Lattice -- Deployment Guide

Model / module: Lattice (Lattice service surface) Publisher: Magicite Display name: Magicite Lattice Version: 1.0.0 Model ID: 990000048 Layer: ISV (8) License: Commercial; entitlement is checked through Magicite licensing (see Licensing (Siren)). Bundled third-party libraries: Third-party notices Platform: Microsoft Dynamics 365 Finance & Operations (X++)

About this guide. The integration services documented here are the service surface of the Lattice model (publisher Magicite, model module Lattice, model ID 990000048, ISV layer 8). Lattice delivers integration operations (these inbound REST/SOAP operations), data entities and feeds, and outbound business events in one model and one deployable package. Licensing is wired through the shared Siren module, which Lattice requires and which the Lattice packages include (see Licensing (Siren)). AOT element names carry the MGCLattice* prefix, while OData collection names use the Lattice prefix as the public wire contract. The package folder is ...\PackagesLocalDirectory\Lattice\. The descriptor (Descriptor/Lattice.xml) declares 36 module references: 35 standard D365 F&O modules plus the Siren licensing prerequisite (see Module Dependencies and Licensing (Siren)). This guide covers the Lattice service surface only; the data-entity (149 entities) and business-event (81 events across 16 modules) surfaces are documented separately.

Overview
Prerequisites
Model Architecture
Development Environment Setup
Production Deployment -- Cloud-Hosted (LCS)
Production Deployment -- On-Premises
Post-Deployment Validation Checklist
Azure AD App Registration Setup
Security Configuration
Environment Configuration
Service Group and Operation Reference
OData Entity Reference
File Ingestion Setup
OData Entity Metadata Explorer Setup
Database Table Reference
Troubleshooting
Upgrade Path
Appendix A -- Artifact Inventory

1. Overview

Lattice, the service surface of the Lattice model described in the note above, is an ISV-layer X++ model that delivers a comprehensive set of custom SOAP services for Dynamics 365 Finance & Operations. The Lattice service surface exposes 30 services (182 operations) organized into 13 auto-deploying service groups, covering transactional operations across Accounts Receivable, Accounts Payable, Inventory Management, Production Control, General Ledger, Fixed Assets, Project Management, Expense Management, Workflow, and Async Operations, plus the posting of journals that already exist in F&O, sales price inquiry, sales-price trade-agreement maintenance, and just-in-time database access.

All services include both synchronous and batch (bulk) operation variants, built-in call logging, idempotency tracking, and asynchronous operation infrastructure. Three read-only OData entities provide operational monitoring without custom reporting development.

The model is designed for enterprise integration scenarios where external systems (middleware, iPaaS, custom applications) must programmatically execute D365 F&O business operations through authenticated service endpoints.

In addition to the outbound SOAP services, the model ships two companion capabilities:

Lattice File Ingestion -- a performance-oriented, pull-based file integration framework that connects to cloud storage (Azure Blob, Azure File share, or SFTP), pulls large data files on a schedule, claim-checks them into Document Management, decomposes each file into per-record segments, transforms each segment through a configurable Liquid template, and dispatches the result to a target in-F&O service operation. Its cloud connectivity and transforms run in a companion .NET library (MGCLatticeFileIngestion.dll) that the Lattice package deploys with the model. See File Ingestion Setup.
OData Entity Metadata Explorer -- an in-client explorer over the environment's public OData data entities (fields, methods, and parameters), populated by a metadata-refresh batch job. See OData Entity Metadata Explorer Setup.

2. Prerequisites

Platform Requirements

Dynamics 365 Finance & Operations version 10.0.x or later (cloud-hosted or on-premises). Each Lattice release ships one package per supported Finance and Operations version, and a package applies only to an environment on the version it was built for: use the package built for the version your environment runs.
All standard D365 F&O modules installed and configured (the Lattice service surface depends on 17 standard modules directly; the consolidated model declares 36 references in total -- see Module Dependencies below)
The Siren licensing module, which the Lattice packages include -- see Licensing (Siren)
Database access for synchronization of the model's custom tables (185 tables across the consolidated model, 181 of them persisted)

Development Environment Requirements

Only to build your own extensions against Lattice: a Finance and Operations development environment (a development VM with Visual Studio and the Finance and Operations development tools). See Development Environment Setup.

Integration Client Requirements

A Microsoft Entra ID app registration, registered on Microsoft Entra ID applications in Finance and Operations (API permissions are needed only for user-delegated flows; see Section 8)
Client ID and client secret (or certificate) for OAuth 2.0 client credentials flow
Network access to the D365 F&O environment endpoint (HTTPS, port 443)

Licensing (Siren)

Lattice requires Siren. The Lattice descriptor references the shared Siren module (the X++ client for the Magicite licensing service), and licensing is enforced at the Lattice write surface under product id Lattice. Lattice cannot be deployed without Siren.

Where Siren comes from: every Lattice package (the drop and lcs-package artifacts) and the binary-modules artifact carry the compiled Siren module next to Lattice, so applying a Lattice package installs or updates Siren as well. There is nothing to install separately.

What there is not

There is no license key to enter and no activation wizard, and Lattice has no licensing setup page of its own. Administrators never paste a key. Environment identity is derived in-process (tenant + host, hashed into a dedup fingerprint) and licenses are provisioned server-side by the Magicite licensing service on first contact.

Per-environment configuration

Nothing needs to be set. Siren ships with the address of the licensing service, the key that service asks for and its signing keys, and it checks in by itself when the environment starts and once a day. Siren's pages are under System administration > Setup > Siren. They need the Siren license administrator role (SirenLicenseAdministrator) or System administrator; the Lattice roles do not include them.

Siren license parameters holds optional overrides only. Leave the Licensing service connection tab blank: API base URL, APIM subscription key, Issuer and Audience are needed only to use a different licensing service, and then together. The Behavior tab sets Usage telemetry enabled (on by default; it never turns off the license check-in), the Environment type override (it can refine a detected non-production type but never changes a detected production environment), the check-in timeouts, and a Registration ID, used only when Magicite gives you one.
Siren license diagnostics shows the license state: find the Lattice line under Products and live verdicts and read status=.
Siren license refresh checks in now instead of waiting for the daily refresh, for example after a renewal or a network fix.

Lattice itself needs no licensing configuration. It registers itself with Siren once per AOS startup (MGCLatticeLicenseStartup, guarded so a licensing fault can never delay or fault AOS startup) and otherwise only reads the cached verdict.

Check-in when the environment starts. At AOS startup Lattice also schedules the batch job Check in the Lattice license with the licensing service (environment start) (MGCLatticeLicenseCheckInBatch): a one-time runtime job that starts immediately, runs as Admin and runs Siren's forced refresh, which checks in every enabled Siren product with the licensing service, Lattice included. Each check-in carries the installed Lattice version: Siren sends the version of the Lattice model as packageVersion, and the model version of every Lattice package carries its release, the Finance and Operations version it was built for and its build number (for example 1.0.47.12: release 1.0, built for 10.0.47, build 12). The job's log shows the version and the license status it got. The job is scheduled once per environment start: an AOS instance that starts while a check-in is waiting or running, or within 15 minutes of the last one, schedules nothing. Between restarts, Siren's own daily refresh batch keeps checking in. The job needs a running batch server; a failed check-in does not fail the job, and the last verdict stays cached.

What is enforced, and what is not

The gate is a soft check. There is no AxLicenseCode or AxConfigurationKey hard gate; nothing disappears from the AOT.

Surface	Gated?
Write operations (create/post)	Yes - blocked on an adverse verdict
Preview (`PreviewMode`) calls	No - a preview commits nothing, so it stays available
Read/status query operations	No
`MGCLatticeDbAccessService.requestAccess`	Yes - provisioning new elevated access is blocked
`MGCLatticeDbAccessService.revokeAccess`	No - removing access must never be blocked
Lattice data entities (OData/DMF), reads and writes	No - deliberately ungated. Entity writes come from unattended integrations and Data management jobs: nobody would see a warning, and an error would stop operations
`MGCLatticeDmfConfigService.applySpec` (Data management configuration)	No - deliberately ungated for the same reason
business events	No - events are never blocked
UI actions that run Lattice processing (list below)	Yes - the action shows a warning that names it, the license status, and the fix, and does nothing
UI actions while the license is `InGrace`	No - the action runs, after a warning that the license is in its grace period
Setup pages, inquiries, downloads, previews	No
UI safety actions: revoke database access, hold, discard, cleanup, idempotency reconciliation	No - these must always work
Scheduled batch runs of the same jobs	No UI gate - a batch run does not pass through the interactive entry point; the service writes it performs are still gated

Gated UI actions (all through one helper, MGCLatticeLicense::checkUiAction, at the start of the button handler or of the menu item class's interactive main, so both "run now" and "schedule in batch" from the dialog are refused):

File ingestion: Run pull, Run processor (segment processing), segment Release, simulator Run, sample payload Replay.
Dead letters: operations console Retry now and Release, Fix and resubmit, the auto-retry job.
Service test console Run (a real run only; a preview is never gated).
Request database access on the database access page (the service refuses as well).
Inbound order policy evaluation.
Business events: reconciliation sweep, catalog refresh, reference seed, coverage report (it refreshes the catalog), trade agreement price effectivity, workflow stalled alert, and the publish all customers / items / external items resyncs.
APIM bulk export and the configurator's Generate.
Async operation processor (manual run), service metadata refresh, OData metadata refresh, table and entity coverage analysis.

Not gated: every setup page and its New/Delete buttons (including the cross-reference setup on the module parameter pages), the APIM configurator's Validate, connection Test connection, Load samples, the Liquid tester, payload and metadata downloads, the migration template and wide entity Excel exports, the call statistics rollup, and the log cleanup and file ingestion cleanup jobs.

Enforcement blocks only on a definitive adverse verdict: Expired, Invalid, or OfflineExceeded.

It does not block on Unlicensed: the state of a fresh install, a failed registration, or an unreachable licensing service. A fault inside the licensing check itself is likewise treated as "allow".

What an administrator should expect

On a fresh deployment: nothing to do. The status is Unlicensed until the first check-in provisions the environment's license, and Unlicensed blocks nothing.
On a healthy licensed environment: nothing to see. Siren refreshes on AOS startup and on a daily batch.
On a transient licensing service outage: nothing to do. Siren falls back to the cached token and rides it out through the grace/offline window.
When a license genuinely lapses: posting operations begin returning LicenseNotValid and the gated UI actions show a warning and stop, while reads, previews, setup, safety actions, and events keep working.
During the grace period: everything runs, and each gated UI action first warns that the license is in its grace period.

See Section 16 - Service Operation Returns LicenseNotValid for the response shape and the resolution path.

Module Dependencies

The model requires the following standard D365 F&O modules to be present in the environment. These are included in all standard D365 F&O deployments:

Module	Purpose
ApplicationCommon	Base application types and framework
ApplicationFoundation	Core application framework
ApplicationPlatform	Platform runtime services
ApplicationSuite	Standard application modules
ApplicationWorkspaces	Workspace framework
Currency	Currency management types
Dimensions	Financial dimension framework
Directory	Organization and address book
FinanceInsightsContracts	Finance Insights contract types
FiscalBooks	Fiscal document framework
GeneralLedger	General ledger posting engine
Ledger	Ledger account structures
Retail	Retail channel types
SourceDocumentation	Source document framework
SourceDocumentationTypes	Source document type definitions
Subledger	Subledger journal posting
ProcessAutomation	Process automation framework

Consolidated model dependencies (36 references). The 17 modules above are those the service surface uses directly. The full consolidated Lattice descriptor (Descriptor/Lattice.xml) declares 36 module references in total. The additional references -- e.g. Retail, BankTypes, Project, ProjectOperations, Personnel/PersonnelCore/PersonnelManagement, the Enterprise Asset Management modules, Tax/TaxEngine, InboundTransportationManagement, MonitoringAndTelemetry, Calendar, UnitOfMeasure, CaseManagement, and ContactPerson -- are pulled in by the data-entity and business-event surfaces of the consolidated model.

35 of the 36 are standard D365 F&O modules present in any standard deployment. The exception is Siren, the shared Magicite licensing module, which the Lattice packages carry -- see Licensing (Siren) above.

3. Model Architecture

Model Descriptor Properties

Name:               Lattice
Display name:       Magicite Lattice
Publisher:          Magicite
Layer:              ISV (8)
Model ID:           990000048
Model module:       Lattice
Customization:      Allow
VersionMajor:       1
VersionMinor:       0
VersionBuild:       0
VersionRevision:    0

Artifact Summary

The counts below are the consolidated Lattice model as it deploys -- all three capabilities in one package.

