — which the client’s security posture did not permit — or re-architecting the data retrieval to stay inside the platform, which is exactly what the bound action approach achieves. Replacing SSRS also removed a separate infrastructure dependency and gave the client full control over report formatting in code. Can this pattern be reused for other document types in Dynamics 365? Yes. The Azure Function App’s renderer is data-driven — it consumes a JSON payload and builds tables from whatever keys are present. The Dynamics 365 plugin can be adapted to query any entity and produce an equivalent payload. CloudFronts has applied the same pattern to inspection records, summary reports, and client-facing status documents across Professional Services and Manufacturing implementations. Does this work for environments without Microsoft Defender for Cloud Apps? Yes. The architectural benefits — synchronous generation, serverless PDF rendering, no SSRS infrastructure, and in-browser preview — apply regardless of the security layer on the environment. 7. Conclusion Replacing SSRS with an Azure Function App-based PDF renderer resolved both the reliability and authentication problems in a single architectural shift, delivering instant, professional-quality Project Status Reports from a Microsoft Power Pages portal with no legacy reporting infrastructure to maintain. The key lesson from this project is that keeping authentication within the Dynamics 365 service layer — rather than bridging to external systems — eliminates an entire category of environment-specific failures that are otherwise very difficult to diagnose and fix. By keeping authentication within Dynamics 365 and leveraging serverless architecture, the solution delivers instant, high-quality reports without infrastructure overhead. This approach demonstrates how modern cloud-native patterns can eliminate entire classes of system failures while improving user experience dramatically. Ready to modernise document generation in your Dynamics 365 environment?CloudFronts builds scalable Power Platform and Dynamics 365 solutions that replace legacy reporting infrastructure and automate document workflows. Reach out at transform@cloudfronts.com. Shashank Keny Associate Consultant · CloudFronts Shashank Keny is an Associate Consultant at CloudFronts with 1.5+ years of experience in cloud, data, and business applications. He specializes in building scalable, API-driven architectures and integrating enterprise systems across the Microsoft ecosystem. He is a Certified Databricks Data Engineer with hands-on experience in Dynamics 365 Project Operations and Dynamics 365 Sales, along with delivering business intelligence solutions using Power BI. His expertise also extends to modern AI solutions, including building custom copilots and implementing intelligent applications using Azure AI Foundry. Passionate about solving real-world business challenges through data and AI, he focuses on delivering efficient, scalable, and production-ready solutions. Experience: 1.5+ years Certification: Databricks Certified Data Engineer Specialization: Dynamics 365 Project Operations, Power BI, Azure Integrations, AI Solutions View LinkedIn Profile

Summary A US-based oil & gas cybersecurity firm implemented a mobile-first Canvas App integrated with Dynamics 365 Project Operations to unify time, expense, and material submission, tracking, and approval. The solution enabled project-specific approval workflows where only assigned approvers could validate submitted records. CloudFronts introduced a dual-mode interface (Day Mode and Week Mode) to improve usability for both field engineers and managers. Submission and approval cycle time reduced from hours/days to near real-time visibility. Table of Contents 1. Customer Scenario 2. Solution Overview 3. Key UX Features 4. Functional Implementation 5. Solution Walkthrough 6. Architecture & Integration Approach 7. Business Impact 8. FAQs 9. Conclusion Customer Scenario A Texas-based cybersecurity firm specializing in operational technology (OT) security for oil rigs manages multiple concurrent field projects using Dynamics 365 Project Operations. Employees and resources were responsible for logging: Time entries Expense entries (travel, accommodation, airfare, etc.) Material usage logs (equipment, parts, consumables, etc.) However, the system was not designed for mobile-first usage, and processes were fragmented across multiple interfaces. Key Challenges Field engineers & other Resources could not efficiently submit entries from mobile devices Time, expense, and material tracking existed in separate workflows Approval processes had to be restricted to project-specific stakeholders Project managers lacked real-time visibility into resource usage • Delays in submission can cause downstream billing and reporting issues Project tracking accuracy can get compromised, and reporting delays directly affected client communication and billing cycles. Solution Overview CloudFronts designed and deployed a unified mobile application using Power Apps (Canvas Apps) integrated with Dynamics 365 Project Operations. Objective: One app → All submissions → Controlled approvals → Real-time visibility What the App Enables For Field Users: Submit time entries (daily or weekly) Create expense entries with receipt validation Log material consumption against projects Track submission status instantly For Project Approvers: View only entries related to assigned projects Approve or reject submissions directly from mobile Maintain audit-ready approval workflows Key UX Features The application is designed with a strong focus on usability for both resources and project approvers, ensuring a seamless mobile experience across submission and approval workflows. 