Quick answer. As of September 2026, Dynamics 365 Supply Chain Management documents the core of an FDA-regulated manufacturer’s traceability and record controls (batch and serial registration from component to finished product, item tracing forward and back, quality orders and batch holds, and electronic signatures with a logged audit trail), but its as-built genealogy browser, the Traceability add-in, is a preview feature Microsoft says is not meant for production use, item tracing runs one legal entity at a time, and Microsoft states that no Part 11 certification exists, so the configured system is yours to validate. Microsoft’s Food and Drug Administration CFR Title 21 Part 11 page, last updated December 4, 2025, says “Customers who build and deploy applications subject to FDA regulation are responsible for ensuring that their applications meet FDA requirements”, and 21 CFR 11.10(a) lists “Validation of systems to ensure accuracy, reliability, consistent intended performance, and the ability to discern invalid or altered records.” Whether Supply Chain Management is the right platform at all is a separate decision, covered in Dynamics 365 ERP for the Regulated Enterprise: Modernizing or Replacing Legacy ERP.
The question usually arrives in the middle of an ERP selection. The quality head asks a plain one: if a component lot turns out to be bad, can the new system say which finished lots used it and which customers received them, and how fast. In the same week someone on the selection team calls the platform Part 11 compliant, and nobody can point to a Microsoft document that says so, because Microsoft’s own compliance page says no Part 11 certification exists. This checklist takes the manufacturer’s FDA records one at a time and sorts each into three piles: what Supply Chain Management documents as a feature today, what rests on a preview feature, and what stays with the manufacturer to configure, test and validate. It quotes what 21 CFR parts 11, 820 and 211 say in the Electronic Code of Federal Regulations and what Microsoft documents on Microsoft Learn. It does not decide whether a product, a site or a record falls under a given part; that call belongs to the manufacturer’s regulatory affairs and quality functions.
The recall trace: can it follow a component lot to every finished lot and customer?
A recall starts with one suspect component lot and one deadline, and the first failure mode is a trace that stops before it reaches the customer. The regulation defines the unit being traced. Under 21 CFR 820.3(a), in the Quality Management System Regulation for devices, “Batch or lot means one or more components or finished devices that consist of a single type, model, class, size, composition, or software version that are manufactured under essentially the same conditions and that are intended to have uniform characteristics and quality within specified limits.” For drug products, 21 CFR 211.188(b)(3) asks the batch production and control record for “Specific identification of each batch of component or in-process material used”. Part 820 carries two traceability lines this page names only as the eCFR states them: section 820.10(b)(2) says “the manufacturer must document procedures for traceability in accordance with the requirements of part 821 of this chapter, if applicable.” and section 820.35(c) says “In addition to the requirements of Clauses 7.5.1, 7.5.8, and 7.5.9 in ISO 13485, the UDI must be recorded for each medical device or batch of medical devices.”
On the Supply Chain Management side, the registration is documented. According to Microsoft’s Register and track batch/serial numbers for finished products and their components page, last updated August 13, 2025, “Workers and managers can register batch/serial numbers for materials and components that are used in manufacturing processes.” and “They can also then associate those numbers with the batch/serial numbers of the products that are produced.” The same page lists its conditions: the product must be defined as serial controlled or batch controlled, and the system must run Supply Chain Management version 10.0.40 or later with the Tracked components feature turned on; Microsoft adds, “As of Supply Chain Management version 10.0.45, this feature is turned on by default.”
The trace itself is documented too, and so are its limits, which decide how a recall drill has to be scripted. According to Microsoft’s Item and raw material tracing in inventory, production, and sales page, last updated May 22, 2026, “Manufacturers can trace items, raw materials, or ingredients back to the vendor, and forward through the production and sale of the finished product.” The precondition is explicit: “You can trace an item or raw material only if you assign a tracking dimension to it.” Then the limits, in Microsoft’s words: “Because tracing is based on inventory transactions, some limitations exist when you trace items.” “Additionally, co-products appear in the trace details, but by-products aren’t included.” “The trace displays for one legal entity at a time.” “The trace doesn’t include cross-company capabilities in an intercompany context.” “You must start a new trace for each company where an item is received or issued.” And the trace is a snapshot: “The trace details aren’t updated if the information changes after the trace is done.”
