11.3 SSRS Report Design, Deployment & Security

11.3 SSRS Report Design, Deployment & Security

Quick Answer: Operational document delivery in Dynamics 365 F&O requires mastering report layout design, automated deployment, Print Management routing, and role-based security. Reports are authored in Visual Studio as either Auto Designs (metadata-driven tabular layouts) or Precision Designs (pixel-perfect layouts required for invoices, checks, and pre-printed statutory forms). Deployment in development VMs uses Visual Studio right-click deploy or the PowerShell cmdlet Deploy-AXReport -ReportName <ReportName>, while Tier 2+ and Production environments deploy compiled binaries via Software Deployable Packages (SDPs). The Print Management framework governs document destinations (Screen, Printer/DRA, Email, File, Print Archive) with hierarchical overrides (Module -> Account -> Document). Finally, reports are secured via Output Menu Items bound to Security Privileges, granting report execution without compromising underlying table-level data security.

---

1. Authoring SSRS Reports in Visual Studio: Auto vs. Precision Designs

Developers design SSRS reports within the Dynamics 365 model project in Visual Studio. Inside the Application Object Tree (AOT), reports reside under the Reports node.

Auto Designs vs. Precision Designs

When adding a design node to an SSRS report in Visual Studio, developers must choose between two design paradigms:

┌─────────────────────────────────────────────────────────────────────────────┐
│                     Report Design Paradigm Comparison                       │
├───────────────────┬─────────────────────────────┬───────────────────────────┤
│ Feature           │ Auto Design                 │ Precision Design          │
├───────────────────┼─────────────────────────────┼───────────────────────────┤
│ Design Tool       │ Visual Studio Properties    │ SQL Server Data Tools     │
│                   │ & Metadata Editor           │ (SSDT) Report Designer    │
│ Layout Control    │ High-level structural flow; │ Pixel-perfect exact canvas│
│                   │ system-rendered tables      │ placement (X, Y in mm/pt) │
│ Styling & Themes  │ Automatically applies F&O   │ Manual styling, font sizes│
│                   │ CSS styles and themes       │ borders, and color codes  │
│ Target Use Cases  │ Internal audit listings,    │ External legal documents, │
│                   │ simple tabular registers    │ invoices, checks, customs │
│ Barcode & Images  │ Limited image support;      │ Full barcode fonts, logos,│
│                   │ basic layout placement      │ watermarks, pre-printed   │
│ Maintenance Cost  │ Low; auto-adjusts to schema │ Higher; requires manual   │
│                   │ changes and column widths   │ tablix/expression updates │
└───────────────────┴─────────────────────────────┴───────────────────────────┘

Report Datasets & Tablix Controls

• Datasets: Created under the report's Datasets node. A report can consume multiple datasets populated by queries or RDP classes. Each dataset exposes fields mapped from the staging table decorated with [SRSReportDataSetAttribute].
• Tablix Controls: The core data presentation element in Precision Designs. A Tablix functions as a table, matrix, or hybrid list. Developers configure Row Groups (for grouping transactions by Invoice, Currency, or Customer) and Column Groups (for matrix cross-tabs).
• Report Expressions: Authored using Visual Basic .NET syntax:
  • Formatting Dates: =Format(Fields!TransDate.Value, "yyyy-MM-dd")
  • Formatting Currency: =FormatCurrency(Fields!AmountCur.Value, 2)
  • Conditional Visibility: =IIf(Fields!LineAmount.Value == 0, True, False)
  • Page Numbering: ="Page " & Globals!PageNumber & " of " & Globals!TotalPages
  • Parameter References: =Parameters!CustAccount.Value

---

2. Report Deployment Architecture & Tooling

Report deployment registers report definitions (.rdl), shared datasets, and business logic assemblies with the active SQL Server Reporting Services microservice or report server instance.