1. Day Mode / Week Mode Toggle The app provides a flexible entry experience through a dual-mode interface: Day Mode: Enables detailed entry for a single day, ideal for precise logging and corrections. Week Mode: Allows bulk entry across multiple days, reducing effort for repetitive data entry. This flexibility significantly improves usability across different working styles and scenarios. 2. Calendar-Based Swipe Navigation The application introduces a Dynamics-style calendar navigation with swipe support, allowing users to: Traverse across multiple days or weeks effortlessly View and manage multiple submission records in sequence Navigate between historical and current entries with minimal effort This mobile-first interaction design reduces friction in high-frequency data entry scenarios. 3. Unified Submission & Approval Experience The UI/UX is intentionally designed to mirror the complete lifecycle of a record, ensuring consistency between submission and approval stages. Each record follows a structured lifecycle aligned with Dynamics 365 stages: Submitted Pending Approved Rejected Recall Requested Recall Request Approved Recall Request Rejected The interface dynamically adapts based on the current stage: Action buttons (Approve, Reject, Recall, etc.) are conditionally visible Status indicators are clearly displayed Users experience the same structured flow from creation to closure This ensures clarity, reduces errors, and improves user confidence in the system. 4. Dynamic Action-Based UI (Smart Button Behavior) The app intelligently modifies UI controls based on record state: Submit button appears only for draft entries Approve/Reject buttons are visible only to project approvers Recall option is available only after submission Post-approval states restrict further edits This enforces role-based and state-based control, preventing invalid actions and maintaining process integrity. 5. Conditional Receipt Upload for Expense Entries Expense submission logic is enhanced with category-driven validation: Mandatory: Airline tickets, OT hardware purchases Optional: Meals, local travel This balances compliance requirements with user convenience, avoiding unnecessary friction. 6. On-Demand Data Refresh Users can manually refresh data within the app to: Fetch the latest submission and approval statuses Sync newly created or updated records Ensure real-time visibility without relying solely on background refresh Especially useful in environments with intermittent connectivity. 7. Mobile-First Interaction Design Touch-friendly controls Swipe navigation Lightweight screens for faster performance Minimal navigation depth This ensures field engineers working in remote or on-site environments can operate efficiently. Functional Implementation This section outlines how the solution was implemented within Dynamics 365 Project Operations and the Power Platform to enable end-to-end submission and approval management. 1. Unified Data Model in Dataverse All three entry types — Time, Expense, and Material — are structured within Dataverse and linked to: Project Resource (User) Approval records Supporting documents (for expenses) Each submission creates a corresponding record with a defined lifecycle stage, ensuring consistency across all entry types. 2. Submission Logic from Canvas App Each submission type follows a structured flow: User selects project and entry type (Time / Expense / Material) Required fields are validated based on entry type Conditional logic enforces: Receipt requirement (for specific expense categories) Mandatory fields (based on business rules) Record is created in Dataverse Submission triggers backend approval workflow This ensures that all records entering the system are complete, validated, and ready for approval processing. 3. Approval Record Creation & Routing Upon submission: A corresponding approval record is automatically created The system identifies project-specific approvers Key behavior: Only assigned project approvers can view and act on records Approval actions update the main record status 4. Record Lifecycle Management (Status-Driven System) Lifecycle: Draft → Submitted → Pending → Approved / Rejected → Recall Flow Users submit records → moves to Submitted Approvers review → Approved or Rejected Users request recall → Recall Requested Approvers respond → Recall Approved or Rejected Controlled through: Power Apps UI logic MS Bound Actions for submission and approval handling Dataverse status fields 5. Expense Receipt Handling (Integrated from Previous Solution) Receipt upload enforced conditionally Files stored as Notes (Annotations) in Dataverse Linked to expense records This eliminates manual document handling and ensures compliance. Solution Walkthrough The following walkthrough … Continue reading How We Built & Deployed a Mobile-Based Canvas App for Unified Time, Expense (with Receipts) & Material Submission with Project-Based Approvals for a US Cybersecurity Firm →