Planning rules for this record:
- Set the tracking dimensions on every regulated item before go-live; an item without one cannot be traced later.
- If lots cross legal entities, script the recall trace across them in the demo, and write down the manual step of starting a new trace in each company.
- Treat each trace as a dated snapshot and re-run it when the record changes, rather than relying on an earlier result.
- Test whether and where the UDI is recorded for each device or batch; none of the Microsoft pages read for this checklist says Supply Chain Management records it as a native field, so assume nothing until the demo shows it.
The genealogy browser is a preview feature: what that means for a production decision
The add-in usually appears in the demo, and the failure mode is scoring it as the recall tool of record. Microsoft points to it from the tracked-components page itself: “You can also track batch/serial numbers for materials and components using the Traceability Add-in for Dynamics 365 Supply Chain Management (preview)”, which, the same Tip says, offers a graphical browser interface and an API for integration with external systems. Microsoft’s Traceability overview (preview) page, last updated October 28, 2025, opens with the notice “This article is prerelease documentation and is subject to change.” and states: “This is a preview feature. Preview features aren’t meant for production use and might have restricted functionality.” Among the preview add-in’s features, the same page lists as-built BOM registration: documenting composition genealogy (the as-built bill of materials) and activity events such as procurement, production and distribution against each serial and batch number.
Installing the add-in has its own limits. According to Microsoft’s Install, update, or uninstall Traceability (preview) page, last updated October 2, 2026, “Copying an environment with Traceability already installed isn’t supported.” That matters wherever the program plans to copy environments, for example to refresh a test environment from production.
Planning rule: score what the manufacturer can run in production on the tracked-components registration and the item trace described above, and treat the preview Traceability add-in as a pilot until Microsoft changes its label. If the program’s recall plan depends on the add-in, say so in the risk register, not in the fit score.
Holding a suspect lot everywhere at once
A suspect lot that stays available to planning or shipping is the next failure mode, so the hold has to reach every process that can consume or move the lot. According to Microsoft’s Use batch disposition codes to mark batches as available or unavailable page, last updated June 2, 2026, “You assign batch disposition codes to inventory batches to indicate whether each batch is available for master planning, reservation, picking, and shipping.” A code with the Unavailable status blocks the batch for all four, although Microsoft notes that some of those settings can be changed to add exceptions. Microsoft’s Inventory blocking page, last updated August 14, 2025, adds a second mechanism, “You can use inventory blocking to prevent items from being processed or consumed.”, and a preference for expiry: “We recommend that you rely on batch disposition codes, instead of inventory status, for blocking expired batches.”
Quality orders are the inspection record. According to Microsoft’s Quality and nonconformance management overview page, last updated August 13, 2025, “When you set up a quality association, Supply Chain Management can generate quality orders for various business processes, events, and conditions.” Microsoft’s Quality orders page, last updated June 22, 2026, says “By default, you can no longer edit or update a quality order after it has been validated and the tests have been passed.”, and documents a procedure for reopening one when that is needed, which is itself a step the manufacturer’s procedures should control.
Advanced quality management is the newer layer. According to Microsoft’s Advanced quality management overview page, last updated July 27, 2026, “Advanced quality management is a suite of quality management features introduced in Microsoft Dynamics 365 Supply Chain Management version 10.0.44.” Of the advanced quality management feature itself, the page says “As of Supply Chain Management version 10.0.49, this feature is mandatory and can’t be turned off.”, and its prerequisites list says the related features are turned on by default from version 10.0.47. Microsoft describes the purpose this way: “These tools address core issues that manufacturers face as they try to meet the United States Food and Drug Administration’s (FDA’s) Quality System Regulation (QSR), part 11 of Title 21 of the Code of Federal Regulations (21 CFR Part 11), current Good Manufacturing Practice (cGMP), and other regulatory and international standards, such as the International Organization for Standardization (ISO) and Six Sigma.” That sentence uses the regulation’s older name; the eCFR now titles part 820 the Quality Management System Regulation, and this checklist uses that name. The capabilities Microsoft lists on the page include corrective and preventive action (CAPA) management, flexible sampling plans, instrument calibration, customer-specific certificates of analysis and production dispensing; each is a feature to demonstrate against your own procedures, not a finding about fit.
