FinOps Workbench — User Guide

What it does

FinOps Workbench talks to the Power Platform admin APIs and, optionally, Lifecycle Services on your behalf. It recognises three kinds of environment, and most actions are enabled or disabled depending on which kind you've selected:

Everything runs against your own signed-in identity — there is no service account, tenant id, client id or secret to configure. You must be an administrator on the environments you want to manage.

System requirements

• Windows 10 or 11 (x64, ARM64 or 32-bit / ia32), or macOS 11 Big Sur or later (Apple Silicon or Intel).
• A Microsoft Entra ID (work/school) account with administrator rights on the Power Platform / F&O environments you intend to manage.
• Internet access to Microsoft endpoints (login.microsoftonline.com, the Power Platform admin APIs, your Dataverse org URLs, and — for LCS features — lcs.dynamics.com / lcsapi.lcs.dynamics.com).
• No SQL client or ODBC driver needs to be installed — the SQL workspace and the MCP SQL tools use a built-in TDS client.

The Windows installer is not code-signed, so SmartScreen may warn on first launch. The macOS build is signed with a Developer ID and notarized by Apple, so it opens without a Gatekeeper warning.

Installing the app

Download the latest build from the download page and pick the file for your machine:

On Windows

1. Run the downloaded …-setup.exe. Because it isn't code-signed, SmartScreen may show "Windows protected your PC" — click More info → Run anyway.
2. The installer lets you choose the location and doesn't require administrator rights (it installs per-user by default).
3. Launch FinOps Workbench from the Start menu.

On macOS

1. Open the downloaded .dmg and drag FinOps Workbench into your Applications folder.
2. Launch it from Applications (or Launchpad). The build is Developer-ID signed and notarized, so it opens normally. If macOS ever blocks a build, right-click the app → Open → Open to confirm once.

Updates — new versions are published to the same download page. On Windows, run the newer installer over your existing install; on macOS, replace the app in Applications. Your settings and cached session are preserved either way.

Getting started

1. On the Environments page, click Sign in (Authentication group of the ribbon). A Microsoft sign-in window opens inside the app — sign in with your Entra ID account and complete any multi-factor prompts.
2. Once signed in, your name and account appear in the bottom-left corner and the environment list loads automatically.
3. The status bar (bottom) shows Signed in as <your UPN> and a count of visible / total environments.

Behind the scenes the app also tries to set up two extra sessions from the same sign-in, silently where it can: a developer-tools session (used later when you download assets) and an LCS session (so LCS SQL access and asset downloads don't need a separate sign-in). If either can't be captured silently, the app sets it up the first time you need it.

Your session is remembered securely between launches (encrypted at rest with a key bound to your machine and user account), so you normally only sign in once. On startup the app restores your previous session; if it has expired you'll be prompted to sign in again. Sign out clears all tokens, the LCS session, browser cookies and cached SQL grants.

The Environments view

The home page lists every environment you can administer, with live status, capacity, versions and lifecycle state.

The Environments page — every environment you can administer, in one grid.

Layout

• Left rail — switch between the five areas (Environments, SQL Workspace, Assets, MCP Server and AOT). Your signed-in account sits at the bottom; the rail collapses to icons via the hamburger button.
• Ribbon — grouped actions (Authentication, Lifecycle, Data ops, View). Buttons enable or disable based on the selected environment's kind and state.
• Grid — one row per environment, organised into Environment, Dataverse and F&O column bands.
• Details tab (right edge) and Activity log (bottom edge) — both tuck away by default; click the tab to expand.

The grid

• The Kind column shows whether a row is a UDE, LCS, or Dataverse environment.
• Coloured State, Operation status and F&O state pills give status at a glance — green = healthy/ready, amber = busy, red = failed/unavailable, blue = admin/maintenance, grey = neutral.
• The SQL access column shows a key icon when a valid SQL JIT grant is currently held for that row. The key disappears automatically when the grant expires.
• Double-click any row to open its full JSON (a curated Details tab plus the Raw JSON).
• Type to search, drag column headers to reorder, and click a column's filter button to filter.

Columns, units and filters

From the View group you can apply the F&O preset (default), the Dataverse preset or Show all columns; switch storage columns between GB / MB; and filter to All, UDE / F&O only or Dataverse only.

