Security Risks of Being On-Premise | The Reality of Staying on GP

For many organizations, Microsoft Dynamics GP has long served as a reliable backbone for financial and operations processes. Yet as the security landscape continues to evolve and GP approaches key lifecycle milestones, remaining on-premise introduces a level of risk that grows increasingly significant each year. What once felt like a stable and predictable ERP environment now demands careful reconsideration from a security, compliance, and business continuity perspective.

This article explores why continuing with GP is no longer just a technical-debt challenge but an escalating organizational risk. We’ll outline how Microsoft Dynamics 365 Business Central‘s cloud-native security architecture fundamentally changes an organization’s defensive posture, offering resilience that on-premise systems can no longer match.

To hear the full discussion, you can review the recorded webinar.

GP’s Support Timeline and Its Impact on Security

With Microsoft ending product enhancements, tax and regulatory updates, and mainstream support for Dynamics GP on December 31, 2029, followed by the complete end of GP security updates on April 30, 2031, any organization still running GP after these dates will be operating without critical protections. New vulnerabilities will remain permanently unpatched regardless of their severity.

Even today, maintaining a secure GP environment requires consistently applying at least one update per year under Microsoft’s Modern Lifecycle policy. Many organizations struggle to keep up due to complexity of customizations or infrastructure constraints, leading to widening patch gaps. Over time, these gaps compound into operational fragility – where outdated infrastructure, unsupported components, and delayed updates converge, creating an environment increasingly susceptible to cyberattacks and compliance failures.

These risks directly affect financial reporting, IT governance, and executive accountability.

Why On‑Premise Dynamics GP Environments Are Growing More Vulnerable

Aging Operating Systems and Infrastructure

Many organizations still run Dynamics GP on servers like Windows Server 2012 or SQL Server 2012, both of which are long past end‑of‑life. Even Windows Server 2016 reaches extended support retirement in early 2027.

Once these foundational layers stop receiving security updates, they become permanent vulnerability points. Even organizations that update GP itself may still find their environment exposed because the operating system or database beneath it has aged beyond Microsoft’s patching window.

Each unsupported component amplifies the risk of the next, expanding the attack surface.

Identify and Access Limitations

On-premise GP relies on legacy authentication models that lack the modern protections of cloud-native systems. Capabilities such as MFA, conditional access, real-time access monitoring, and strong audit trails are not available natively.

This makes credential theft, lateral movement, and privilege escalation more feasible. Permissions often drift over time, creating excessive access that is difficult to unwind.

Backup Fragility and Compliance Pressure

Compliance frameworks like PCI, SOX, HIPAA, and GDPR require more than basic controls; they expect:

• Timely patching
• MFA enforcement
• Logging and monitoring
• Reliable disaster recovery

Many GP environments cannot meet these requirements without significant ongoing investment.

Additionally, common GP backup practices introduce significant risk:

• Backups stored on the same network as production.
• No immutable or versioned backups.
• Little or no recovery testing.
• Aging firewalls and weak perimeter controls.
• Decentralized file storage and inconsistent permissions.

With ransomware actors increasingly targeting backup repositories, these gaps can turn a single incident into a prolonged outage.

Real-World Incidents That Illustrate the Risks

Twenty‑Nine GP Databases Encrypted

Organizations running Dynamics GP have experienced real and consequential security incidents in recent years. In one case, a ransomware attack encrypted twenty-nine GP databases simultaneously, leaving the entire ERP footprint inaccessible. The only usable backups were more than a year old, forcing an extensive recovery effort involving forensic data repair, manual reconstruction, and months of business disruption.

One Phishing Email, Total ERP Lockdown

In another case, a single phishing email prompted an employee to click a malicious link, ultimately leading to the encryption of the organization’s entire GP environment. Because identity protections were limited, and audit controls were insufficient, the attacker was able to move freely in the environment. The recovery was slow and costly, showing how quickly an everyday email can escalate into a full-scale system outage.

Why Dynamics 365 Business Central Offers a Fundamentally Different Security Model

A cloud‑native ERP like Dynamics 365 Business Central approaches security from a position that on-premise systems cannot replicate.

Automatic updates replace manual patch cycles, ensuring that vulnerabilities are addressed without relying on internal resources or scheduled downtime. Identity and access controls integrate directly with Azure Active Directory, enabling MFA, conditional access policies, and centralized role management by default.

Microsoft’s global security infrastructure provides:

• 24/7 monitoring and anomaly detection.
• Enterprise‑grade encryption.
• Global redundancy and built‑in disaster recovery.
• Hundreds of compliance certifications.
• Continuous regulatory updates.

This shift from reactive maintenance to proactive security is one of the main reasons many organizations are making the transition to Dynamics 365 Business Central.

If You Must Stay on GP in the Near Term, Hardening Is Essential

While many organizations are planning a transition to the cloud, some may need to remain on Dynamics GP for the next six to twelve months. In these situations, strengthening GP is critical.

This includes:

• Applying the latest GP 18.x update.
• Ensuring annual updates to maintain eligibility for fixes.
• Upgrading SQL Server and Windows Server to supported versions.
• Enforcing MFA for VPN, RDP, and administrative accounts.
• Eliminating the Power User role in favor of least‑privilege access.
• Disabling orphaned and inactive accounts.
• Securing SQL Server (rename SA, restrict privileges, use Windows auth).
• Implementing network segmentation and secure VPN-only access.
• Testing and validating isolated, immutable backups.
• Deploying endpoint detection and response solutions.
• Training teams to recognize phishing attempts.

These measures cannot eliminate structural weaknesses that come with aging on-premise systems, but they can reduce exposure during the transition window.

A Strategic Roadmap for Transition

Transitioning to Dynamics 365 Business Central does not need to be disruptive. Organizations begin with a migration assessment to understand customizations, data, and opportunities for process improvement.

Encore’s partner‑funded migration assessments offer structured insight into where complexity lies and how to streamline it. To take advantage of our assessment and other active promotions, contact your Account Manager today.

Encore’s migration assessment gives organizations a clear, data-driven view of their current environment, including customizations, integrations, and opportunities for process improvement. From there, a structured roadmap helps organizations move confidently to Dynamics 365 Business Central.

Migration plans typically incorporate:

• Phased workloads
• Historical data migration via secure data lakes
• Power Platform capabilities
• Dual‑use rights through Microsoft promotions
• Change‑management programs that ensure adoption

The Path Forward: A More Secure, More Resilient Future

For many Dynamics GP customers, the transition to Dynamics 365 Business Central may feel like a major step, but it does not need to be overwhelming or rushed. The key is simply to begin. Reach out to your Encore Account Manager to create a roadmap tailored to your business, your timelines, and your constraints.

With Microsoft and Encore incentives, dual‑use rights, and predictable pricing, organizations can transition strategically rather than reactively. Encore’s assessments, ROI tools, and migration expertise ensure that the journey is not only manageable but value‑driven.

If your organization is evaluating its path forward, Encore is here to provide guidance, assessments, and strategic support to help you navigate the transition confidently. Contact our experts today.