Planning rule: write the hold scenarios first (receipt quarantine, an in-process test failure, expiry, a recall of a released lot), then demo each end to end, from the quality order or disposition code to the moment planning, picking and shipping stop offering the lot.
Electronic records and signatures against Part 11, requirement by requirement
The inspection finding to avoid is an audit trail nobody configured, so start from what Part 11 asks and set Microsoft’s documented controls beside it. Among the controls 21 CFR 11.10 sets for persons who use closed systems, 11.10(e) asks for “Use of secure, computer-generated, time-stamped audit trails to independently record the date and time of operator entries and actions that create, modify, or delete electronic records.” and adds “Record changes shall not obscure previously recorded information.” Section 11.50(a)(3) asks signed records to show “The meaning (such as review, approval, responsibility, or authorship) associated with the signature”. Section 11.70 says “Electronic signatures and handwritten signatures executed to electronic records shall be linked to their respective electronic records to ensure that the signatures cannot be excised, copied, or otherwise transferred to falsify an electronic record by ordinary means.” Section 11.100(a) says “Each electronic signature shall be unique to one individual and shall not be reused by, or reassigned to, anyone else.” Section 11.200(a)(1) asks electronic signatures that are not based upon biometrics to “Employ at least two distinct identification components such as an identification code and password”.
On the Microsoft side, according to Microsoft’s Electronic signatures overview page, last updated November 26, 2025, “You can also create custom signature requirements for any database table and field.” The same page says “Every user who signs documents must obtain a valid cryptographic certificate.” and “The system records electronic signature information in a log to provide an audit trail.” Microsoft’s Configure database logging page, last updated March 14, 2026, says that when logging is configured for a table or field, the system stores a record of every change to it, and that “By default, the system logs all transactions that use electronic signatures.” It is equally direct about the limits: “Database logging is designed to track individual transactions.” “It isn’t designed to track automated transactions that run in batch jobs.” “Database logging can adversely affect long-running automated processes, such as inventory close, calculations for bills of materials (BOMs), master planning, and long-running data imports.”
Electronic batch records sit on top of these controls. Microsoft’s Electronic batch records (EBRs) page on Microsoft Learn, last updated July 27, 2026, describes the batch production record as the component that “documents the actual method that was used to produce the item and the actual value of the measurement for each of the item’s characteristics”. While electronic batch records are enabled, block editing is on, and “The block editing feature for routes and BOMs/formulas prevents those records from being edited after they are approved.” With the Validate quality order option set to Yes, the system requires a signature when an overall quality order is validated; the page then says, “However, no signature is required when individual tests of a quality order are validated.” For drug products, the Electronic Code of Federal Regulations places the batch record requirement in 21 CFR 211.188: “Batch production and control records shall be prepared for each batch of drug product produced and shall include complete information relating to the production and control of each batch.” Section 211.68(b) adds: “Appropriate controls shall be exercised over computer or related systems to assure that changes in master production and control records or other records are instituted only by authorized personnel.”