Details and Activity log

The Details panel (right edge) shows a full, curated breakdown of the selected environment — general info, status, capacity, Dataverse and F&O metadata, links and more. The Activity log (bottom edge) records everything the app does, colour-coded by severity with timestamps. Right-click to Copy row or Copy all messages. When something doesn't work as expected, this is the first place to look.

Lifecycle operations

These live in the Lifecycle and Data ops ribbon groups. Actions that change or provision environments always confirm first, and most are submitted asynchronously — click Refresh to track progress in the Operation status pill.

Requesting just-in-time SQL access

Select an environment and click Request SQL access (enabled for UDE and LCS environments). Choose a reason and an access level:

• Pick a standard reason and the app sets the role automatically (Reader or Writer) — you can still change it, or type your own reason.
• The app finds your public IP (or you can enter it), opens the SQL firewall for that IP, and requests time-limited credentials.
• For UDE environments this goes through the supported Dataverse action. For LCS environments it signs you in to Lifecycle Services once (if needed) and completes the request there.

Credentials are valid for about 12 hours and only from the allowed IP. You must be a system administrator on the environment.

The SQL JIT credentials viewer — copy the connection string straight into SSMS or your app.

The Credentials tab shows the server, database, user name, password (masked, with a Show toggle), role and expiry, plus a ready-to-use connection string. Copy connection string puts the .NET/SSMS-ready string on the clipboard; Re-request obtains a fresh grant — for example to upgrade a read grant to read/write.

The granted credentials are cached for the session (the environment's SQL access column shows a key), so opening the SQL Workspace on that environment connects straight away.

The SQL workspace

An SSMS-style workspace for browsing and querying environment databases.

The SQL Workspace — object browser, query editor and results grid, with T-SQL auto-complete.

• Object browser (left) — lists all your environments, each with its kind icon. Select one and connect it; connected environments expand to their database → schemas → Tables / Views → columns. Very large F&O schemas group objects into alphabetical folders. Both the F&O and Dataverse endpoints of the same environment can be connected at once.
• Query tabs (right) — each tab has a SQL editor and a results grid, and runs against the environment named on the tab. Press F5 (or Execute) to run; Ctrl+Space opens auto-complete (T-SQL keywords plus the environment's tables and columns).
• Double-click a table to open a new tab pre-filled with SELECT TOP (1000) * FROM [schema].[table] and run it automatically.

Connecting — select an environment in the object browser and use the ribbon (or right-click → Connect):

• Connect F&O — connects the finance & operations database using a SQL JIT grant. For a UDE environment it requests the grant for you; for an LCS environment it reuses a held grant or runs the LCS request.
• Connect Dataverse — connects the org's read-only TDS endpoint using your signed-in identity, no separate credentials needed. Writes are rejected by the server.

Downloading assets

Select an environment and click Download assets to open the picker (enabled for UDE and LCS environments). It lists everything available for that environment:

• Downloadable VHD versions and developer tools (Packages local directory, the F&O Visual Studio extension, Trace Parser, cross-reference database) — for any environment with a Dataverse org.
• For LCS-managed environments, also the project's asset library (software deployable packages, data packages, models, GER configurations, NuGet packages) and database backups (bacpacs).

Tick what you want and click Download… to save to a folder. Downloads run in the background with per-item progress; you can minimise the window (progress stays visible in the system tray / menu bar) and start several batches at once.

The Assets page — your download library, with quick actions to open or remove files.

The Assets page is your download library — it shows what you've already downloaded, whether each file is still on disk, and quick actions to Open file, Open folder, Download more… or Delete (sends the file to the Recycle Bin / Trash).

The MCP server

FinOps Workbench can expose your signed-in session to AI tooling (Claude Desktop or Claude Code) through a built-in Model Context Protocol server. An assistant can then list and inspect environments, read F&O details and operation status, and run SQL on your behalf.

The MCP Server page — start the server and register it with Claude in one click.

1. Set the Host / Port (defaults localhost / 8899 are fine for local use).
2. Leave Use HTTPS on — most MCP clients, including Claude, require HTTPS. The app ships a self-signed localhost certificate; you can point at your own PFX if you prefer.
3. Click Start. The log shows "MCP server listening on https://localhost:8899".
4. Register the server with your client:
   • Add to Claude Code — runs claude mcp add for you (user scope). In Claude Code, run /mcp to confirm.
   • Add to Claude Desktop — writes the connection into Claude Desktop's config via the mcp-remote bridge. Fully quit and reopen Claude Desktop afterwards.
   • Copy config — copies the connection snippet to paste into any client manually.