Artifact Type	Count	Description
AxClass	631	Services, contracts, business events + event contracts, trigger extensions, tests, infrastructure, file ingestion, OData metadata discovery, licensing wrapper, wizard host, workspace query range functions
AxService	30	Service registrations (incl. price inquiry, sales-price trade agreement, inventory cost (cost calculation and pending price activation), pending vendor invoice posting, posting of existing journals, expense reports, data management configuration and field mappings, and just-in-time DB access)
AxServiceGroup	13	Auto-deploying service groups
AxTable	185	Custom database tables (service monitoring/metadata, idempotency, file ingestion, OData metadata, trade agreements, DB-access audit, cross-reference keys, recurring data job health, and the entities' staging tables); 181 persisted, 2 in-memory, 2 TempDB
AxTableExtension	4	Standard-table extensions
AxDataEntityView	149	OData/DMF data entities (46 read-only, 103 writable; 131 enabled for Data management), including the 33 cross-reference entities and the 15 set-based import entities
AxCompositeDataEntityView	1	Composite entity
AxDataEntityViewExtension	2	Standard-entity extensions
AxEdt	102	Extended data types
AxEnum	35	Status, format, state, log-level, and error-code enums (incl. `MGCLatticeServiceErrorCode`)
AxForm	43	The external systems page, the cross references page and its FactBox, the async operation registry page, the file ingestion class lookup, and 30 navigable pages (the file ingestion operations and integration operations workspaces, file ingestion connections, service metadata explorer, service metadata refresh log, OData entity metadata explorer, service test console, integration operations console, dead-letter fix and resubmit, recurring integration health and details, Liquid template tester, the service call log, service idempotency log, business event log and inbound order policy state inquiries, setup pages) plus 8 list parts hosted in the two workspaces
AxFormExtension	35	Standard-form extensions: Cross references buttons and FactBoxes on 25 standard pages and a Cross references tab on 7 module parameters pages, plus the Data management, retail assortment and DMF entity page extensions
AxSecurityPrivilege	291	Granular privileges (service operations, monitoring, file ingest, metadata explorer and refresh, status queries, test console, statistics, the maintenance-batch `Execute` privileges, the data-entity `View`/`Maintain` pairs, and the cross-reference and external system `View`/`Maintain` pairs), granting 309 entry points in total
AxSecurityDuty	22	Duty aggregations; every privilege reaches its roles through a duty
AxSecurityRole	4	Integration administrator, operator, read-only, and the high-risk database access administrator
AxMenuItemAction	36	Action menu items (metadata refresh, async processor, OData metadata refresh, file ingestion pull/processor/cleanup, service log cleanup, DB-access expiry, idempotency claim Mark succeeded and Release claim, and the recurring integration actions: refresh health, refresh all, activate, deactivate, repair, and add, enable and disable a client application)
AxMenuItemDisplay	58	Display menu items: one per navigable page, plus the ten count-tile items, the eight workspace part items, and the seven per-module Cross references items and the Cross references FactBox item
AxMenuExtension	1	System administration menu extension placing the pages under Setup, Inquiries and Periodic tasks, and registering the two workspaces under Workspaces (default dashboard and navigation pane)
AxLabelFile	1	Label resources
AxRuleSet	1	Rule set
AxQuery	10	Queries behind the workspace count tiles (enabled connections, open dead letters, failed calls in the last 24 hours, held inbound orders, stale and manually parked idempotency claims, unresolved business event errors, and recurring jobs failing or broken, with a backlog, or silent)
AxTile	18	Workspace tiles (10 count, 6 link, 2 workspace registrations)
AxReference	2	C# library references deployed to the AOS `bin` (`MGCLatticeDocumentationGenerator`, `MGCLatticeFileIngestion`)

Security artifacts are enumerated, not detailed, here. Security model documents the role/duty/privilege model. Note in particular that the fourth role, MGCLatticeDatabaseAccessAdministrator, is high-risk and unassigned by default -- see The Database Access Administrator Role.

4. Development Environment Setup

On a development VM, for example to build your own extensions against Lattice, install the compiled Lattice package or keep the compiled modules in your source control. Lattice is delivered as compiled packages only.

Install the compiled package instead of the source

To run Lattice on a development VM (for example, to develop your own extensions against it), install the Lattice LCS software deployable package:

Get the lcs-package artifact of a Lattice release (AXDeployableRuntime_Lattice_<version>.zip), the one built for the Finance and Operations version of the VM. It contains the compiled Lattice and Siren modules.
Copy the zip to a non-user folder on the VM, open its Properties and select Unblock, then extract it.
Open a Command Prompt as administrator in the extracted folder and run:
```
AXUpdateInstaller.exe devinstall
```
The installer doesn't synchronize the database. Synchronize it as described in Synchronize the Database, then verify the service groups.

Keep the compiled modules in your source control

To build your own extensions and packages with Lattice included, commit the compiled modules to your repository instead of installing a package on each machine. This is Microsoft's approach for third-party binaries (Manage third-party models and runtime packages by using source control).

Get the binary-modules artifact of a Lattice release (Lattice_BinaryModules_<version>.zip). It contains the compiled Lattice and Siren module folders (runtime content only, no X++ source) and a README.
Extract it into your repository's Metadata folder, so you have Metadata\Lattice and Metadata\Siren next to your own packages, and commit both folders, including every file in bin. Lattice requires Siren, so keep both at the versions in the same zip.
On development VMs where Metadata is mapped to PackagesLocalDirectory, get the latest version, restart Visual Studio and synchronize the database. Add a module reference to Lattice in the descriptor of each of your models that extends it.
In your build pipeline, make sure the Metadata folder is on the X++ build's metadata or reference folder, and add both modules to the search pattern of the Create Deployable Package task, one per line:
```
$(Build.SourcesDirectory)\Metadata\Lattice
$(Build.SourcesDirectory)\Metadata\Siren
```
Your deployable package then carries Lattice and Siren along with your own modules. To upgrade, replace both folders with the ones from a newer binary-modules artifact.

Synchronize the Database

After installing the package, synchronize the database to create the model's 181 persisted tables (the other 4 of its 185 tables are in-memory or TempDB):

Visual Studio:

Open Extensions > Dynamics 365 > Synchronize database
Wait for synchronization to complete
Verify no errors in the output window

The tables cover service monitoring and metadata, idempotency, async operations and dead letters, file ingestion, OData entity metadata, business event logs and filters, cross-reference keys, trade agreements, database access grants, and the data entities' staging tables. Section 15 describes the service-surface tables.

Verify Service Group Deployment

The service groups deploy automatically with the package (each has AutoDeploy = Yes); there is no page to set them up on. To confirm they are live, open https://{environment-url}/api/services in a browser signed in to the environment and check that all 13 service groups are listed:

MGCLatticeAccountsPayableServiceGroup
MGCLatticeAccountsReceivableServiceGroup
MGCLatticeAsyncOperationServiceGroup
MGCLatticeDataManagementServiceGroup
MGCLatticeDbAccessServiceGroup
MGCLatticeExpenseServiceGroup
MGCLatticeFixedAssetsServiceGroup
MGCLatticeGeneralLedgerServiceGroup
MGCLatticeInventoryServiceGroup
MGCLatticeJournalPostingServiceGroup
MGCLatticeProductionServiceGroup
MGCLatticeProjectServiceGroup
MGCLatticeWorkflowServiceGroup

If one is missing, see Service Group Not Deployed.

5. Production Deployment -- Cloud-Hosted (LCS)

This section covers deployment to a cloud-hosted Dynamics 365 Finance & Operations environment managed through Microsoft Dynamics Lifecycle Services (LCS).

Step 1: Get the Deployable Package

Use the lcs-package artifact of the Lattice release (AXDeployableRuntime_Lattice_<version>.zip, Lattice and Siren, compiled code only), the one built for the Finance and Operations version the environment runs. The drop artifact of the same release holds the Power Platform unified package of the same build, for an environment managed in the Power Platform admin center.

Step 2: Upload to LCS Asset Library

Sign in to Lifecycle Services (https://lcs.dynamics.com)
Open the target project
Navigate to Asset library > Software deployable packages
Click Import (or + to upload)
Upload the deployable package (.zip)
Wait for asset validation to complete (status changes from "Validating" to "Valid")

Step 3: Schedule Deployment

In LCS, open the target environment
Click Maintain > Apply updates
Select the uploaded package from the asset library
Choose a maintenance window:
- Production environments: Schedule during an approved maintenance window with at least 5 hours allocated
- Sandbox environments: Can be applied immediately
Confirm and initiate the deployment
Monitor the deployment status in LCS

Step 4: Post-Deployment Steps

After the deployment completes successfully:

Verify service groups: See Post-Deployment Validation Checklist
Database synchronization: The deployment process runs database synchronization automatically. If tables are missing, check the deployment history for a failed synchronization step (see Database Synchronization Errors) and apply the package again
IIS reset: If service endpoints are not responding, perform an IIS reset through LCS (Maintain > Restart services)
Allowed service operations: a file ingestion connection that routes records through the service-invoke target (MGCLatticeFileIngestServiceInvokeTarget) calls only the operations in its Allowed service operations list, and an empty list allows none. An administrator fills it on the connection's Processing tab, one per line as ServiceClass.operation or ServiceClass.*; the new-connection wizard fills it with the operation chosen in its routing helper. Nothing fills or widens it automatically.
Check the documentation address (optional): The Help icon on every Lattice page opens that page's documentation. It works out of the box: the address defaults to https://go.magicite.tech/documentation. To point it at your own copy of the documentation, see Documentation Help (the Help Icon).

6. Production Deployment -- On-Premises

This section covers deployment to an on-premises Dynamics 365 Finance & Operations environment.

Step 1: Get the Package

Use the same package as described in Step 1 of Cloud-Hosted Deployment: the lcs-package artifact of the Lattice release, built for the Finance and Operations version the environment runs.

Step 2: Upload to LCS (On-Premises Project)

Sign in to LCS and open the on-premises project
Navigate to Asset library > Software deployable packages
Upload the deployable package

Step 3: Apply the Package

On-premises environments take the Lattice package through LCS, as for any deployable package:

Open the target on-premises environment in LCS
Click Maintain > Apply updates
Select the package and schedule the deployment

The deployment synchronizes the database and restarts the services. When it completes, run the Post-Deployment Validation Checklist.

7. Post-Deployment Validation Checklist

Execute the following checks after every deployment to confirm the model is operational.

Service Group Validation

Database Table Validation

Verify the following tables exist (use SQL Server Management Studio or Table Browser):
- MGCLatticeServiceCallLog -- Service call audit log
- MGCLatticeServiceIdempotencyLog -- Duplicate request prevention
- MGCLatticeAsyncOperationTracking -- Async operation status tracking
- MGCLatticeServiceGroupMetadata -- Service group metadata cache
- MGCLatticeServiceMetadata -- Service metadata cache
- MGCLatticeServiceOperationMetadata -- Operation metadata cache
- MGCLatticeServiceMetadataRefreshLog -- Metadata refresh audit log
- MGCLatticeExternalSystem, MGCLatticeCrossReferenceSetup, MGCLatticeCrossReference -- Cross-reference keys (see Cross-reference keys)

OData Entity Validation

Verify OData entities are accessible at the following endpoints (replace {environment-url} with your D365 F&O URL):
- https://{environment-url}/data/LatticeServiceCallLogs
- https://{environment-url}/data/LatticeServiceIdempotencyLogs
- https://{environment-url}/data/LatticeAsyncOperationTrackingRecords
Each endpoint returns HTTP 200 with a valid OData JSON response

Security Validation

UI Validation

Navigate to System administration > Inquiries > Lattice > Services > Service metadata explorer
Verify the Service Metadata Explorer form opens without errors
Verify service metadata is populated (if empty, run the Refresh metadata action)
Navigate to System administration > Inquiries > Lattice > Services > Service test console and verify it opens -- this console invokes any service operation interactively from a JSON request (useful for the endpoint smoke test below, for exercising the *Batch variants, and for validating per-operation logging)
Verify the OData Entity Metadata Explorer form opens; if empty, run the MGCLatticeODataMetadataRefresh action (see OData Entity Metadata Explorer Setup)
Verify the File ingestion connections, File ingestion monitor, and Liquid template tester forms open without errors (see File Ingestion Setup)
Confirm MGCLatticeFileIngestion.dll is present in the AOS bin (required by the file ingestion jobs)
Confirm that every file ingestion connection shows Encrypted or Azure Key Vault reference in Secret storage
(Optional) Run a file ingestion smoke test with the sample file in File Ingestion Setup, Step 5

Process Automation Validation

Navigate to System Administration > Setup > Process automations
Verify Lattice-related process automations are registered
Confirm the process automation scheduler is running (check batch job status)

Service Endpoint Smoke Test

Using a configured Azure AD app registration, execute a test call:

POST https://{environment-url}/api/services/MGCLatticeAccountsReceivableServiceGroup/MGCLatticeSalesOrderPostingService/getSalesOrderStatus
Content-Type: application/json
Authorization: Bearer {access-token}

{
    "_request": {
        "RequestId": "7c9e6679-7425-40de-944b-e07fc1f90ae7",
        "DocumentId": "SO-000001",
        "LegalEntityId": "USMF"
    }
}

Verify the response returns HTTP 200 with a valid JSON payload
Verify call logging with a preview: status queries are not written to the service call log, so send a posting operation with PreviewMode true (for example postGeneralJournal, as in Connect an integration client) and confirm its row on System administration > Inquiries > Lattice > Services > Service call log, with Preview selected

8. Azure AD App Registration Setup

External systems authenticate to D365 F&O service endpoints using OAuth 2.0 client credentials flow. This requires an Azure AD (Entra ID) app registration.