The table sets each requirement beside the nearest control Microsoft documents. The pairing is this checklist’s, not Microsoft’s, and each pairing is a test to run, never a finding that the control satisfies the requirement.
| Requirement (21 CFR section) | What Microsoft documents, and where | Test to run |
|---|---|---|
| Validation of systems, 11.10(a) | No product statement; Microsoft says customers are responsible (Food and Drug Administration CFR Title 21 Part 11) | Plan validation from the intended use and the record list |
| Time-stamped audit trail, 11.10(e) | Signature information recorded in a log as an audit trail (Electronic signatures overview); signed transactions logged by default (Configure database logging) | Sign, change and delete a test record, then read the log for the user, date and time |
| Changes do not obscure prior entries, 11.10(e) | A record of every change to a configured table or field (Configure database logging) | Change a logged field twice and confirm both earlier values are still readable |
| Meaning of the signature, 11.50(a)(3) | Not documented in the sources read; test it | Check that each signed record shows what the signature meant |
| Signature linked to its record, 11.70 | Not documented in the sources read; test it | Try to copy or move a signature to another record |
| Unique to one individual, 11.100(a) | A valid cryptographic certificate for every signer (Electronic signatures overview) | Confirm certificates are issued per person and never shared |
| Two identification components for signatures not based upon biometrics, 11.200(a)(1) | Passkey expiration and passphrase constraints under the electronic signature improvements feature (Advanced quality management overview); the full signing sequence is not documented in the sources read | Walk one signature from start to finish and count the components it asks for |
| Change control over master records, 211.68(b) | Block editing of approved routes and BOMs/formulas (Electronic batch records (EBRs)) | Try to edit an approved formula without removing approval |
| Batch production record, 211.188 | The batch production record component of electronic batch records (Electronic batch records (EBRs)) | Pull the record for a test batch and check it against your batch record procedure |
Planning rules for this record:
- Decide which tables and fields carry signature and logging requirements from the record list, not from the menu.
- Size database logging against the batch jobs Microsoft names (inventory close, BOM calculation, master planning, long-running imports) before switching it on in production.
- Decide whether individual quality tests need a signature under your procedures, because Microsoft says the system does not require one.
What validation stays with you
When the validation plan is written, the expensive mistake is assuming that an audited cloud service arrives as a validated system. Microsoft’s Part 11 compliance page says: “Although no certification exists for complying with CFR Title 21 Part 11, the following Microsoft enterprise cloud services undergo independent, third-party audits.” Its list of those services includes “Microsoft Dynamics 365 and Dynamics 365 U.S. Government”, and the same page says “Customers who build and deploy applications subject to FDA regulation are responsible for ensuring that their applications meet FDA requirements.” Microsoft’s Good Clinical, Laboratory, and Manufacturing Practices (GxP) page, last updated June 2, 2026, says “Computerized systems that use GxP processes require validation of adherence to GxP requirements and are considered qualified when the system can demonstrate its ability to fulfill them.” and “There’s no GxP certification for cloud service providers”; the audits it lists after that sentence are of Microsoft Azure and Microsoft Office 365. Part 11 itself names validation first among its controls for closed systems, in 21 CFR 11.10(a).
Keep three layers apart in that plan:
- What Microsoft attests: independent audits of its cloud services, with compliance reports customers can request, subject to nondisclosure terms, through their Microsoft account representative or the Service Trust Portal, according to the same Part 11 page.
- What the manufacturer validates: the configured system, its intended use, and the records on this checklist, with the quality and regulatory functions deciding what is in scope.
- What i3solutions recommends: write the intended use and the record list first, derive the configuration and the validation scope from them, and decide early whether validation will be independent or internal.
How independent validation of regulated software is scoped is covered in Third-Party Software Validation (IV&V) for FDA and ISO Regulated Software: What It Involves and What It Costs.
When a record belongs in a separate system, and what to ask of it
When a record on the list does not land where the team hoped, often the preview add-in’s genealogy view the program wants in production or a trace that must cross companies, the decision point is whether a separate system should hold it. That is a choice for the selection team, and it is not always the answer; ask these questions of any candidate before it goes into the architecture:
- Which record does it hold, and is that record also held in Supply Chain Management, so that two copies need reconciling?
- Does it run inside the Dynamics 365 environment or outside it, and who administers it?
- How do the lot genealogy and signature records join across the boundary, and which system is the record of truth for each?
- How do its own audit trail and electronic signatures answer each Part 11 requirement in the table above, tested the same way?
- Who validates the interface between the two systems, and who re-tests it when either side changes?
- What is its own release status: generally available, or preview?