Tools exposed: auth_status, sign_in, list_environments, get_environment_details, get_environment_history, get_finops_details, get_operation_status, run_sql, and request_sql_jit (guidance only). SQL runs against a held JIT grant for F&O/UDE environments, or the read-only Dataverse TDS endpoint for plain Dataverse orgs.

Write operations (create_environment, copy_environment, delete_environment, dbsync_to_finops) are off by default. Turn on Allow write ops only if you want the assistant to make changes; the toggle takes effect immediately.

The AOT browser & X++ editor

The AOT page turns an environment's metadata into a browsable, searchable Application Object Tree with a full X++ editor — no SQL Server, no DYNAMICSXREFDB restore, no Visual Studio required. Everything is read from the environment's PackagesLocalDirectory and indexed locally.

The AOT browser — the complete Application Object Tree, with cross-references resolved from the metadata itself.

Getting sources

Pick an environment in the source dropdown and click Get sources — one operation downloads its PackagesLocalDirectory.zip (via the developer-tools service), extracts it and builds the object index. Each step resumes where it left off, so the button is also the "continue where it stopped" button. Already have an extracted folder (a build VM copy, a VHD mount)? Point straight at it with Browse folder….

Indexing sweeps the metadata files themselves, so the tree holds the complete AOT — a stock application lands at around 240,000 objects — including the pure-metadata types (security objects, menu items, EDTs…) that a cross-reference database barely covers.

Browsing

• Classic view groups objects into the familiar VS categories (Data Model, Code, User Interface, Analytics, Security…); Model view groups by package/model. Big node sets load lazily in alphabetical buckets.
• The search box finds any object by name across the whole tree.
• Find references shows what an object uses and everything it is used by — straight from the local index, no xref database. Rows double-click through to the referencing object.
• Opening a form or table lands on its Design tree — the structure you know from Visual Studio, with data sources, fields and controls, and a property pane for the selected node. Label files open as a filterable grid with per-label where used.

The X++ editor

Parsing is derived from the actual X++ compiler — classes, tables, EDTs and enums each get their own colour.

Source opens in an editor whose parsing is derived from the actual X++ compiler, so the colouring understands the language rather than approximating it:

• Kind-aware colours — classes, interfaces, tables/views/entities, EDTs and enums are each coloured by what the index knows they are; keywords, literals (including 31\12\2026 dates and verbatim strings), macros, intrinsics and labels all render like Visual Studio.
• Outline & breadcrumbs — Ctrl/⌘+Shift+O jumps between methods and fields.
• Go to object — press F12 (or Ctrl/⌘+B, or right-click → Go to AOT object) on any identifier to jump to that table, class, EDT or enum.
• Multi-tab — every object opens in its own tab that remembers its view, edits and cursor position. Right-click a tab to Pin, Close, Close Others or Close All; middle-click closes.

Multi-tab editing — pin tabs, track unsaved changes, and save across several tabs at once.

Editing your own models

Objects that live in a custom model (see overlays below) are editable right in the viewer — standard Microsoft code stays read-only. While editing you get IntelliSense: object names, keywords and intrinsics, your variables with their declared types, Type:: static methods and enum values, and variable. members resolved through the type's full inheritance chain.

IntelliSense resolves fields and methods through the object index and the type's inheritance chain.

Save (Ctrl/⌘+S) writes your method changes back into the object's metadata XML precisely — only the code you touched changes, so the file diffs cleanly in Git. The ribbon's Editor group also has Save all / Discard / Discard all. Form data-source and control code can't be edited yet — the app refuses rather than risking the XML.

Custom metadata overlays

Custom metadata… lets you overlay your own metadata folder (a Visual Studio Metadata folder or a Git working copy) on top of the environment's download, per environment. Custom objects are highlighted in the tree, table and form extensions merge into the designer, and the overlay is where editing and IntelliSense activate.

Settings & appearance

Open Settings from the ribbon (View group).

Settings — theme, LCS options and SQL object-browser behaviour.