Summary In most CRM implementations, data exposure should be encapsulated for both inside & outside the organization. Sales, Finance, Operations, HR, everyone works in the same system. Collaboration increases. Visibility increases. But so does risk. This is based on real-world project experience, for a practical example I had implemented for a technology consulting and cybersecurity services firm based in Houston, Texas, USA, specializing in modern digital transformation and enterprise security solutions. This blog explains: 1] Why Security Roles alone are not enough. 2] How users can still access data through Advanced Find, etc. 3] What Field-Level Security offers beyond entity-level restriction. 4] Step-by-step implementation. 5] Business advantages you gain. Table of Contents The Real Problem: Intra-Organizational Data Exposure Implementation of Field-Level Security Results Why Was a Solution Required? Business Impact The Real Problem: Intra-Organizational Data Exposure Let’s take a practical cross-department scenario. Both X Department and Y Department work in the same CRM system built on Microsoft Dynamics 365. Entities Involved 1] Entity 1 2] Entity 2 Working Model X Department Fully owns and manages Entity 1 Occasionally needs to refer to specific information in Entity 2 Y Department Fully owns and manages Entity 2 Occasionally needs to refer to specific information in Entity 1 This is collaborative work. You cannot isolate departments completely. But here’s the challenge: Each entity contains sensitive fields that should not be editable — or sometimes not even visible — to the other department. Security Roles in Microsoft Dynamics 365 operate at the entity (table) level, not at the field (column) level. Approach Result Remove Write access to Entity 2 for X Dept X Dept cannot update anything in Entity 2 — even non-sensitive fields Remove Read access to sensitive fields in Entity 2 Not possible at field level using Security Roles Restrict Entity 2 entirely from X Dept X Dept loses visibility — collaboration breaks Hide fields from the form only Data still accessible via Advanced Find or exports This is the core limitation. Security Roles answer: “Can the user access this record?” They do NOT answer: “Which specific data inside this record can the user access?” Implementation of Field-Level Security Step 1: Go to your Solution & Identify Sensitive Fields, usually Personal info, facts & figures, etc. e.g. cf_proficiencyrating. Step 2: Select the field and “Enable” it for Field Level Security (This is not possible for MS Out of the Box fields) Step 3: Go to Settings and then select “Security” Step 4: Go to Settings and then select “Security” -> “Field Security Profiles” Step 5: Either create or use existing Field Security Profile, as required Step 6: Within this one can see all the fields across Dataverse which are enabled for Field Security, Here the user should select their field and set create/read/update privileges (Yes/No). Step 7: Then select the system users, or the Team (having the stakeholder users), and save it. Results: Assume you are a user from X dept. who wants to access Entity 2 Record, and you need to see only the Proficiency Rating & Characteristic Name, but not Effective Date & Expiration Date; now since all fields have Field Level Security they would have a Key Icon on them, but the fields which do not have read/write access for you/your team, would have the Key Icon as well as a “—“. The same thing would happen in Views, subgrids, as well as if the user uses Advanced Find. Why this Solution was Required? The organization needed: 1] Cross-functional collaboration 2] Protection of confidential internal data 3] Clear separation of duties 4] No disruption to operational workflows They required a solution that: 1] Did not block entity access 2] Did not require custom development 3] Enforced true data-level protection Business Impact 1. Confidential Data Protection Sensitive internal data was secured without restricting overall entity access, enabling controlled collaboration. 2. Reduced Internal Data Exposure Risk Unauthorized users could no longer retrieve protected fields via Advanced Find, significantly lowering governance risk. 3. Clear Separation of Duties Departmental ownership of sensitive fields was enforced without disrupting cross-functional visibility. 4. Improved Audit Readiness Every modification to protected fields became traceable, strengthening accountability and compliance posture. 5. Reduced Operational Friction System-enforced field restrictions eliminated the need for entity blocking, duplicate records, and manual approval workarounds. 6. Efficiency Gains The solution was delivered through configuration — no custom code, no complex business rules, and minimal maintenance overhead. I Hope you found this blog useful, and if you would like to discuss anything, you can reach out to us at transform@cloudFronts.com.