Where the boundary is a Dynamics 365 integration, the mechanism matters to the validation plan. i3solutions builds Dynamics 365 integrations using named Microsoft mechanisms including Dataverse, dual write, virtual tables, Azure Logic Apps, Azure Service Bus, and Power Automate connectors.
The fit checklist to hand to the selection team
The checklist is for the moment the selection team has to commit, and each row is a test the demo should pass before anyone scores the platform. The last column is left for the team to fill: native, preview, or a separate system.
| Record or control | What Microsoft documents (source) | Status | Test to run | Native, preview or separate system |
|---|---|---|---|---|
| Tracking dimensions on every regulated item | Tracing works only when a tracking dimension is assigned (Item and raw material tracing) | Documented | List every regulated item and its tracking dimension | Yours to decide |
| Component-to-finished-lot registration | Tracked components, version 10.0.40 or later, on by default from 10.0.45 (Register and track batch/serial numbers) | Documented | Register components on a test production order and read the link from the finished lot | Yours to decide |
| Recall trace forward and back | Back to the vendor and forward through production and sale (Item and raw material tracing) | Documented | Time a full trace on demo data shaped like your own | Yours to decide |
| Cross-entity trace | One legal entity at a time, no intercompany trace, a new trace per company (Item and raw material tracing) | Documented limit | Script the trace across every company a lot passes through | Yours to decide |
| UDI recorded per device or batch | Not documented in the sources read | Not documented in the sources read | Ask to see where the UDI is stored and printed | Yours to decide |
| As-built genealogy browser | Traceability Add-in, a preview feature; copying an environment with it installed is not supported (Traceability overview (preview); Install, update, or uninstall Traceability (preview)) | Preview | Pilot only, outside the production recall plan | Yours to decide |
| Quality orders and holds | Quality associations generate quality orders; disposition codes govern planning, reservation, picking and shipping (Quality and nonconformance management overview; batch disposition codes) | Documented | Demo each hold scenario end to end | Yours to decide |
| Expiry holds | Batch disposition codes recommended over inventory status for expired batches (Inventory blocking) | Documented | Expire a test batch and confirm every process stops offering it | Yours to decide |
| Electronic signatures by table and field | Custom signature requirements for any database table and field (Electronic signatures overview) | Documented | Map each signed record to its table and field | Yours to decide |
| Audit trail and logging load | Signed transactions logged by default; not designed for batch jobs (Configure database logging) | Documented limit | Run inventory close and master planning with logging on | Yours to decide |
| Electronic batch records | Batch production record, block editing, no signature on individual quality tests (Electronic batch records (EBRs)) | Documented | Pull the batch record for a test batch | Yours to decide |
| Validation scope and owner | No Part 11 certification exists; customers are responsible (Food and Drug Administration CFR Title 21 Part 11) | Stays with the manufacturer | Name the owner and write the plan from the intended use | Yours to decide |
The cost of running these tests, configuring the answers and validating the result belongs in the implementation budget; the drivers are covered in How Much Does a Dynamics 365 Finance and Supply Chain Implementation Cost?.
When this checklist points away from Supply Chain Management, or away from this page
A fit checklist earns its keep when it says no, so these are the cases where the answer changes:
- If lots routinely cross legal entities, Microsoft’s item trace does not follow them; it runs one legal entity at a time with no intercompany trace, so plan the process or the system that does.
- If the program depends on the as-built genealogy browser in production, Microsoft says preview features are not meant for production use.
- If the open question is which ERP to run at all, that is the platform decision covered by the regulated-ERP guide linked in the Quick answer, not this checklist.
- If the question is keeping a validated system validated through Microsoft’s updates, that is a separate decision from this initial fit test, and so is maintenance and asset serial traceability, which is a different record from production lot genealogy.
- Whether a record, a product or a site falls under part 820, part 211 or part 11 is for the regulatory affairs head and the quality system to decide. Part 820 itself draws one such line in 21 CFR 820.1(a)(2): “The provisions of this part do not apply to manufacturers of components or parts of finished devices, but such manufacturers are encouraged to consider provisions of this regulation as appropriate.”