Step 1: Create the App Registration

Sign in to the Azure Portal (https://portal.azure.com)
Navigate to Microsoft Entra ID > App registrations
Click New registration
Configure:
- Name: Lattice Integration Operations - {Environment Name}
- Supported account types: Accounts in this organizational directory only (Single tenant)
- Redirect URI: Leave blank (not required for client credentials flow)
Click Register
Record the Application (client) ID and Directory (tenant) ID

Step 2: Add API Permissions

A client that uses the client credentials flow (service-to-service) needs no API permission: Finance and Operations authorizes it through its registration on Microsoft Entra ID applications (Step 4) and the roles of the user it is mapped to. The Finance and Operations API offers no application permissions. Add permissions only for a client that calls on behalf of a signed-in user:

In the app registration, navigate to API permissions
Click Add a permission
Select Microsoft Dynamics ERP (Microsoft.ERP). If it does not appear, search for the full name
Under Delegated permissions, select at least Access Dynamics AX Custom Service (CustomService.FullAccess), Access Dynamics AX data (Odata.FullAccess) and Access Dynamics AX online as organization users (AX.FullAccess)
Click Add permissions
Click Grant admin consent for {tenant} (requires Global Administrator or Privileged Role Administrator)

Step 3: Create a Client Secret

Navigate to Certificates & secrets
Click New client secret
Configure:
- Description: Lattice Integration - Production
- Expires: 24 months (recommended; set a calendar reminder for rotation)
Click Add
Copy the secret value immediately -- it cannot be retrieved after leaving this page
Store the secret in a secure vault (Azure Key Vault, HashiCorp Vault, or equivalent)

Step 4: Register in D365 F&O

In D365 F&O, navigate to System Administration > Setup > Microsoft Entra ID applications
Click New
Enter the Application (client) ID from Step 1 in Client Id
Enter a Name (e.g., Lattice Integration - Middleware)
Set the User ID to a D365 F&O service account user that has been assigned the MGCLatticeIntegrationAdministratorRole (see Security Configuration)
Click Save

Step 5: Obtain an Access Token (Verification)

Use the following request to verify token acquisition:

POST https://login.microsoftonline.com/{tenant-id}/oauth2/v2.0/token
Content-Type: application/x-www-form-urlencoded

client_id={client-id}
&client_secret={client-secret}
&scope=https://{environment-url}/.default
&grant_type=client_credentials

A successful response returns a JSON object with an access_token field.

9. Security Configuration

Security Model Overview

The model implements a layered security model following D365 F&O security best practices:

MGCLatticeIntegrationAdministratorRole (Security Role)
  |
  +-- MGCLatticeIntegrationServiceOperationsDuty (Duty)
  |     |
  |     +-- MGCLatticeAccountsPayableServiceMaintain (Privilege)
  |     +-- MGCLatticeAccountsReceivableServiceMaintain (Privilege)
  |     +-- MGCLatticeInventoryServiceMaintain (Privilege)
  |     +-- MGCLatticeProductionServiceMaintain (Privilege)
  |     +-- MGCLatticeGeneralLedgerServiceMaintain (Privilege)
  |     +-- MGCLatticeFixedAssetsServiceMaintain (Privilege)
  |     +-- MGCLatticeProjectServiceMaintain (Privilege)
  |     +-- MGCLatticeWorkflowServiceMaintain (Privilege)
  |     +-- MGCLatticeAsyncOperationServiceMaintain (Privilege)
  |
  +-- MGCLatticeIntegrationServiceMonitoringDuty (Duty)
  |     |
  |     +-- MGCLatticeServiceMetadataExplorerPrivilege (Privilege)
  |     +-- MGCLatticeServiceCallLogEntityView (Privilege)
  |     +-- MGCLatticeServiceIdempotencyLogEntityView (Privilege)
  |     +-- MGCLatticeAsyncOperationTrackingEntityView (Privilege)
  |
  +-- MGCLatticeServiceMetadataExplorerDuty (Duty)
  |     |
  |     +-- MGCLatticeServiceMetadataExplorerPrivilege (Privilege)
  |     +-- MGCLatticeServiceMetadataRefreshExecute (Privilege)
  |
  +-- MGCLatticeODataEntityMetadataExplorerDuty (Duty)
  |     |
  |     +-- MGCLatticeODataEntityMetadataExplorerPrivilege (Privilege)
  |
  +-- MGCLatticeFileIngestDuty (Duty)
  |     |
  |     +-- MGCLatticeFileIngestMaintain (Privilege)
  |     +-- MGCLatticeFileIngestView (Privilege)
  |     +-- MGCLatticeFileIngestOperationsView (Privilege)
  |
  +-- MGCLatticeBatchMaintenanceDuty (Duty)
  |     |
  |     +-- MGCLatticeServiceLogMaintenance (Privilege)
  |     |     |
  |     |     +-- Invoke the MGCLatticeServiceLogCleanup log-retention batch job
  |     |
  |     +-- further batch and maintenance privileges (sweeps, rollups, event resends)
  |
  +-- MGCLatticeServiceOperationLogConfigDuty, MGCLatticeFileIngestSimulatorDuty,
  |   MGCLatticeIntegrationInboundInquiryDuty (Duties, one privilege each)
  |
  +-- MGCLatticeCrossReferenceMaintainDuty (Duty)
        |
        +-- MGCLatticeExternalSystemMaintain (Privilege)
        +-- MGCLatticeCrossReference<Module>Maintain (7 Privileges, one per module)

The tree is abridged: the role holds 19 duties and no privileges of its own. Security model lists every duty and privilege.

Assigning the Integration Administrator Role

Navigate to System Administration > Security > Assign users to roles
Select the role Integration administrator
Click Add users
Select the service account user(s) that will be used by integration clients
Click OK to confirm the assignment

Granting Access to the Lattice data entities

The duties MGCLatticeDataEntitiesView (read) and MGCLatticeDataEntitiesMaintain (read/write) secure the model's OData data entities other than the 33 cross-reference entities, and the predefined roles include them: MGCLatticeIntegrationAdministratorRole and MGCLatticeIntegrationOperatorRole hold both, and MGCLatticeIntegrationReadOnlyRole holds MGCLatticeDataEntitiesView. The three monitoring entities (LatticeServiceCallLogs, LatticeServiceIdempotencyLogs, LatticeAsyncOperationTrackingRecords) are granted through MGCLatticeIntegrationServiceMonitoringDuty, which all three roles hold. Each entity grant covers OData access; there is no separate adaptor permission. The 33 cross-reference entities are secured by the per-module cross-reference privileges instead: MGCLatticeCrossReferenceViewDuty (read) is in the operator and read-only roles, and MGCLatticeCrossReferenceMaintainDuty (read/write) is in the administrator role. See Cross-reference keys.

To give entity access to a user who holds none of these roles, or a narrower subset than they grant:

Navigate to System Administration > Security > Security configuration
On the Roles tab, click Create new and name it (e.g. Lattice Data Entity Reader)
Add the duty MGCLatticeDataEntitiesView for read-only access, or MGCLatticeDataEntitiesMaintain for read/write
Save and publish, then assign the role to the integration user alongside its operations role

Every one of the model's 291 privileges reaches at least one predefined role through a duty, and no role holds a privilege directly. Custom roles remain the way to grant a narrower set, as below.

Creating Granular Roles (Optional)

For environments requiring least-privilege access, create custom roles that include only specific duties or privileges. For example, to create a role that can only execute Accounts Receivable operations:

Navigate to System Administration > Security > Security configuration
On the Roles tab, click Create new
Name: Lattice AR Integration Operator
Add only the privilege MGCLatticeAccountsReceivableServiceMaintain
Add the duty MGCLatticeIntegrationServiceMonitoringDuty (for call log access)
Save and publish

The Database Access Administrator Role -- Read Before Granting

The package ships a fourth role, MGCLatticeDatabaseAccessAdministrator ("Database access administrator"), which is high-risk and unassigned by default. Lattice is distributed directly, not through AppSource, so this role ships in the product rather than being left out. Buyers must understand what it confers before granting it.

What it grants. Through MGCLatticeDbAccessAdminDuty → MGCLatticeDbAccessAdminPrivilege, a holder may call MGCLatticeDbAccessService, or use the Database access grants page, to provision just-in-time db_owner access to AxDB -- that is, full control of the application database, outside the F&O security model entirely. A successful requestAccess call:

records the grant's audit row before its database user and firewall rule are created, so a failed or interrupted request leaves a row that the expiry sweep cleans up;
creates a contained database user and adds it to the db_owner role;
opens a database firewall rule for the caller-supplied public IPv4 address;
stores the generated password on the audit row, encrypted with the platform encryption service, so the page's Show password can show it again to the administrator who requested it, while the grant is active and not past its expiry;
returns the generated password on the live response;
is revoked by the expiry sweep once its clamped lifetime of 1--72 hours (default 24) has passed.

Controls that are in place. These are real, and they are also the whole of the mitigation:

The operation is privilege-gated and re-checks the caller's menu-item access in code (defense in depth).
One active grant per administrator -- requesting again revokes all of the caller's active grants first. revokeAccess likewise revokes all of the caller's active grants.
The password is stored only encrypted by the platform encryption service and is never written to telemetry or any persistent log. Every save or decrypt of it writes a platform encryption audit row (SysEncryptionLog).
A failed request is rolled back. A revoke that fails -- while rolling back, on request, or when a new grant replaces an old one -- leaves the grant Active with its expiry moved to now and shows a warning, so the expiry sweep retries it instead of the grant being marked revoked while its database user remains. Failures are recorded in telemetry without sensitive detail.
An expiry batch (MGCLatticeDbAccessExpiry) revokes grants past their deadline, retries failed revokes, marks both Expired and clears their stored password (a revoked grant's password is cleared too). It schedules itself: issuing a grant schedules a one-time sweep for its expiry, each sweep schedules the next one only while grants remain active, and a grant is refused if the sweep cannot be scheduled. See Background processes.
requestAccess is license-gated; revokeAccess deliberately is not.

What it does not do. It does not scope access to particular tables, does not require a second approver, and does not restrict what the grant holder may do once connected. A db_owner grant is unconstrained by F&O security, so it bypasses every role, duty, privilege, and segregation-of-duties control documented in Security model. Audit rows tell you that a grant was issued and to whom; they cannot tell you what was done with it.

Guidance:

Treat it as equivalent to handing out a database administrator credential, because that is what it is.
Leave it unassigned unless you have an operational need. It is not required for any integration, monitoring, or trial activity.
If you must grant it, assign it to as few named administrators as possible, never to a service account or an integration identity, and keep it segregated from the integration operator and read-only roles.
Monitor the grant audit table and treat every grant as an event worth reviewing.
If your governance model cannot accommodate this, keep the role unassigned. Leaving MGCLatticeDbAccessServiceGroup undeployed removes only the REST path (the group contains only this service, so no other Lattice capability is affected); the Database access grants page provisions grants through the same code without it.

Service Account Best Practices

Create a dedicated, non-interactive D365 F&O user for each integration client
Assign the user to the appropriate legal entities (companies)
Set the user's default company to the primary legal entity used in service calls
Do not assign system administrator or other elevated roles to the service account
Enable the user account but do not assign an interactive license

10. Environment Configuration

Batch Server Configuration

Async operations require an active batch server. The *Batch variants of service operations do not: they run their items synchronously within the HTTP call.

Navigate to System Administration > Setup > Batch groups
Verify the Default batch group exists and has at least one batch server assigned
Optionally, create a dedicated batch group for integration operations:
- Name: MGCLatticeIntegration
- Description: Batch group for Lattice integration async operations
- Assign one or more batch servers
Navigate to System Administration > Setup > Server configuration
Confirm the AOS instance is configured as a batch server (checkbox: Batch server)
Set the Maximum batch threads appropriate to workload (recommended: 4-8 for integration operations)

Process Automation Configuration

The model registers its background processes with process automation when it is deployed; each comes with its own schedule, so there is nothing to configure.

Navigate to System administration > Setup > Process automations, Background processes tab.
Verify that the Lattice background processes (their names start with Lattice) are listed and switched on.

Process automation must be initialized in the environment, and the Lattice Async Operation Processing background process (every minute, on the Background processes tab of Process automations) must not be switched off: it dispatches queued asynchronous operations whose own batch job did not run, and the operations that the stale-processing recovery queued again. The stale-processing recovery itself (closing or re-queuing operations left Processing by a stopped batch task) runs in every poll of that process and in every run of the Lattice dead-letter retry background process. The Lattice maintenance jobs run as background processes of the same framework; see Background processes.

Documentation Help (the Help Icon)

The Help icon on every Lattice page opens that page's documentation in a new browser tab. The address defaults to https://go.magicite.tech/documentation (a Magicite pointer that redirects to the current documentation), so no setup is needed. To point it at your own copy of the documentation, an administrator edits the Documentation base URL on the Lattice row in System administration > Setup > Siren > Documentation help. The default is only written while the address is blank, so a value you enter survives every upgrade. To remove the icon, clear Show the Help icon on the same row (a cleared address takes the default again at the next AOS start).