Development Environment Deployment (Tier 1 VMs)

In one-box development environments, developers deploy reports using two methods:

1. Visual Studio Solution Explorer: Right-click the report object in the project and select Deploy Reports. Visual Studio compiles the RDL metadata, generates the proxy assembly, and deploys the report to the local SSRS instance (http://localhost/ReportServer).
2. PowerShell Deploy-AXReport Cmdlet: Used for automated command-line deployments, continuous integration validation, or mass redeployments.
   • Deploying a single report:

     Deploy-AXReport -ReportName CustInvoiceReport
     

   • Deploying all reports within a specific module or package:

     Deploy-AXReport -ReportName Sales*
     

   • Deploying every report in the system (mass redeployment):

     Deploy-AXReport -ReportName *
     

Tier 2+ Sandboxes & Production Deployment (ALM Pipeline)

[!IMPORTANT] No Direct Deployment in Tier 2+ and Production Environments: Developers cannot run PowerShell Deploy-AXReport or connect Visual Studio to Tier 2+ sandboxes or Production. All report artifacts must be built in Azure DevOps, packaged into a Software Deployable Package (SDP), uploaded to the LCS Project Asset Library, and deployed via LCS maintenance flows. During package deployment, the automated servicing orchestration deploys all reports included in the package.

---

3. The Print Management Framework

The Print Management framework provides centralized, rules-based document routing for core transactional documents across Accounts Receivable, Accounts Payable, Sales and Marketing, and Procurement.

Supported Document Types

• Customer Invoices, Free Text Invoices, Sales Quotations, Sales Order Confirmations, Packing Slips.
• Purchase Orders, Vendor Invoices, Receipts Lists, Request for Quotations (RFQs).
• Collection Letters, Interest Notes, Project Invoices.

Hierarchical Inheritance Architecture

Print Management settings follow a strict inheritance hierarchy. Lower levels inherit settings from higher levels unless an explicit override is defined:

┌────────────────────────────────────────────────────────┐
│                      Module Level                      │
│ (e.g., Accounts Receivable Parameters > Print Mgmt)    │
└───────────────────────────┬────────────────────────────┘
                            │ Default Fallback
                            ▼
┌────────────────────────────────────────────────────────┐
│                     Account Level                      │
│  (e.g., CustTable > Print Management per Customer)     │
└───────────────────────────┬────────────────────────────┘
                            │ Explicit Customer Override
                            ▼
┌────────────────────────────────────────────────────────┐
│                   Transaction Level                    │
│  (e.g., Specific Sales Order > Print Management Setup) │
└────────────────────────────────────────────────────────┘

Output Destinations

Print Management routes generated documents to five primary destinations:

1. Screen: Renders the document interactively in the HTML5 report viewer inside the browser.
2. Printer (Document Routing Agent / DRA): Cloud-hosted F&O cannot communicate directly with local on-premises network printers across firewalls. The Document Routing Agent (DRA) is a lightweight Windows client installed on a local print server. The DRA authenticates against Microsoft Entra ID, polls Azure Service Bus print queues, downloads generated PDF/EMF print jobs, and routes them to on-premises network printers via standard Windows spoolers.
3. Email: Automatically emails the document as a PDF attachment. Supports dynamic email tokens (e.g., emailing directly to the primary contact email registered on CustTable via @@Email@@).
4. File / SharePoint: Saves the generated PDF, Excel, or Word file to Microsoft SharePoint Online document libraries, Azure Blob Storage, or direct browser file download.
5. Print Archive: Stores an immutable copy of the rendered report in the F&O database/blob storage for regulatory auditing, reprint verification, and non-repudiation.

Overriding Print Destinations Programmatically via Controller

Developers can intercept and redirect print destinations in X++ by manipulating the report controller's print settings before execution:

public class CustInvoicePrintController extends SrsReportRunController
{
    public static void main(Args _args)
    {
        CustInvoicePrintController controller = new CustInvoicePrintController();
        controller.parmReportName(ssrsReportStr(SalesInvoice, Report));
        controller.parmArgs(_args);
        
        // Access print destination settings
        SRSPrintDestinationSettings printSettings = controller.parmReportContract().parmPrintSettings();
        
        // Force output to PDF email
        printSettings.printMediumType(SRSPrintMediumType::Email);
        printSettings.fileFormat(SRSReportFileFormat::PDF);
        printSettings.emailTo("billing@customer.com");
        printSettings.emailSubject("Your Monthly Statement");
        
        // Suppress interactive dialog
        controller.parmShowDialog(false);
        controller.startOperation();
    }
}

---

4. Report Security Architecture & Execution Privileges

Securing operational reports requires understanding the boundary between report execution rights and underlying data security.