In complex business processes, like calculating commissions or validating data across multiple records, applying the same logic repeatedly in a Power Automate flow can quickly become inefficient and difficult to maintain. A more scalable approach is to encapsulate the logic in a Dataverse plugin, expose it as a bound action, and then call this action from a flow. This method centralizes business rules, reduces redundancy, and improves maintainability. In this post, we’ll walk through the steps to implement this approach and examine its advantages over applying the same logic directly within a flow for each individual record. We’ll illustrate this with a practical example from a Houston-based technology consulting and cybersecurity services firm that specializes in modern digital transformation and enterprise security solutions. Flow Diagram Step 1: Create the PluginThe first step is to write a plugin that contains the logic you want to apply to each record. Example: DuplicateCommissionsCounter Step 2: Expose the Plugin as a Bound ActionInstead of running plugin logic manually for each record, you can register it as a bound action in Dataverse. Procedure: E.g. 2. Attach your plugin to this action. Outcome: This exposes your plugin logic as a reusable, callable bound action. Any process or flow can now invoke it for a specific invoice record. Step 3: Use Power Automate to Call the Bound ActionOnce the plugin is exposed, you can loop through multiple records in a flow and call the action. Procedure in Power Automate: This approach ensures that all complex logic resides in the plugin, while the flow orchestrates which records need processing. Advantages Over Logic Directly in the Flow To conclude, exposing plugins as bound actions is a robust, maintainable way to apply complex logic across multiple records in Dataverse. It allows Power Automate flows to focus on orchestration rather than logic execution, leading to cleaner, faster, and easier-to-manage solutions. We hope you found this blog useful, and if you would like to discuss anything, you can reach out to us at transform@cloudfronts.com

It does not matter if an accounting firm is small or big, they can greatly benefit when they use Professional Services Automation Software for CPA Firms. This software provides valuable insights and actionable data related to activities concerning accounting. In a nutshell, PSA software helps in streamlining the processes and will ensure that CPA firms become efficient and productive delivering the work on time.  Why Use PSA Software? As per PMI or Project Management Institute, almost any task related to accounting can be considered as a ‘project.’ Therefore, projects that are considered unique in CPA firms are projects that focus on client-specified deliverables. Tasks such as company audit, tax return, or balance sheet fall under this thing. The accounting processes that we use to complete each of these tasks is different. Thus, we need to approach these cases differently. How PSA Software supports CPAs? PSA software provides CPS firms with digital tools that will enable them to streamline and standardize their processes pertaining to their accounting activities or projects. Since CPA firms provide or sell a wide range of accounting services to their clients, mastering the processes is the only way to become successful in the business and to beat the competition. In so many studies that PMI has carried out, it is understood that corporations that standardize the processes and have a structured or methodical practices are more successful.  As per a few studies they did carry out, the CPA firms who took this approach completed the projects on time and within the stipulated budget 89 per cent of the time.  Whereas companies that did not follow this format completed projects within time and within budget only 36 per cent of the time. CPAs can now tailor and automate the accounting activities using a PSA software so that they can complete their projects in time and within the budget that they have. PSA Software for Accountants Project account which is a crucial component in PSA or professional service automation is quite different from financial accounting in so many different ways. Here is a quick list of some of them for your reference: Financial accounting focuses more on the economic evolution of a company that happens over a period of time such as weekly, quarterly, and annually. Project accounting focuses primarily on deliverables that need to complete in a specified timeframe.  While financial accounting focuses on cost centres as well as the departments, project accounting focuses on activities and tasks.  Financial accounting is useful mainly for a business leader or a stakeholder that has some knowledge and understanding of the accounting principles. Project accounting, however, is a tool that an accountant can use to keep track of things and to focus on completing jobs that are of high priority within time. An accountant is a beneficiary of it rather than a stakeholder.  Software that companies design to tackle financial accounting may not work for project accounting. Get Professional Services Automation Software for CPA Firms if you want to become efficient and to stand out from the tough competition that is out there in the market.

Problem Definition: Post upgrading to V3 I faced issues while importing the time entries from my Resource bookings. This was not the case with V2. In V2 when I went to Import Time Entries from Resource Bookings, it used to pick up all the time entries that were in Active State. Resolution: The resolution to this was simple, but, little tricky. Below are the steps to be followed to get the issue resolved. Step 1: Go to the D365 – Custom App as shown in the below image. This will take you to the classic interface of D365 CRM as shown below. Step 2: Navigate to Settings à Customizations Step 3: Click on Customize the System This will open a screen as shown below. Step 4: Navigate to Entities- Bookable Resource Bookings – Views and open the view named Resource Bookings for Time Entries Import Step 5: Click on Edit Filter Criteria and add a condition Status  – Equals  –  Active These conditions ensure that only Active bookings are to be selected. Then click on OK and Save and Close. Finally, click on Publish All Customizations. Now when you try to import the time entries from Resource booking it will import only the Active time entries and leave behind the canceled time entries. This blog reflects my personal findings and based solely on my experience of using PSA for the last 3+ years. For those who are looking for a platform that can track and manage the entire procedures of sales and project management, I would highly recommend them to try Microsoft dynamics 365 for project service automation.