Recommended Environment Parameters

Parameter	Recommended Value	Navigation Path
Batch server max threads	4-8 per AOS node	System Administration > Setup > Server configuration
Async operation timeout	3600 seconds (default)	Configured in service contract
Service call log retention	90 days	The Lattice integration log cleanup background process (`MGCLatticeServiceLogCleanup`) runs daily by itself; the menu item MGCLatticeServiceLogCleanup runs it on demand with other retention values
Idempotency log retention	30 days (Succeeded rows only)	`MGCLatticeServiceLogCleanup` (daily background process)
Business event log retention	90 days (failed rows waiting for a replay are kept)	`MGCLatticeServiceLogCleanup` (daily background process)
Metadata catalog refresh	After each deployment	Nothing refreshes the service and OData catalogs automatically. After a deployment, run Refresh metadata on the Service metadata explorer and Refresh OData metadata on the OData entity explorer (or schedule the two refresh batch jobs)

Log Retention and Cleanup

The high-churn log tables (MGCLatticeServiceCallLog, MGCLatticeServiceIdempotencyLog, MGCLatticeFileIngestLog, MGCLatticeBusinessEventLog and the others below) grow over time. The model ships a retention job, MGCLatticeServiceLogCleanup (a RunBaseBatch class with the menu item of the same name), that purges aged rows with set-based deletes and reports per-table deleted counts to the infolog.

Default retention windows:

Table	Aged by	Default retention
`MGCLatticeServiceCallLog`	`StartDateTimeUtc`	90 days
`MGCLatticeFileIngestLog`	system `createdDateTime`	90 days
`MGCLatticeServiceIdempotencyLog`	`CompletedDateTimeUtc`	30 days (only `Succeeded` rows; in-flight `Processing` claims are never deleted)
`MGCLatticeServiceCallStatistics`	`StatisticsDate`	90 days (the call log window)
`MGCLatticeAsyncOperationTracking`	`SubmittedDateTimeUtc`	30 days (only `Succeeded` and `Failed` rows)
`MGCLatticeIntegrationDeadLetter`	`LastAttemptDateTimeUtc`	90 days (only `Reprocessed` and `Discarded` rows)
`MGCLatticeBusinessEventLog`	system `createdDateTime`	90 days, dialog field Business event log (days) (success rows and failed rows the replay sweep has finished with; a failed row still waiting for a replay is kept)

Scheduling:

Navigate to System administration > Periodic tasks > Lattice > Clean up integration logs (or run the MGCLatticeServiceLogCleanup menu item) and click Batch in the dialog.
Set a recurrence (nightly recommended) and assign the batch group.
Run under the batch service account, which must hold the MGCLatticeServiceLogMaintenance privilege (granted by MGCLatticeBatchMaintenanceDuty, which MGCLatticeIntegrationAdministratorRole includes).

Notes:

The metadata-refresh logs (MGCLatticeServiceMetadataRefreshLog, MGCLatticeODataRefreshLog) are purged by creation date, with the Service metadata refresh log (days) and OData refresh log (days) values of the job dialog.
For deeper archival you can still use the D365 F&O Data Management Framework to export and archive records before truncation.
The MGCLatticeServiceCallLog table stores cross-company data (SaveDataPerCompany = No), so cleanup operations do not need to iterate across legal entities.

Background Processes (Integration Operations)

The Lattice maintenance jobs run as background processes of the process automation framework, so there is no batch job to create. Every database synchronization (each deployment of the package) registers them; the framework then creates a batch job only when a process is due, and for the three reconciliation processes only when there is something to reconcile. Process automation must be initialized in the environment (see above). To see them, change an interval, put a process to sleep for part of the day or switch one off, go to System administration > Setup > Process automations > Background processes.

Background process	Job class	Runs	Purpose
Lattice dead-letter retry	`MGCLatticeIntegrationDlqRetryBatch`	Every 5 minutes, when a dead-letter item is due or re-queued	Replays dead-letter items that are Retrying and due, closes re-queued file-ingestion items whose record has been processed, and recovers asynchronous operations left `Processing` by a stopped batch task. A failed item first waits 60 seconds, then backs off (see the integration operator guide).
Lattice idempotency reconciliation	`MGCLatticeIdempotencyReconciliationSweep`	Hourly, when a claim has been processing for more than 60 minutes	Resolves stranded create-then-post idempotency claims left in `Processing`. For each self-describing stale claim it probes whether the created document exists / was posted, then finalizes the claim (marks it `Succeeded`), releases it (deletes the claim so the request can be retried), or parks it for manual review. See the idempotency reconciliation runbook.
Lattice business event reconciliation	`MGCLatticeBusinessEventReconciliationSweep`	Hourly, when a failed outbound event is at least 15 minutes old	Re-publishes outbound business events that failed, up to 5 attempts each.
Lattice workflow stalled or failed alerts	`MGCLatticeWorkflowStalledAlertBatch`	Hourly	Raises the Workflow stalled or failed business event once for each faulted workflow and each work item pending for more than 24 hours.
Lattice service call statistics rollup	`MGCLatticeServiceCallStatisticsRollup`	Daily	Aggregates `MGCLatticeServiceCallLog` into the daily per-operation `MGCLatticeServiceCallStatistics` table for the last 30 whole UTC days, giving throughput / latency / error reporting without querying the raw call log.
Lattice integration log cleanup	`MGCLatticeServiceLogCleanup`	Daily	Purges aged log rows with the default retention windows above.
Lattice file ingestion cleanup	`MGCLatticeFileIngestCleanup`	Daily	Deletes fully processed file ingestion bundles and their stored files after the connection's retention period (Section 13).
Lattice sales price effectivity events	`MGCLatticeTradeAgreementPriceEffectivityBatch`	Daily	Emits the Effective / Expired sales-price trade-agreement business events by advancing a per-company position: sales prices whose start date has arrived are reported effective, and prices that have lapsed with no successor are reported expired. Complements the change-time trade-agreement events raised on the price-journal post path. The background process covers every legal entity (virtual companies excepted): in each legal entity where the event is active it reports that legal entity's prices from that legal entity's own position, and raises each event in the price's legal entity. Legal entities where neither event is active are skipped.
Lattice recurring data job health alerts	`MGCLatticeRecurringJobHealthAlerts`	Every 15 minutes, when recurring data jobs exist	Evaluates the health of every recurring data job, which keeps Recurring integration health and its workspace tiles current, and raises the Recurring data job health changed business event for each job with alerts on whose health changed.

A background process takes no parameters, so each job runs with the defaults its dialog proposes (retention days, stale minutes, the 24-hour workflow threshold, and so on). The jobs keep their menu items under System administration > Periodic tasks > Lattice (the business event reconciliation and the sales price effectivity job under Periodic tasks > Lattice business events), which run one now with other values. The recurring data job health alerts process has no menu item and no parameters: Refresh all on Recurring integration health evaluates every job on demand and raises the same events. Do not also schedule these jobs as recurring batch jobs: the runs would duplicate each other, and the workflow alert scan remembers what it reported, so a second scan with a different threshold reports the same items again. To run a job on another schedule or with other values, switch its background process off and schedule the job instead. The sales price effectivity job run from its menu item (now or as a batch job) covers only the legal entity it runs in; because each legal entity keeps its own position, such a run never makes the background process send an event twice. Each process runs as its owner, by default the user the database synchronization ran as; the dead-letter retry replays operations as that user, who must have access to them (an administrator can change the owner on the background process).

Other jobs on this surface:

Job	Class / menu item	Cadence	Purpose
Inbound order policy evaluation	`MGCLatticeInboundOrderPolicyEvaluationBatch`	Schedule it frequently (every few minutes) once the policy is enabled	Evaluates pending inbound sales orders against the guardrail policy: a price-tolerance hold (a line priced outside tolerance versus the item base price puts the order on the configured standard price hold, or only flags it when no hold code is set) and auto-confirm of clean orders, and of held orders once their price hold is cleared. Gated on the `MGCLatticeInboundOrderPolicyParameters` master switch (default Off -- the job is inert until the policy is enabled).
Database access expiry sweep	`MGCLatticeDbAccessExpiryBatch` / `MGCLatticeDbAccessExpiry`	Self-scheduling, one-time runs	Revokes every active just-in-time database access grant past its expiry (drops the database user and firewall rule), marks it Expired and clears its stored password, including grants whose revoke failed elsewhere and were left active and due now. Each grant schedules a run at its expiry; a run schedules the next one at the earliest remaining expiry, or 15 minutes later when a revoke failed, and nothing once no grant is active. Needed only where the database access administrator role is used.

The metadata-refresh jobs (MGCLatticeServiceMetadataRefresh, MGCLatticeODataMetadataRefresh) run after each deployment (see above), the async processor (MGCLatticeAsyncOperationProcessor) is its own background process, and the file ingestion pull and segment processor are scheduled as described in Section 13. The privileges for running the maintenance jobs on demand, the async processor and the jobs above, other than the database access expiry sweep, are in MGCLatticeBatchMaintenanceDuty on the integration administrator role.

The database access expiry sweep schedules itself. Before a grant is issued, Lattice checks for a sweep that starts by the grant's expiry; if there is none, it creates the one-time runtime batch job Revoke expired just-in-time database access grants for that time, owned by the requesting administrator. A sweep owned by a user who has since been disabled does not count, because the platform withholds the jobs of a disabled user, so the next grant or revoke schedules a new one. Each run schedules the next run only while grants remain active, so no job keeps running once no grant is active. To run it on demand, use System administration > Periodic tasks > Lattice > Run database access expiry sweep.

The file ingestion cleanup, Clean up file ingestion bundles (MGCLatticeFileIngestCleanup), runs daily as a background process; its menu item under System administration > Periodic tasks > Lattice runs it now.

Not a batch job. MGCLatticeSalesOriginDimensionStamper is a trigger, not a scheduled job: it stamps the configured financial dimension onto SalesTable on insert (via a data event handler), gated on the MGCLatticeSalesOriginDimensionParameters switch. It requires no scheduling.

Per-Operation Logging Configuration

Service-call-log persistence can be tuned per operation through the MGCLatticeServiceOperationLogConfig table (governed by MGCLatticeServiceLoggingPolicy), surfaced under System administration > Setup > Lattice > Service operation logging configuration. Use it to raise or lower the logging level for individual operations -- for example, to suppress full call-log rows for a very high-volume operation while retaining them for operations under audit. Operations without an explicit entry fall back to the default policy. The MGCLatticeServiceCallStatistics rollup (above) is built only from the rows the call log kept: calls to an operation set to Off are not counted in the statistics at all, and an operation set to Errors only is counted only for its failed calls.

11. Service Group and Operation Reference

MGCLatticeAccountsPayableServiceGroup

Accounts Payable services: purchase order posting, product receipt cancellation, purchase prepayment invoices, pending vendor invoices, vendor invoice journals, vendor payment proposals and the generation of vendor payments (checks), and purchase requisitions.

Service	Operation	Description
MGCLatticePurchaseOrderPostingService	`confirmPurchaseOrder`	Confirm a purchase order
	`postPurchasePackingSlip`	Post product receipt
	`invoicePurchaseOrder`	Invoice a purchase order
	`getPurchaseOrderStatus`	Query purchase order status
	`cancelPurchaseProductReceipt`	Cancel a posted product receipt (high-risk)
	`postPurchasePrepaymentInvoice`	Post a purchase order's prepayment invoice, defining the prepayment when the order has none
	`confirmPurchaseOrderBatch`	Bulk confirm purchase orders
	`postPurchasePackingSlipBatch`	Bulk post product receipts
	`invoicePurchaseOrderBatch`	Bulk invoice purchase orders
	`cancelPurchaseProductReceiptBatch`	Bulk cancel product receipts
	`postPurchasePrepaymentInvoiceBatch`	Bulk post prepayment invoices
MGCLatticeVendorInvoiceService	`postPendingVendorInvoice`	Post a pending vendor invoice as the page's Post does
	`postPendingVendorInvoiceBatch`	Bulk post pending vendor invoices
MGCLatticePurchaseReturnService	`createPurchaseReturn`	Create a purchase return order
	`shipPurchaseReturn`	Ship a purchase return
	`creditPurchaseReturn`	Credit a purchase return
	`createPurchaseReturnBatch`	Bulk create purchase return orders
	`shipPurchaseReturnBatch`	Bulk ship purchase returns
	`creditPurchaseReturnBatch`	Bulk credit purchase returns
MGCLatticeVendorInvoiceJournalService	`postInvoiceRegisterJournal`	Post vendor invoice register journal
	`postInvoiceApprovalJournal`	Post vendor invoice approval journal
	`postInvoiceRegisterJournalBatch`	Bulk post invoice register journals
	`postInvoiceApprovalJournalBatch`	Bulk post invoice approval journals
MGCLatticeVendorPaymentProposalService	`generatePaymentProposal`	Generate a vendor payment proposal
	`generatePaymentProposalBatch`	Bulk generate payment proposals
	`generateVendorPayments`	Generate the payments of a vendor payment journal as its Generate payments does: draw the next check of the bank account for each check line, optionally post the journal in the same transaction
	`generateVendorPaymentsBatch`	Bulk generate vendor payments
MGCLatticePurchaseRequisitionService	`submitPurchaseRequisition`	Submit a purchase requisition
	`convertPurchaseRequisitionToOrder`	Convert requisition to purchase order
	`submitPurchaseRequisitionBatch`	Bulk submit purchase requisitions
	`convertPurchaseRequisitionToOrderBatch`	Bulk convert requisitions to orders

MGCLatticeAccountsReceivableServiceGroup

Accounts Receivable services: sales order capture and posting, packing slip cancellation, free text invoices, return orders, sales price inquiry, and sales-price trade-agreement maintenance.