Securing via Output Menu Items

In Dynamics 365 F&O, reports and controllers are not directly assigned to security roles. Instead, access is governed through Menu Items:

• Menu Item Type: Reports are exposed to the user interface via Output Menu Items (MenuItemType::Output).
• Object Type & Object: The Output Menu Item points to the Controller Class (ObjectType = Class) or directly to the SSRS report definition.

Role-Based Security Architecture (RBAC)

To grant a user permission to execute a report, developers build security artifacts following the standard hierarchy:

1. Privilege (SecurityPrivilege): The developer creates a privilege (e.g., CustInvoiceReportView) and adds the Output Menu Item to the Entry Points node.
2. Access Level: The Entry Point AccessLevel property is set to Read (or Correct if modifying parameters).
3. Duty (SecurityDuty): The privilege is assigned to a functional duty (e.g., InquireIntoCustomerMaster).
4. Role (SecurityRole): The duty is granted to business roles (e.g., AccountsReceivableClerk).

┌────────────────────────────────────────────────────────┐
│                     Security Role                      │
│            (e.g., Accounts Receivable Clerk)           │
└───────────────────────────┬────────────────────────────┘
                            │ Contains
                            ▼
┌────────────────────────────────────────────────────────┐
│                     Security Duty                      │
│          (e.g., Inquire Into Customer Invoices)        │
└───────────────────────────┬────────────────────────────┘
                            │ Contains
                            ▼
┌────────────────────────────────────────────────────────┐
│                   Security Privilege                   │
│             (e.g., CustInvoiceReportView)              │
└───────────────────────────┬────────────────────────────┘
                            │ Grants Entry Point Access
                            ▼
┌────────────────────────────────────────────────────────┐
│             Output Menu Item (EntryPoint)              │
│       (Points to CustInvoiceReportController)          │
└────────────────────────────────────────────────────────┘

Decoupling Report Execution from Underlying Table Permissions

[!IMPORTANT] Core Security Principle: Execution Privilege vs Table Access When an RDP class executes on the AOS, it runs with elevated system permissions to extract and process data into staging tables. Therefore, a user only requires execute permissions on the Output Menu Item. You do not need to grant the user direct read permissions on the underlying physical tables (CustInvoiceJour, GeneralJournalEntry, etc.). Granting direct table permissions violates the principle of least privilege and exposes confidential relational data to ad-hoc table browsers or unauthorized export.

---

5. Scenario Walk-Through: Multi-Entity Branded Invoicing & Document Routing Agent Deployment

Business Scenario: Global Logistics Enterprise

Contoso Logistics operates distribution centers across North America and Europe. They must implement and deploy a customized Sales Invoice operational document with the following enterprise constraints:

1. Dynamic Branding & Precision Layout: The invoice must print legal entity logos dynamically based on the active company (CompanyInfo), render a Swiss QR-bill 2D barcode at exact millimeter margins for window envelopes, and display structured line groupings with multi-currency subtotals.
2. Conditional Delivery Routing: Customers flagged for electronic billing must receive invoices as PDF attachments sent to their primary billing email (@@Email@@), while other invoices must automatically print on physical high-speed tray printers at the local shipping depot.
3. Secure Cloud-to-On-Premises Printing: The physical printers reside behind corporate firewalls with no inbound ports open to the public internet.
4. Automated ALM Deployment: The customized report must be deployed across development, UAT, and production environments without manual administrator intervention on report servers.