• Theme — Follow OS app mode (default), or pin Light / Dark. The whole app re-themes instantly and tracks your Windows or macOS light/dark switch live.
• Load LCS environments — also crawl Lifecycle Services for F&O environments that aren't in the Power Platform admin list. Turn off if you only work with Power Platform environments.
• LCS region — pick the regional LCS REST API endpoint used for asset downloads (leave on Global unless your LCS tenant is in a specific geo).
• SQL object browser — group large table/view lists into alphabetical folders (and the threshold at which grouping kicks in). This keeps the SQL workspace tree responsive on huge schemas — an F&O database has ~25,000 tables.

Settings are saved to %LOCALAPPDATA%\FinOpsWorkbench\settings.json on Windows, or ~/Library/Application Support/FinOpsWorkbench/settings.json on macOS.

The app follows your Windows or macOS light/dark preference automatically:

Dark mode — the app re-themes the whole UI to match your OS.

Keyboard shortcuts

On macOS, use ⌘ (Command) in place of Ctrl.

Where your data lives

FinOps Workbench stores everything under your own user profile — nothing is sent anywhere except the Microsoft services you're administering. The per-user data folder is %LOCALAPPDATA%\FinOpsWorkbench\ on Windows and ~/Library/Application Support/FinOpsWorkbench/ on macOS.

Secrets are never logged. Tokens, passwords, cookies, connection strings and download SAS URLs are kept out of the Activity log and diagnostics.

Troubleshooting

SmartScreen warns when I run the installer (Windows). The Windows installer isn't code-signed. Click More info → Run anyway. This is expected for a release from the official download page.

macOS won't open the app / says it's from an unidentified developer. The macOS build is signed with a Developer ID and notarized by Apple, so it should open normally. If macOS still blocks it, right-click the app in Applications → Open → Open to confirm once.

Sign-in window is blank or won't load. The app uses an embedded Chromium browser window. If it can't start (seen on some virtual machines), the app falls back to your default browser to finish sign-in — watch the Activity log. Ensure the machine can reach login.microsoftonline.com.

"Request SQL access" is disabled. It's only available for UDE and LCS environments. Plain Dataverse environments have no F&O database to grant access to — query them via SQL Workspace → Dataverse tables instead.

The SQL workspace sits on "Waiting for Microsoft to provision JIT SQL access…". Microsoft provisions the SQL login and firewall rule on demand; this can take a minute or two on a fresh grant, and the app retries for up to four minutes. A changed public IP is a common cause — re-request access to refresh the firewall rule.

The AOT page says the environment "has no browsable sources yet". The object tree is built from the environment's PackagesLocalDirectory. Click Get sources to download, extract and index it in one go (the download is several GB, so the first run takes a while — it resumes if interrupted). If you already have an extracted copy on disk, Browse folder… uses it directly with no download.

X++ source is read-only / there is no Save button. Only objects in a custom model are editable. Overlay your model's Metadata folder via Custom metadata… — its objects highlight in the tree and open editable. Microsoft's standard code always stays read-only, and form data-source/control code isn't editable yet.

Claude can't connect to the MCP server. Make sure the server is Started, Use HTTPS is on, and you've registered it with Add to Claude Code / Desktop. For Claude Desktop, fully quit and reopen it after adding, then ask the assistant to call auth_status.

FAQ

Do I need to configure a tenant, client id or secret? No. The app signs you in interactively with your own account and uses your identity for everything.

Is my session shared with anyone? No. Tokens are stored encrypted on your machine and used only to call Microsoft services. The MCP server, if you start it, is localhost-only.

Do I need SQL Server or Visual Studio to browse the AOT? No. The AOT browser and X++ editor read from the environment's PackagesLocalDirectory and index it locally — no SQL Server, no DYNAMICSXREFDB restore and no Visual Studio.

Can I manage LCS environments fully from the app? Partly. You can list them, enrich their details, request SQL access, and download LCS assets. Copy, Delete, History and DB Sync for LCS environments must be done in the LCS portal.

Does querying Dataverse cost or change anything? The Dataverse SQL endpoint is read-only — only SELECT works, and it needs no separate credentials beyond your sign-in.

Is the app free? Yes. FinOps Workbench is built and maintained by Veriland Consulting for the Dynamics 365 community — free to use and share, provided "as is" without warranties.