Service	Operation	Description
MGCLatticeSalesOrderPostingService	`confirmSalesOrder`	Confirm a sales order
	`postSalesPackingSlip`	Post packing slip
	`invoiceSalesOrder`	Invoice a sales order
	`getSalesOrderStatus`	Query sales order status
	`cancelSalesPackingSlip`	Cancel a posted packing slip (high-risk)
	`confirmSalesOrderBatch`	Bulk confirm sales orders
	`postSalesPackingSlipBatch`	Bulk post packing slips
	`invoiceSalesOrderBatch`	Bulk invoice sales orders
	`cancelSalesPackingSlipBatch`	Bulk cancel packing slips
MGCLatticeSalesOrderCaptureService	`createSalesOrder`	Create a sales order with its lines (idempotent by `RequestId`)
	`createSalesOrderBatch`	Bulk create sales orders
MGCLatticeFreeTextInvoiceService	`postFreeTextInvoice`	Post a free text invoice
	`cancelFreeTextInvoice`	Cancel a free text invoice
	`postFreeTextInvoiceBatch`	Bulk post free text invoices
	`cancelFreeTextInvoiceBatch`	Bulk cancel free text invoices
MGCLatticeSalesReturnService	`createSalesReturn`	Create a sales return order
	`receiveSalesReturn`	Receive a sales return
	`creditSalesReturn`	Credit a sales return
	`createSalesReturnBatch`	Bulk create sales return orders
	`receiveSalesReturnBatch`	Bulk receive sales returns
	`creditSalesReturnBatch`	Bulk credit sales returns
MGCLatticePriceInquiryService	`resolveSalesPrice`	Resolve the effective sales price for a customer, item, date, and quantity (read-only)
MGCLatticeSalesTradeAgreementService	`setSalesPrice`	Create or post a sales-price trade agreement (forward-only supersession)
	`setSalesPriceBatch`	Bulk create/post sales-price trade agreements

MGCLatticeInventoryServiceGroup

Inventory Management services: inventory journal posting, transfer order processing, item cost calculation, and activating the pending prices (new standard costs) of a costing version.

Service	Operation	Description
MGCLatticeInventoryJournalPostingService	`postMovementJournal`	Post inventory movement journal
	`postAdjustmentJournal`	Post inventory adjustment journal
	`postCountingJournal`	Post inventory counting journal
	`postTransferJournal`	Post inventory transfer journal
	`postBOMJournal`	Post a BOM journal
	`postTagCountingJournal`	Post a tag counting journal
	`postOwnershipChangeJournal`	Post a consignment ownership change journal
	`postMovementJournalBatch`	Bulk post movement journals
	`postAdjustmentJournalBatch`	Bulk post adjustment journals
	`postCountingJournalBatch`	Bulk post counting journals
	`postTransferJournalBatch`	Bulk post transfer journals
	`postBOMJournalBatch`	Bulk post BOM journals
	`postTagCountingJournalBatch`	Bulk post tag counting journals
	`postOwnershipChangeJournalBatch`	Bulk post ownership change journals
MGCLatticeTransferOrderPostingService	`shipTransferOrder`	Ship a transfer order
	`receiveTransferOrder`	Receive a transfer order
	`shipTransferOrderBatch`	Bulk ship transfer orders
	`receiveTransferOrderBatch`	Bulk receive transfer orders
MGCLatticeInventoryCostService	`activatePendingPrices`	Activate the pending prices of a costing version (high-risk: revalues on-hand inventory)
	`activatePendingPricesBatch`	Bulk activate pending prices
	`calculateItemCosts`	Calculate item costs in a costing version and record them as pending cost prices
	`calculateItemCostsBatch`	Bulk calculate item costs

MGCLatticeProductionServiceGroup

Production Control services: production order lifecycle operations.

Service	Operation	Description
MGCLatticeProductionOrderPostingService	`estimateProductionOrder`	Estimate a production order
	`scheduleProductionOrder`	Schedule a production order
	`releaseProductionOrder`	Release a production order
	`startProductionOrder`	Start a production order
	`postPickList`	Post production pick list
	`postRouteCard`	Post production route card
	`reportAsFinished`	Report production as finished
	`endProductionOrder`	End a production order
	`getProductionOrderStatus`	Query production order status
	`estimateProductionOrderBatch`	Bulk estimate production orders
	`scheduleProductionOrderBatch`	Bulk schedule production orders
	`releaseProductionOrderBatch`	Bulk release production orders
	`startProductionOrderBatch`	Bulk start production orders
	`postPickListBatch`	Bulk post pick lists
	`postRouteCardBatch`	Bulk post route cards
	`reportAsFinishedBatch`	Bulk report as finished
	`endProductionOrderBatch`	Bulk end production orders

MGCLatticeGeneralLedgerServiceGroup

General Ledger services: journal posting (lines on main accounts or on customer, vendor and bank accounts) and reversal, payment journals (including prepayments and generated check payments) and payment reversal, budget register entries, and foreign currency revaluation.

Service	Operation	Description
MGCLatticeGeneralLedgerJournalService	`postGeneralJournal`	Post a general ledger journal (lines on main accounts or on customer, vendor and bank accounts)
	`postIntercompanyJournal`	Post an intercompany journal
	`getJournalStatus`	Query journal posting status
	`reverseJournal`	Reverse a posted journal, every voucher or one (high-risk)
	`postGeneralJournalBatch`	Bulk post general journals
	`postIntercompanyJournalBatch`	Bulk post intercompany journals
	`reverseJournalBatch`	Bulk reverse journals
MGCLatticePaymentJournalService	`postCustomerPaymentJournal`	Post a customer payment journal (lines can be prepayments marked against a sales order)
	`postVendorPaymentJournal`	Post a vendor payment journal (lines can be prepayments marked against a purchase order; with `GeneratePayments`, check lines get their checks before posting)
	`settleCustomerTransactions`	Settle customer open transactions
	`settleVendorTransactions`	Settle vendor open transactions
	`reverseCustomerPayment`	Reverse a posted customer payment (high-risk)
	`reverseVendorPayment`	Reverse a posted vendor payment (high-risk)
	`postCustomerPaymentJournalBatch`	Bulk post customer payment journals
	`postVendorPaymentJournalBatch`	Bulk post vendor payment journals
	`settleCustomerTransactionsBatch`	Bulk settle customer transactions
	`settleVendorTransactionsBatch`	Bulk settle vendor transactions
	`reverseCustomerPaymentBatch`	Bulk reverse customer payments
	`reverseVendorPaymentBatch`	Bulk reverse vendor payments
MGCLatticeBudgetRegisterService	`postBudgetEntry`	Post a budget register entry
	`postBudgetTransfer`	Post a budget transfer
	`postBudgetEntryBatch`	Bulk post budget entries
	`postBudgetTransferBatch`	Bulk post budget transfers
MGCLatticeCurrencyRevaluationService	`runCustomerRevaluation`	Run customer foreign currency revaluation
	`runVendorRevaluation`	Run vendor foreign currency revaluation
	`runLedgerRevaluation`	Run ledger foreign currency revaluation
	`runCustomerRevaluationBatch`	Bulk run customer revaluations
	`runVendorRevaluationBatch`	Bulk run vendor revaluations
	`runLedgerRevaluationBatch`	Bulk run ledger revaluations

MGCLatticeFixedAssetsServiceGroup

Fixed Assets services: acquisition posting, depreciation proposals, disposal processing, transactions after acquisition, asset transfers and splits, and the reversal of fixed asset transactions.

Service	Operation	Description
MGCLatticeFixedAssetService	`postAcquisition`	Post a fixed asset acquisition
	`runDepreciationProposal`	Run a depreciation proposal
	`postDisposal`	Post a fixed asset disposal (high-risk)
	`postAssetTransaction`	Post fixed asset transactions after acquisition (acquisition adjustment, depreciation and depreciation adjustment, revaluation, write-up and write-down adjustment, extraordinary and bonus depreciation) in a new fixed asset journal
	`transferAsset`	Transfer an asset to new financial dimensions with the standard asset transfer, and to a new location
	`splitAsset`	Split a fixed asset book by percentage or quantity into a new or existing asset and post the split journal
	`reverseAssetTransaction`	Reverse a posted fixed asset voucher of a book with the standard transaction reversal (high-risk)
	`postAcquisitionBatch`	Bulk post acquisitions
	`runDepreciationProposalBatch`	Bulk run depreciation proposals
	`postDisposalBatch`	Bulk post disposals
	`postAssetTransactionBatch`	Bulk post fixed asset transactions
	`transferAssetBatch`	Bulk transfer assets
	`splitAssetBatch`	Bulk split assets
	`reverseAssetTransactionBatch`	Bulk reverse fixed asset transactions

MGCLatticeProjectServiceGroup

Project Management services: project journal posting and project invoice proposals.

Service	Operation	Description
MGCLatticeProjectJournalService	`postHourJournal`	Post a project hour journal
	`postExpenseJournal`	Post a project expense journal
	`postItemJournal`	Post a project item journal
	`postFeeJournal`	Post a project fee journal
	`postHourJournalBatch`	Bulk post hour journals
	`postExpenseJournalBatch`	Bulk post expense journals
	`postItemJournalBatch`	Bulk post item journals
	`postFeeJournalBatch`	Bulk post fee journals
MGCLatticeProjectInvoiceService	`createInvoiceProposal`	Create a project invoice proposal and optionally post it
	`createInvoiceProposalBatch`	Bulk create invoice proposals

MGCLatticeExpenseServiceGroup

Expense Management services: expense reports from expense tools. Creating a report for a worker follows the expense delegate rule: the caller must be the worker's own user, a current delegate of the worker, or hold the expense administrator, expense agent or system administrator role (see Security model).

Service	Operation	Description
MGCLatticeExpenseReportService	`createExpenseReport`	Create an expense report with its lines for a worker, optionally submitting it to the expense report workflow
	`postExpenseReport`	Post an expense report the workflow approved
	`createExpenseReportBatch`	Bulk create expense reports
	`postExpenseReportBatch`	Bulk post expense reports

MGCLatticeJournalPostingServiceGroup

Journal posting services: post a journal that already exists in the legal entity (entered on its page, imported through data management or created through the standard journal entities) with the journal page's standard posting. The caller must also hold the Lattice operation that posts the journal's type; see Security model.

Service	Operation	Description
MGCLatticeJournalPostingService	`postLedgerJournal`	Post a ledger journal: general, customer or vendor payment, invoice register, vendor invoice, invoice approval, project expense or fixed asset journal
	`postInventoryJournal`	Post an inventory journal: movement, adjustment, counting, transfer, BOM, tag counting, ownership change, project item or fixed asset journal
	`postProjectJournal`	Post a project hour or fee journal
	`postProductionJournal`	Post a production journal: picking list, route card, job card or report as finished
	`postTradeAgreementJournal`	Post a trade agreement journal
	`postLedgerJournalBatch`	Bulk post ledger journals
	`postInventoryJournalBatch`	Bulk post inventory journals
	`postProjectJournalBatch`	Bulk post project journals
	`postProductionJournalBatch`	Bulk post production journals
	`postTradeAgreementJournalBatch`	Bulk post trade agreement journals

MGCLatticeWorkflowServiceGroup

Workflow services: submit, approve, reject, delegate, and recall workflow actions.

Service	Operation	Description
MGCLatticeWorkflowActionService	`submitToWorkflow`	Submit a document to workflow
	`approveWorkItem`	Approve a workflow work item
	`rejectWorkItem`	Reject a workflow work item
	`delegateWorkItem`	Delegate a workflow work item
	`recallWorkflow`	Recall a submitted workflow
	`getWorkflowStatus`	Query workflow status
	`submitToWorkflowBatch`	Bulk submit to workflow
	`approveWorkItemBatch`	Bulk approve work items
	`rejectWorkItemBatch`	Bulk reject work items
	`delegateWorkItemBatch`	Bulk delegate work items
	`recallWorkflowBatch`	Bulk recall workflows

MGCLatticeAsyncOperationServiceGroup

Cross-cutting async operation infrastructure: submit operations for batch processing and poll for completion status.

Service	Operation	Description
MGCLatticeAsyncOperationService	`submitAsyncOperation`	Submit a long-running operation for batch execution
	`getAsyncOperationStatus`	Poll for async operation completion status

MGCLatticeDataManagementServiceGroup

Data management configuration and field mappings: capture an environment's data projects and recurring data jobs as a specification, compare a specification with an environment, apply a specification to another environment, and check and repair the field mappings of data projects.