Architectural Solution & Implementation Steps

Step 1: Precision Design Authoring in Visual Studio

• Open Visual Studio and create a new Precision Design on the SalesInvoice report extension named SalesInvoice.PrecisionDesign_EU.
• Configure page size to standard A4 (210 mm x 297 mm) with exact 10 mm margins.
• Add an image control in the page header bound to the database field CompanyInfo.Logo with MIME type image/png.
• Insert a Tablix control bound to the SalesInvoiceTmp dataset. Configure a parent Row Group on InvoiceId and child group on LineNum.
• Add a 2D barcode textbox in the footer configured with font SwissQRBillFont and expression =Code.GenerateQRData(Fields!IBAN.Value, Fields!Amount.Value, Fields!Reference.Value).

Step 2: Print Management Configuration & Dynamic Email Routing

• Navigate to Accounts receivable > Setup > Forms > Form setup > Print management.
• Under Customer invoice, set the default destination to Printer targeting the network warehouse printer.
• Under individual customer accounts (CustTable > General > Print management), configure customer-specific overrides:
  • Set Destination to Email.
  • Set To: @@Email@@ (dynamically resolves the primary email contact associated with the customer party record in Global Address Book).
  • Set File format to PDF.

Step 3: Document Routing Agent (DRA) Setup on Print Server

• Install the Document Routing Agent on a Windows Server located on the internal warehouse network.
• Open the DRA client and authenticate against Microsoft Entra ID using dedicated service principal credentials.
• Enter the Dynamics 365 F&O tenant URL: https://contoso.operations.dynamics.com.
• In F&O, navigate to Organization administration > Setup > Network printers.
• Select the discovered warehouse printers, check Active, and map them to the warehouse distribution queue.
• Configure the DRA to run as a Windows Service so print jobs continue processing unattended after administrative logout.

Step 4: ALM Packaging and Deployment

• In the development environment, test the report definition locally using PowerShell:

  Deploy-AXReport -ReportName SalesInvoice
  

• Commit the report metadata, controller class, and print management extensions to Azure DevOps Git/TFVC.
• The automated build pipeline compiles the package and generates the Software Deployable Package (package.zip).
• Release pipelines upload the SDP to the Lifecycle Services (LCS) Project Asset Library and trigger automated servicing to Tier 2 Sandboxes and Production.

---

6. Real-World Exam Traps: SSRS Design, Deployment & Security

[!WARNING] Exam Trap 1: Attempting to Run Deploy-AXReport in Tier 2+ Sandboxes or Production Candidates frequently choose PowerShell Deploy-AXReport when an exam scenario asks how to deploy a modified report to a UAT sandbox or production environment. Deploy-AXReport is strictly a development tool for Tier 1 development Virtual Machines where developers have administrative OS access. In Tier 2+ and Production, developers cannot run PowerShell cmdlets; all deployments must be packaged into Software Deployable Packages (SDPs) and applied via Lifecycle Services (LCS).

[!WARNING] Exam Trap 2: Granting Direct Table Read Permissions to Report Users When configuring security for an SSRS report, candidates mistakenly add read permissions for transactional tables (like CustInvoiceJour or GeneralJournalEntry) to the user's security role. SSRS Report Data Provider (RDP) classes run in the Application Object Server (AOS) tier under elevated system context. Users only require Read access to the Output Menu Item entry point inside a security privilege. Granting direct table permissions violates least privilege and exposes confidential ERP data.

[!WARNING] Exam Trap 3: Opening Inbound Firewall Ports for Cloud-to-Printer Routing Questions describing cloud F&O printing to on-premises network printers often present distractors like opening TCP port 9100 on the corporate firewall, configuring VPN tunnels, or setting up public static IPs for printers. Cloud F&O never initiates direct inbound connections to local printers. The only correct solution is deploying the Document Routing Agent (DRA) on an internal print server, which uses secure outbound HTTPS/WCF polling to Azure Service Bus queues.

[!WARNING] Exam Trap 4: Hardcoding Print Destinations in RDP Process Logic Instead of the Controller Never attempt to configure print medium types (such as Email, Screen, or Printer) inside the RDP class's processReport() method. By the time processReport() executes, the reporting framework has already negotiated the destination pipeline. Custom print destination overrides and suppression of user dialogs must occur inside the Report Controller class (e.g., in main() or preRunModifyContract()) by manipulating SRSPrintDestinationSettings.