- If Microsoft changes a preview label or a version default, the affected rows of this checklist change with it.
How i3solutions answers
Before the contract is signed, the selection team needs the checklist run against its own items, legal entities and records, and a validation plan with a named owner. i3solutions implements Microsoft Dynamics 365 for regulated enterprises. i3solutions has delivered Dynamics 365 integration engagements for regulated enterprises across healthcare, defense and aerospace manufacturing, and financial services. i3solutions has completed more than 20 Dynamics 365 integration engagements. On a Supply Chain Management program, the work is the configuration and integration of the system for the records on this checklist, delivered as a project, with embedded specialists where your team needs them.
i3solutions delivers FDA / ISO computer-system validation and independent verification and validation (IV&V) for regulated software.
Every engagement is delivered by senior, US-based people. i3solutions has been a Microsoft partner since 1997 and has delivered 600+ implementations across aerospace and defense, financial services, and health sciences. An i3solutions engagement does not produce managed-service ownership, a replacement for the internal team, open-ended scope expansion, or vendor lock-in. The wider practice is described in Enterprise Dynamics 365 Development Services That Align CRM and ERP to How You Operate.
Key Takeaways
- Batch and serial registration from component to finished product is documented in Supply Chain Management from version 10.0.40, and on by default from 10.0.45.
- Item tracing runs back to the vendor and forward to the sale, but only for items with a tracking dimension and only one legal entity at a time.
- The Traceability add-in’s as-built genealogy is a preview feature, and Microsoft says preview features are not meant for production use.
- Electronic signatures can be required on any database table and field and are logged; database logging is not designed for batch jobs and can slow them.
- Microsoft says no Part 11 certification exists and that customers are responsible for their FDA-regulated applications, so validating the configured system is the manufacturer’s work.
Frequently Asked Questions
Is Dynamics 365 Supply Chain Management 21 CFR Part 11 compliant?
Microsoft does not describe it that way. Microsoft’s Part 11 compliance page says “Although no certification exists for complying with CFR Title 21 Part 11, the following Microsoft enterprise cloud services undergo independent, third-party audits.” and “Customers who build and deploy applications subject to FDA regulation are responsible for ensuring that their applications meet FDA requirements.” Microsoft documents controls a manufacturer can configure, such as signature requirements on any table and field and a signature log as an audit trail, and 21 CFR 11.10(a) lists validation of systems, so the configured system is the manufacturer’s to validate.
Can Dynamics 365 trace a lot from raw material to customer?
Yes, within limits Microsoft states. Microsoft says “Manufacturers can trace items, raw materials, or ingredients back to the vendor, and forward through the production and sale of the finished product.”, but only for items with a tracking dimension, and “The trace displays for one legal entity at a time.” A lot that crosses companies needs a new trace in each company.
Is the Traceability add-in ready for production?
Microsoft labels it a preview feature and says “Preview features aren’t meant for production use and might have restricted functionality.” Microsoft also says “Copying an environment with Traceability already installed isn’t supported.” Score the production fit on tracked components and the item trace, and run the add-in as a pilot until Microsoft changes its label.
Does Dynamics 365 require electronic signatures on production and quality records?
Only where they are configured. Microsoft says “You can also create custom signature requirements for any database table and field.” For electronic batch records, with the Validate quality order option set to Yes, a signature is required when an overall quality order is validated, and Microsoft says “However, no signature is required when individual tests of a quality order are validated.”
Does database logging slow Dynamics 365 down?
It can. Microsoft says “Database logging can adversely affect long-running automated processes, such as inventory close, calculations for bills of materials (BOMs), master planning, and long-running data imports.” and “It isn’t designed to track automated transactions that run in batch jobs.” Size logging against those jobs before switching it on in production.
Planning the Decision
If your program needs this checklist run record by record against its own items and legal entities, a recall-trace demo script written for the companies its lots pass through, or a validation scope drafted from its intended use, start with the people who will do the work.