Service	Operation	Description
MGCLatticeDmfConfigService	`captureSpec`	Read an environment's data projects and recurring data jobs as a specification
	`specFromPackageManifest`	Turn a data package's `Manifest.xml` into a specification
	`diffSpec`	Compare a specification with the environment, member by member, without changing it
	`applySpec`	Make an environment match a specification
MGCLatticeDmfMappingService	`validateMappings`	Check the field mappings of data projects and report every problem (read-only)
	`refreshMappings`	Add missing mappings, remove mappings to fields that no longer exist and, on request, regenerate a stale staging-to-target mapping

MGCLatticeDbAccessServiceGroup

Just-in-time database access services: request and revoke time-bound AxDB db_owner access for controlled break-glass scenarios.

Service	Operation	Description
MGCLatticeDbAccessService	`requestAccess`	Request time-bound `db_owner` access to AxDB
	`revokeAccess`	Revoke all of the caller's active access grants

12. OData Entity Reference

Three read-only OData entities are available for operational monitoring and reporting. All entities have IsPublic = Yes and DataManagementEnabled = No.

LatticeServiceCallLogs

Endpoint: /data/LatticeServiceCallLogs Entity name: MGCLatticeServiceCallLog Description: Audit log recording every custom service invocation with timing, status, and document references for operational monitoring and SLA reporting.

Field	Type	Description
RequestId	Guid	Unique request identifier
CorrelationId	Guid	Correlation identifier for request chaining
ExecutionId	Guid	Execution instance identifier
ServiceName	String(80)	Name of the invoked service
OperationName	String(80)	Name of the invoked operation
LegalEntityId	DataAreaId	Legal entity (company) context
UserContext	UserId	Executing user context
StartDateTimeUtc	UtcDateTime	Operation start timestamp
EndDateTimeUtc	UtcDateTime	Operation end timestamp
DurationMs	Int64	Execution duration in milliseconds
Success	NoYes	Whether the operation succeeded
Status	Enum (MGCLatticeServiceCallStatus)	Operation status
ErrorCode	Enum (MGCLatticeServiceErrorCode)	Machine-readable error classification (`None` on success)
Message	String(1000)	Outcome summary returned to the caller
ErrorDetails	String(1000)	The error messages returned to the caller, separated by `;` (empty when there were none)
DocumentId	String(80)	Related document identifier
IsPreview	NoYes	Whether the call was a preview (`PreviewMode`) that committed nothing

LatticeServiceIdempotencyLogs

Endpoint: /data/LatticeServiceIdempotencyLogs Entity name: MGCLatticeServiceIdempotencyLog Description: Tracks processed service requests by RequestId to prevent duplicate execution of the same operation.

Field	Type	Description
RequestId	Guid	Unique request identifier (primary key)
CorrelationId	Guid	Correlation identifier
ServiceName	String(80)	Name of the invoked service
OperationName	String(80)	Name of the invoked operation
Status	Enum (MGCLatticeServiceCallStatus)	Claim state: `Processing` while the request is in flight, `Succeeded` once finalized (claim-first idempotency). Failed requests delete their claim rather than retaining it.
Success	NoYes	Whether the operation succeeded
DocumentId	String(80)	Related document identifier
ClaimedDateTimeUtc	UtcDateTime	When the in-progress claim was inserted (used for stale-claim takeover)
CompletedDateTimeUtc	UtcDateTime	Completion timestamp
LegalEntityId	DataAreaId	Legal entity the request ran in
DocumentTable	TableName	Table of the document the request created, used by the reconciliation sweep
ReconcileState	Enum (MGCLatticeIdempotencyReconcileState)	Outcome the idempotency reconciliation sweep stamped on a stale claim: `NotReconciled`, `ResolvedSucceeded`, `ReleasedForRetry` or `ManualRequired`

LatticeAsyncOperationTrackingRecords

Endpoint: /data/LatticeAsyncOperationTrackingRecords Entity name: MGCLatticeAsyncOperationTracking Description: Tracks asynchronous operation status and results for monitoring and polling.

Field	Type	Description
TrackingId	Guid	Unique tracking identifier (primary key)
RequestId	Guid	Original request identifier
CorrelationId	Guid	Correlation identifier
ServiceName	String(80)	Name of the service
OperationName	String(80)	Name of the operation
LegalEntityId	DataAreaId	Legal entity context
UserContext	UserId	Executing user context
Status	Enum (MGCLatticeAsyncOperationStatus)	Current operation status
SubmittedDateTimeUtc	UtcDateTime	Submission timestamp
CompletedDateTimeUtc	UtcDateTime	Completion timestamp
DocumentId	String(80)	Related document identifier
Message	String(1000)	Status or result message
ErrorDetails	String(max)	Detailed error information
RequestPayload	String(max)	Original request payload (JSON)
BatchJobId	Int64	Associated batch job identifier

13. File Ingestion Setup

The Lattice File Ingestion framework pulls files from cloud storage, stages them into bundles and segments, transforms each record with a Liquid template, and dispatches the result to a target in-F&O service operation. The Lattice package deploys the companion C# library, and the deployment's database synchronization creates the MGCLatticeFileIngest* tables, so what is left after a deployment is configuring connections and scheduling the jobs.

For full functional detail (connection fields, authentication JSON formats, Liquid templating, monitoring, and troubleshooting), see the File ingestion user guide. This section covers the deployment- and operations-facing steps.

Step 1: Confirm the C# Library Is Deployed

The Lattice package deploys MGCLatticeFileIngestion.dll and its runtime dependencies (Renci.SshNet.dll, Fluid.dll, Parlot.dll, BouncyCastle.Cryptography.dll) to the module bin with the model, so a completed package deployment needs no extra step. Without them, the pull and segment-processing jobs fail to load; if that happens, check that the deployment completed and apply the package again.

Step 2: Configure Security

The file ingestion framework adds the following security artifacts (already aggregated into the Integration administrator role via the MGCLatticeFileIngestDuty duty):

Artifact	Type	Grants
`MGCLatticeFileIngestMaintain`	Privilege	Configure connections and run the pull, processor, and cleanup jobs
`MGCLatticeFileIngestView`	Privilege	Read-only access to the file ingestion monitor
`MGCLatticeFileIngestOperationsView`	Privilege	Read-only access to the file ingestion operations workspace
`MGCLatticeFileIngestDuty`	Duty	Bundles the three privileges above; referenced by `MGCLatticeIntegrationAdministratorRole`
`MGCLatticeFileIngestSimulatorDuty`	Duty	The simulator and sample payloads (`MGCLatticeFileIngestSimulatorPrivilege`); referenced by the administrator and operator roles

Assign the duty (or the full Integration administrator role) to the user(s) and/or batch service account that will configure connections and run the jobs.

Step 3: Create File Ingestion Connections

Each source is configured as an MGCLatticeFileIngestConnection record. Navigate to System administration > Setup > Lattice > File ingestion > File ingestion connections and create a record per source.

Key fields (see the User Guide for the complete reference):

Connection ID / Name -- unique identifier and friendly description.
Storage type -- Azure Blob, File share, or SFTP.
Endpoint / Container or share / Folder path / File pattern -- where to scan and which files to match.
Authentication -- the connection secret, as a small JSON object, or an Azure Key Vault secret URI (see Key Vault secrets). The JSON shape depends on the storage type (connection string / SAS for Azure Blob and File share; host + username + password or private key for SFTP). See the User Guide section "Authentication JSON by storage type" for exact formats. Use scoped, least-privilege credentials with delete permission on the source folder, and write permission on the archive and error folders when they are set (the framework moves or deletes source files after a pull). The field is write-only: the secret is encrypted when you save and is never shown again, so the field stays empty. Type into it only to replace the stored secret; to switch an Azure Blob connection with an Endpoint to the managed identity, enter {}. The read-only Secret storage field beside it shows what is stored (see the note below).

Secret storage. A secret typed in the Authentication field is encrypted with the platform encryption service (Global::editEncryptedField, the mechanism the platform uses for the email SMTP password) and stored in the container field MGCLatticeFileIngestConnection.AuthSecret. The key belongs to the environment, not to a server, so every AOS and batch server can decrypt the secret, whichever server saved it. AuthSecretKvRef holds only a Key Vault reference, which is not a secret. The pull and processing jobs read the secret in-process through MGCLatticeFileIngestSecretProtector::resolveConnectionSecret; it is never displayed. Every save or decrypt writes a platform encryption audit row (SysEncryptionLog); the pull never saves the connection.

Secret storage shows Encrypted, Azure Key Vault reference or Not set.

Database copies. Like other platform-encrypted values such as the email SMTP password, the connection secrets may need to be entered again after the database is copied to another environment. Key Vault references are unaffected.

File format -- XML, JSON, CSV / delimited or Fixed width. For XML and JSON, Record path identifies the records (for example /Orders/Order or $.orders[*]); CSV uses the connection's delimiter, header and quote settings (a new connection reads the first row as the header); fixed width needs the column specification.
Liquid template -- the per-record transformation that emits the payload for the target operation.
Target service class / Target service operation -- the X++ class and method that receive each transformed record.
Allowed service operations -- for a connection that routes records through the service-invoke target, the operations it may call, one per line as ServiceClass.operation or ServiceClass.*. An empty list allows none. The new-connection wizard fills it from its routing helper.
Enabled -- only enabled connections are scanned by the pull job.
Retention (days) -- how long a completed bundle's claim-checked file and staging records are kept before cleanup removes them (must be > 0 for cleanup to act).

Step 4: Schedule the Batch Jobs

The framework is driven by three jobs, each available as an action menu item that can be run interactively. Schedule the pull and the segment processor as recurring batch jobs; the cleanup runs daily by itself as the Lattice file ingestion cleanup background process:

Job	Class / Menu item	Recommended schedule	Notes
Pull	`MGCLatticeFileIngestPull`	Recurring batch, e.g. every 5--15 minutes	Pace to how often files arrive at the source. Lists and ingests files, creates bundles + segments, claim-checks the file, then deletes the source. Only one run works on a connection at a time (a run that finds the connection busy skips it), and a file is picked up only once it is older than the connection's Minimum file age (seconds). With Wait until the file size is stable set, a file is also picked up only once an earlier run saw it at the same size, so a file that is still being uploaded is left for a later run.
Segment processor	`MGCLatticeFileIngestSegmentController`	Recurring batch; can run continuously	On the menu as System administration > Periodic tasks > Lattice > Process file ingestion segments. For parallel throughput, add multiple batch tasks of the segment processor to the same batch job -- each becomes an independent draining worker using a top-picking (`readPast`) pattern.
Cleanup	`MGCLatticeFileIngestCleanup`	Daily background process; nothing to schedule	Removes claim-checked files and staging records for `Processed` bundles older than the connection's Retention (days). Retention of `0` skips deletion. Each run also removes the file sizes recorded for Wait until the file size is stable that were not refreshed for 7 days (their files are gone). On the menu as System administration > Periodic tasks > Lattice > Clean up file ingestion bundles.

To add parallel tasks to the segment processor batch job: open the batch job, then under Batch tasks add additional tasks pointing at the segment controller so multiple threads drain the segment staging table concurrently.

Step 5: Validate

Open System administration > Inquiries > Lattice > File ingestion > File ingestion monitor (form MGCLatticeFileIngestBundleInquiry) and confirm it opens without errors.

Drop a test file in a configured source location and confirm a bundle appears after the next pull, its segments move to Processed, and the source file is deleted. For this smoke test, a small JSON file of two orders works on a connection with File format JSON and Record path orders, which makes one segment per order:

{
  "orders": [
    {
      "orderNumber": "SO-1001",
      "customer": { "id": "US-001", "name": "Contoso Retail" },
      "orderDate": "2026-06-03",
      "lines": [
        { "item": "D0001", "qty": 5 },
        { "item": "D0002", "qty": 2 }
      ]
    },
    {
      "orderNumber": "SO-1002",
      "customer": { "id": "US-004", "name": "Fabrikam Wholesale" },
      "orderDate": "2026-06-03",
      "lines": [
        { "item": "D0003", "qty": 1 }
      ]
    }
  ]
}

The File ingestion user guide walks through the same sample end to end, with a Liquid template for it.

Check the MGCLatticeFileIngestLog for informational, warning, and error entries.

Liquid Template Tester

The model ships a Liquid template tester form (MGCLatticeLiquidTester, opened via System administration > Inquiries > Lattice > File ingestion > Liquid template tester) for authoring and validating per-record Liquid templates without running a full pull cycle. Paste a sample record (for example one order object of the sample in Step 5) and a candidate template to preview the transformed output before saving it on a connection. It needs nothing beyond the package deployment.

14. OData Entity Metadata Explorer Setup

The OData Entity Metadata Explorer provides an in-client view over the environment's public OData data entities -- their fields, methods, and method parameters -- backed by the MGCLatticeODataEntityMetadata, MGCLatticeODataFieldMetadata, MGCLatticeODataEntityMethod, and MGCLatticeODataEntityMethodParameter tables and audited via MGCLatticeODataRefreshLog.

Step 1: Populate the Metadata

The metadata tables are empty until the discovery process runs. Run the MGCLatticeODataMetadataRefresh action menu item, which executes the MGCLatticeODataMetadataRefreshBatch class (a RunBaseBatch that can be run interactively or scheduled as a recurring batch). Schedule it to run periodically (or after major platform/application updates) so the explorer reflects the current set of OData entities.

If the explorer form (MGCLatticeODataEntityMetadataExplorer) shows no records, run MGCLatticeODataMetadataRefresh and check MGCLatticeODataRefreshLog for any errors.

Step 2: C# OData Generators

The OpenAPI and Postman generators behind the Specifications buttons of both explorers are part of the MGCLatticeDocumentationGenerator C# library, which the Lattice package deploys with the model; there is nothing to set up. They read the explorer's stored metadata, so refresh it first: Refresh metadata on the Service metadata explorer, and Step 1 above for the OData entity metadata explorer.

15. Database Table Reference

The model has 185 tables (181 persisted, 2 in-memory, 2 TempDB). This section describes the core tables of the service surface: service monitoring and metadata, file ingestion, and OData entity metadata. The other tables (dead letters, business event logs and filters, cross-reference keys, trade agreements, database access grants, the data entities' staging tables) are described with their features.

Service monitoring and metadata (cross-company, SaveDataPerCompany = No):

Table	Purpose	Table Group
`MGCLatticeServiceCallLog`	Audit log for every service invocation	Transaction
`MGCLatticeServiceIdempotencyLog`	Tracks request IDs to prevent duplicate processing	Transaction
`MGCLatticeAsyncOperationTracking`	Status tracking for async/batch operations	Transaction
`MGCLatticeServiceGroupMetadata`	Cached metadata for service groups	Framework
`MGCLatticeServiceMetadata`	Cached metadata for individual services	Framework
`MGCLatticeServiceOperationMetadata`	Cached metadata for service operations	Framework
`MGCLatticeServiceMetadataRefreshLog`	Audit log for metadata refresh operations	Framework

File ingestion:

Table	Purpose	Table Group
`MGCLatticeFileIngestConnection`	Source connection configuration (storage, format, Liquid template, target service)	Group/Main
`MGCLatticeFileIngestBundle`	One ingested file; holds the claim-check `DocuRef`, source name, size, segment count	Transaction
`MGCLatticeFileIngestProcessedFile`	Records of ingested files (duplicate guard), keyed by path hash and content hash	Transaction
`MGCLatticeFileIngestSegment`	One record extracted from a file; raw + transformed content and processing state (the unit of work)	Transaction
`MGCLatticeFileIngestLog`	Operational log for pull, processing, and cleanup jobs	Transaction

OData entity metadata:

Table	Purpose	Table Group
`MGCLatticeODataEntityMetadata`	Discovered public OData data entities	Framework
`MGCLatticeODataFieldMetadata`	Fields per OData entity	Framework
`MGCLatticeODataEntityMethod`	Methods exposed by an OData entity	Framework
`MGCLatticeODataEntityMethodParameter`	Parameters per OData entity method	Framework
`MGCLatticeODataRefreshLog`	Audit log for OData metadata refresh operations	Framework

Index Reference

MGCLatticeServiceCallLog:

DateTimeIdx (clustered) -- StartDateTimeUtc
RequestIdx -- RequestId
ServiceOperationIdx -- ServiceName, OperationName
CorrelationIdx -- CorrelationId

MGCLatticeServiceIdempotencyLog:

RequestIdx (clustered, unique, alternate key) -- RequestId
ServiceOperationIdx -- ServiceName, OperationName

MGCLatticeAsyncOperationTracking:

TrackingIdx (clustered, unique, alternate key) -- TrackingId
RequestIdx -- RequestId
StatusIdx -- Status, SubmittedDateTimeUtc

16. Troubleshooting

Service Group Not Deployed

Symptom: One or more Lattice service groups are missing from https://{environment-url}/api/services, or calls to their endpoints return HTTP 404.

Resolution: Service groups have no setup page in Finance and Operations; they deploy automatically with the package.

Confirm the Lattice package finished deploying to this environment, including the database synchronization (deployment history in Lifecycle Services or the Power Platform admin center)
On a development or cloud-hosted VM, perform an IIS reset and reload the endpoint list:
```
iisreset /noforce
```
On a VM, check the Windows Event Log (Application) for deployment errors
If a group is still missing, deploy the package again

HTTP 401 Unauthorized

Symptom: Service calls return HTTP 401: the call carries no valid token for this environment.

Resolution:

Verify the token request uses the correct scope value: https://{environment-url}/.default
Check that the app's client secret has not expired (navigate to Azure Portal > App registrations > Certificates & secrets)
Request the token from the tenant of the environment (https://login.microsoftonline.com/{tenant-id}/oauth2/v2.0/token), and request a new token before the current one expires
For a user-delegated flow only, verify the delegated permissions and the admin consent of Step 2

HTTP 403 Forbidden

Symptom: Service calls return HTTP 403 with a valid token.

Resolution:

Verify the app is registered in D365 with its client ID: System Administration > Setup > Microsoft Entra ID applications. A valid token for an app that is not registered there gets HTTP 403
Confirm the D365 user the app is mapped to (User ID) exists and is enabled
Verify that user has a Lattice role that grants the operation, for example MGCLatticeIntegrationAdministratorRole (see Security Configuration)
Check that the security role, duties, and privileges have been published:
- Navigate to System Administration > Security > Security configuration
- On the Roles tab, select the role and verify it contains the expected duties
- If the Unpublished objects tab lists changes, select Publish all
Rebuild the security index data: on Security configuration, select Repair on the action pane

Service Operation Returns `LicenseNotValid`

Symptom: A posting or other write operation returns a non-success response with error code LicenseNotValid, IsRetryable = true, and a message of the form "The Magicite Lattice license is not valid (status {status}). Posting operations are unavailable until it is renewed." MGCLatticeDbAccessService.requestAccess throws the equivalent error. A gated UI action (see What is enforced) shows the warning "{action} is not available because the Lattice license is not valid (status {status}) ..." and does nothing; each such refusal writes the telemetry event Lattice.License.UiActionBlocked with the Action and LicenseStatus dimensions.

Read operations, status queries, PreviewMode previews, OData/DMF entity access, and business events continue to work normally. This is by design -- see Licensing (Siren).

Meaning: The licensing service returned a definitive adverse verdict for product id Lattice. The status in the message tells you which (the message shows the status name, for example Offline exceeded):

Status	Meaning	Resolution
`Expired`	The license term ended	Renew with Magicite, then force a refresh (below)
`Invalid`	The licensing library reported a license state that this version of Siren does not recognize, so it is treated as adverse	Force a refresh (below); if the status stays `Invalid`, contact Magicite
`OfflineExceeded`	The environment has not reached the licensing service within the permitted offline window	Restore outbound connectivity to the licensing service, then refresh

Note that IsRetryable is true because the condition is resolved by renewing or reconnecting, not by changing the request. The identical call will succeed once the license is restored -- callers should not treat this as a payload error and should not rebuild the request.

Resolution:

Confirm which status you are in from the message text, and match it to the table above.
On System administration > Setup > Siren > Siren license parameters, check that the Licensing service connection overrides (API base URL, APIM subscription key, Issuer, Audience) are blank, unless Magicite asked you to use a different licensing service.
Verify the AOS has outbound network access to the licensing service. A firewall or proxy change is the usual cause of OfflineExceeded.
Force a license refresh rather than waiting for the daily batch: run System administration > Setup > Siren > Siren license refresh, then read the Lattice line on Siren license diagnostics.
Re-run the failed operation. No payload change is required.
If the status remains adverse after a successful refresh, the license itself needs attention -- contact Magicite.

Diagnostics: each refusal writes a telemetry event Lattice.License.OperationBlocked carrying the LicenseStatus and RequestId dimensions, so blocked calls are countable and correlatable. Siren additionally records an activation row per refresh attempt.

A never-registered environment is not affected. Status Unlicensed is allowed through by design, so a fresh or disconnected install will never produce this error. If you are seeing LicenseNotValid, a verdict was obtained and it was adverse.

Service Operation Returns Empty or Null Response

Symptom: A service operation executes without error but returns empty data.

Resolution:

Verify the request payload contains valid identifiers (e.g., the sales order, journal, or document exists in the target legal entity)
Confirm the LegalEntityId (company/DataAreaId) in the request matches the legal entity where the data resides
Check the MGCLatticeServiceCallLog table for the request details and status
Review the service registration XML to confirm the operation name is spelled correctly in the request

Database Synchronization Errors

Symptom: Database sync fails or tables are not created after deployment.

Resolution:

Verify all model dependencies are present (see Module Dependencies)
Check that the package is the one built for the environment's Finance and Operations version
Open the deployment history in Lifecycle Services or the Power Platform admin center, find the failed synchronization step, and read its log for the table or field that failed
Apply the package again once the cause is fixed; the deployment repeats the synchronization. On a development VM, synchronize from Visual Studio (Extensions > Dynamics 365 > Synchronize database)

Process Automation Not Running

Symptom: Scheduled process automations do not execute.

Resolution:

Navigate to System Administration > Setup > Process automations
Verify the process automation type is registered
Check that the schedule is active and the recurrence is configured
Navigate to System Administration > Inquiries > Batch jobs
Verify the batch framework is running: on System Administration > Setup > Server configuration, check that at least one server is a batch server, and on Batch jobs, check that jobs are executing
Check for stuck or failed batch jobs and resolve

Metadata Not Populated in Service Metadata Explorer

Symptom: The Service Metadata Explorer form shows no records.

Resolution:

Open the Service Metadata Explorer form: System administration > Inquiries > Lattice > Services > Service metadata explorer
Click the Refresh metadata button (action pane)
If the refresh does not populate data, run the batch-based metadata refresh:
- Navigate to System Administration > Periodic tasks
- Run the MGCLatticeServiceMetadataRefresh batch job
Choose Service metadata refresh log on the Service metadata explorer and look for errors written during the refresh

Performance Degradation Under Load

Symptom: Service operations slow down during high-volume bulk processing.

Resolution:

Increase batch threads: System Administration > Setup > Server configuration > increase Maximum batch threads
Distribute batch execution across multiple AOS nodes
Verify SQL Server performance:
- Check for index fragmentation on MGCLatticeServiceCallLog (high-write table)
- Review execution plans for the custom tables
Implement service call log cleanup to reduce table size (see Log Retention and Cleanup)
For bulk operations, prefer the *Batch variants, which process many items in one synchronous call rather than one call per item

OData Entity Metadata Explorer Empty

Symptom: The OData Entity Metadata Explorer form shows no records.

Resolution:

Run the MGCLatticeODataMetadataRefresh action menu item (executes MGCLatticeODataMetadataRefreshBatch) to populate the metadata tables.
Schedule the refresh to run periodically and after platform/application updates.
Check the MGCLatticeODataRefreshLog table for errors during the refresh.

File Ingestion Jobs Fail to Load or No Files Processed

Symptom: The pull or segment-processing jobs throw assembly-load errors, or files are never picked up / segments stay Queued.

Resolution:

Confirm the Lattice package deployment completed: it deploys MGCLatticeFileIngestion.dll and its runtime dependencies to the module bin (see Step 1 of File Ingestion Setup). If they are missing, apply the package again.
Verify the connection is Enabled and the Folder path / File pattern are correct, and that credentials have list (and delete) permission.
Verify MGCLatticeFileIngestSegmentController is scheduled and running (segments stuck in Queued usually mean the processor is not running).
Inspect the MGCLatticeFileIngestLog and the per-segment error messages in the monitor. See the File ingestion user guide for the full troubleshooting matrix.

17. Upgrade Path

ISV Layer Isolation

The model is deployed to the ISV layer (layer 8). This provides the following isolation guarantees:

No conflicts with standard D365 updates: The model does not overlay standard application objects; it changes standard behavior only through extensions (chain of command, event handlers, table, form and entity extensions; see Process customizations). Microsoft platform and application updates do not overwrite it.
No conflicts with customer customizations: Customer extensions in the VAR, CUS and USR layers sit above the ISV layer.
Safe side-by-side operation: AOT elements use the MGCLattice prefix and OData collections the Lattice prefix, so they do not collide with standard or third-party objects.

Pre-Upgrade Steps

Export service call logs: Export the MGCLatticeServiceCallLog data using the Data Management Framework if historical data must be preserved across the upgrade.
Document current configuration: Record the current Azure AD app registrations and security role assignments.

During D365 Platform/Application Updates

Before moving an environment to a new Finance and Operations version, get the Lattice package built for that version and apply it in the same update. A Lattice package applies only to an environment on the Finance and Operations version it was built for, and each Lattice release ships one package per supported version. Then run the Post-Upgrade Validation.

Post-Upgrade Validation

Execute the full Post-Deployment Validation Checklist after every upgrade, with particular attention to:

All 13 service groups deployed and accessible
OData entities returning data
A smoke test of at least one service operation per service group
Process automation schedules are still active
Security role assignments are intact
The Data management entity list has been refreshed and affected data projects remapped (see After an upgrade that changes staging tables)

Model Version Updates

To take a new Lattice release, apply its deployable package as described in Section 5 (on premises, Section 6), the one built for the environment's Finance and Operations version. The deployment synchronizes the database, creating any new tables and fields, and redeploys the service groups. Before you apply it, review the changelog for changes to the service contracts you use; afterwards, run the Post-Upgrade Validation.

Platform-Encrypted Secrets

File ingestion connection secrets and just-in-time database access grant passwords are stored with the platform encryption service (Global::editEncryptedField / appl.EncryptForPurpose, the mechanism the platform uses for the email SMTP password). The key belongs to the environment, so any AOS or batch server can read them.

Database copies: like other platform-encrypted values such as the email SMTP password, these secrets may need to be entered again after a database is copied to another environment. Key Vault references are unaffected.

Appendix A -- Artifact Inventory

AxClass Files (service surface)

The model has 631 classes in all; this inventory lists the classes of the service surface.

Service Implementation Classes (29): MGCLatticeSalesOrderPostingService, MGCLatticeSalesOrderCaptureService, MGCLatticePurchaseOrderPostingService, MGCLatticeTransferOrderPostingService, MGCLatticeInventoryJournalPostingService, MGCLatticeInventoryCostService, MGCLatticeProductionOrderPostingService, MGCLatticeSalesReturnService, MGCLatticePurchaseReturnService, MGCLatticeFreeTextInvoiceService, MGCLatticeGeneralLedgerJournalService, MGCLatticePaymentJournalService, MGCLatticeWorkflowActionService, MGCLatticeBudgetRegisterService, MGCLatticeProjectJournalService, MGCLatticeProjectInvoiceService, MGCLatticeFixedAssetService, MGCLatticeVendorPaymentProposalService, MGCLatticeVendorInvoiceJournalService, MGCLatticeVendorInvoiceService, MGCLatticeCurrencyRevaluationService, MGCLatticePurchaseRequisitionService, MGCLatticeAsyncOperationService, MGCLatticePriceInquiryService, MGCLatticeSalesTradeAgreementService, MGCLatticeJournalPostingService, MGCLatticeExpenseReportService, MGCLatticeDmfConfigService, MGCLatticeDbAccessService

Infrastructure Classes: MGCLatticeOrderPostingServiceBase, MGCLatticeReturnServiceBase, MGCLatticeServiceMetadataExplorerEventHandler, MGCLatticeServiceMetadataRefreshBatch, MGCLatticeServiceContractSampleGenerator

Data Contract Classes (the core request and response contracts; API reference gives the contract of every operation): MGCLatticeOrderOperationResponseContract, MGCLatticeBulkOperationResponseContract, MGCLatticeBulkItemResultContract, MGCLatticeStatusQueryRequestContract, MGCLatticeStatusQueryResponseContract, MGCLatticeDimensionValueContract, MGCLatticeAsyncOperationRequestContract, MGCLatticeAsyncOperationResponseContract, MGCLatticeAsyncOperationStatusContract, MGCLatticeSalesOrderConfirmRequestContract, MGCLatticeSalesOrderPackingSlipRequestContract, MGCLatticeSalesOrderInvoiceRequestContract, MGCLatticeSalesPackingSlipCancelRequestContract, MGCLatticeSalesPostingLineContract, MGCLatticePurchaseOrderConfirmRequestContract, MGCLatticePurchaseOrderPackingReceiptRequestContract, MGCLatticePurchaseOrderInvoiceRequestContract, MGCLatticePurchaseProductReceiptCancelRequestContract, MGCLatticePurchasePrepaymentInvoiceRequestContract, MGCLatticePurchPostingLineContract, MGCLatticeTransferOrderShipRequestContract, MGCLatticeTransferOrderReceiveRequestContract, MGCLatticeTransferPostingLineContract, MGCLatticeInventJournalPostRequestContract, MGCLatticeInventJournalLineContract, MGCLatticeInventBOMJournalPostRequestContract, MGCLatticeInventBOMJournalLineContract, MGCLatticeInventTagJournalPostRequestContract, MGCLatticeInventTagJournalLineContract, MGCLatticeInventOwnershipJournalPostRequestContract, MGCLatticeInventOwnershipJournalLineContract, MGCLatticePendingPriceActivationRequestContract, MGCLatticeItemCostCalculationRequestContract, MGCLatticeProductionOrderActionRequestContract, MGCLatticeProductionStartRequestContract, MGCLatticeProductionEndRequestContract, MGCLatticeProductionPickListPostRequestContract, MGCLatticeProductionPickListLineContract, MGCLatticeProductionRouteCardPostRequestContract, MGCLatticeProductionRouteCardLineContract, MGCLatticeProductionReportFinishedRequestContract, MGCLatticeSalesReturnReceiveRequestContract, MGCLatticeSalesReturnCreditRequestContract, MGCLatticePurchaseReturnShipRequestContract, MGCLatticePurchaseReturnCreditRequestContract, MGCLatticeReturnLineContract, MGCLatticeFreeTextInvoicePostRequestContract, MGCLatticeFreeTextInvoiceLineContract, MGCLatticeFreeTextInvoiceCancelRequestContract, MGCLatticeGeneralJournalPostRequestContract, MGCLatticeGeneralJournalLineContract, MGCLatticeJournalReversalRequestContract, MGCLatticePaymentJournalPostRequestContract, MGCLatticePaymentJournalLineContract, MGCLatticePaymentReversalRequestContract, MGCLatticeSettlementRequestContract, MGCLatticeSettlementLineContract, MGCLatticeWorkflowSubmitRequestContract, MGCLatticeWorkflowActionRequestContract, MGCLatticeWorkflowRecallRequestContract, MGCLatticeBudgetEntryPostRequestContract, MGCLatticeBudgetEntryLineContract, MGCLatticeCurrencyRevaluationRequestContract, MGCLatticeProjectJournalPostRequestContract, MGCLatticeProjectJournalLineContract, MGCLatticeProjectInvoiceProposalRequestContract, MGCLatticeFixedAssetAcquisitionRequestContract, MGCLatticeFixedAssetAcquisitionLineContract, MGCLatticeFixedAssetDepreciationRequestContract, MGCLatticeFixedAssetDisposalRequestContract, MGCLatticeFixedAssetTransactionRequestContract, MGCLatticeFixedAssetTransactionLineContract, MGCLatticeFixedAssetTransferRequestContract, MGCLatticeFixedAssetSplitRequestContract, MGCLatticeFixedAssetReversalRequestContract, MGCLatticeVendorPaymentProposalRequestContract, MGCLatticeVendorPaymentGenerationRequestContract, MGCLatticeVendorInvoiceJournalPostRequestContract, MGCLatticeVendorInvoiceJournalLineContract, MGCLatticePendingVendorInvoicePostRequestContract, MGCLatticePurchReqActionRequestContract, MGCLatticeLedgerJournalPostingRequestContract, MGCLatticeJournalPostingRequestContract, MGCLatticeTradeAgreementJournalPostingRequestContract, MGCLatticeExpenseReportCreateRequestContract, MGCLatticeExpenseReportLineContract, MGCLatticeExpenseReportPostRequestContract

Service Endpoint URLs

All service operations are accessible via the following URL pattern:

https://{environment-url}/api/services/{ServiceGroupName}/{ServiceName}/{OperationName}

Example:

https://contoso.operations.dynamics.com/api/services/MGCLatticeAccountsReceivableServiceGroup/MGCLatticeSalesOrderPostingService/confirmSalesOrder

This document describes the deployment of the Lattice service surface of the consolidated Magicite Lattice model (v1.0.0). For questions or support, contact your Magicite Lattice administrator.

Table of Contents​

1. Overview​

2. Prerequisites​

Platform Requirements​

Development Environment Requirements​

Integration Client Requirements​

Licensing (Siren)​

What there is not​

Per-environment configuration​

What is enforced, and what is not​

What an administrator should expect​

Module Dependencies​

3. Model Architecture​

Model Descriptor Properties​

Artifact Summary​

4. Development Environment Setup​

Install the compiled package instead of the source​

Keep the compiled modules in your source control​

Synchronize the Database​

Verify Service Group Deployment​

5. Production Deployment -- Cloud-Hosted (LCS)​

Step 1: Get the Deployable Package​

Step 2: Upload to LCS Asset Library​

Step 3: Schedule Deployment​

Step 4: Post-Deployment Steps​

6. Production Deployment -- On-Premises​

Step 1: Get the Package​

Step 2: Upload to LCS (On-Premises Project)​

Step 3: Apply the Package​

7. Post-Deployment Validation Checklist​

Service Group Validation​

Database Table Validation​

OData Entity Validation​

Security Validation​

UI Validation​

Process Automation Validation​

Service Endpoint Smoke Test​

8. Azure AD App Registration Setup​

Step 1: Create the App Registration​

Step 2: Add API Permissions​

Step 3: Create a Client Secret​

Step 4: Register in D365 F&O​

Step 5: Obtain an Access Token (Verification)​

9. Security Configuration​

Security Model Overview​

Assigning the Integration Administrator Role​

Granting Access to the Lattice data entities​

Creating Granular Roles (Optional)​

The Database Access Administrator Role -- Read Before Granting​

Service Account Best Practices​

10. Environment Configuration​

Batch Server Configuration​

Process Automation Configuration​

Documentation Help (the Help Icon)​

Recommended Environment Parameters​

Log Retention and Cleanup​

Background Processes (Integration Operations)​

Per-Operation Logging Configuration​

11. Service Group and Operation Reference​

MGCLatticeAccountsPayableServiceGroup​

MGCLatticeAccountsReceivableServiceGroup​

MGCLatticeInventoryServiceGroup​

MGCLatticeProductionServiceGroup​

MGCLatticeGeneralLedgerServiceGroup​

MGCLatticeFixedAssetsServiceGroup​

MGCLatticeProjectServiceGroup​

MGCLatticeExpenseServiceGroup​

MGCLatticeJournalPostingServiceGroup​

MGCLatticeWorkflowServiceGroup​

MGCLatticeAsyncOperationServiceGroup​

MGCLatticeDataManagementServiceGroup​

MGCLatticeDbAccessServiceGroup​

12. OData Entity Reference​

LatticeServiceCallLogs​

LatticeServiceIdempotencyLogs​

LatticeAsyncOperationTrackingRecords​

13. File Ingestion Setup​

Step 1: Confirm the C# Library Is Deployed​

Step 2: Configure Security​

Step 3: Create File Ingestion Connections​

Table of Contents

1. Overview

2. Prerequisites

Platform Requirements

Development Environment Requirements

Integration Client Requirements

Licensing (Siren)

What there is not

Per-environment configuration

What is enforced, and what is not

What an administrator should expect

Module Dependencies

3. Model Architecture

Model Descriptor Properties

Artifact Summary

4. Development Environment Setup

Install the compiled package instead of the source

Keep the compiled modules in your source control

Synchronize the Database

Verify Service Group Deployment

5. Production Deployment -- Cloud-Hosted (LCS)

Step 1: Get the Deployable Package

Step 2: Upload to LCS Asset Library

Step 3: Schedule Deployment

Step 4: Post-Deployment Steps

6. Production Deployment -- On-Premises

Step 1: Get the Package

Step 2: Upload to LCS (On-Premises Project)

Step 3: Apply the Package

7. Post-Deployment Validation Checklist

Service Group Validation

Database Table Validation

OData Entity Validation

Security Validation

UI Validation

Process Automation Validation

Service Endpoint Smoke Test

8. Azure AD App Registration Setup

Step 1: Create the App Registration

Step 2: Add API Permissions

Step 3: Create a Client Secret

Step 4: Register in D365 F&O

Step 5: Obtain an Access Token (Verification)

9. Security Configuration

Security Model Overview

Assigning the Integration Administrator Role

Granting Access to the Lattice data entities

Creating Granular Roles (Optional)

The Database Access Administrator Role -- Read Before Granting

Service Account Best Practices

10. Environment Configuration

Batch Server Configuration

Process Automation Configuration

Documentation Help (the Help Icon)

Recommended Environment Parameters

Log Retention and Cleanup

Background Processes (Integration Operations)

Per-Operation Logging Configuration

11. Service Group and Operation Reference

MGCLatticeAccountsPayableServiceGroup

MGCLatticeAccountsReceivableServiceGroup

MGCLatticeInventoryServiceGroup

MGCLatticeProductionServiceGroup

MGCLatticeGeneralLedgerServiceGroup

MGCLatticeFixedAssetsServiceGroup

MGCLatticeProjectServiceGroup

MGCLatticeExpenseServiceGroup

MGCLatticeJournalPostingServiceGroup

MGCLatticeWorkflowServiceGroup

MGCLatticeAsyncOperationServiceGroup

MGCLatticeDataManagementServiceGroup

MGCLatticeDbAccessServiceGroup

12. OData Entity Reference

LatticeServiceCallLogs

LatticeServiceIdempotencyLogs

LatticeAsyncOperationTrackingRecords

13. File Ingestion Setup

Step 1: Confirm the C# Library Is Deployed

Step 2: Configure Security

Step 3: Create File Ingestion Connections