Today, managing payments, benefits, and expenses from your mobile device using Microsoft and Windows tools is much easier than it seems. Between finance apps, business apps, solutions for controlling mobile data usage, and device management tools, you have a complete ecosystem at your fingertips to work with and organize your money from anywhere.
In the following lines you will see how to take advantage of apps like Dynamics 365, Power Apps, Intune, Mobile Link and digital SIMs (eSIMs) to control expenses, manage aid, move safely in BYOD (bring your own device) environments and connect your mobile to your Windows PC almost as if it were a single screen.
Dynamics 365 mobile expense app: reimbursements, travel, and assistance right from your pocket
Within the Microsoft ecosystem, one of the key pieces for companies that need to process expenses, reimbursements and financial aid related to travel and projects is the Dynamics 365 expense management mobile application, designed on Microsoft Power Apps as a canvas application.
This solution integrates with Dynamics 365 Project Operations (integrated with ERP and manufacturing scenarios) and is published within the Power Apps mobile application, allowing any authorized employee to create, submit, and approve expense reports directly from their smartphone, without needing to open the Finance web client.
The application is designed to make the process as streamlined as possible: the interface is highly visual, task-oriented, and features simplified workflows , so that booking a taxi, hotel, or business lunch after a meeting becomes something that can be done in seconds from your mobile phone.
A key feature is that the app uses optical character recognition (OCR) technology to automatically read information from receipts and invoices. You take a photo of the receipt, the app detects the important data (amount, date, currency, taxes, etc.) and generates the expense line item, ready to be linked to an expense report or a specific grant.
If you prefer, you can also save photos of the receipts to attach later , when you have time to put together the complete report. This is great if you're traveling, have poor cell service, or simply want to "save everything" and review it later at your leisure.
What can you do with the Dynamics 365 expense app?
The mobile expense management app is designed to cover the entire expense lifecycle, from the moment you pay for something until it's approved and reimbursed. Key features for the end user include:
On one hand, you can create individual expenses and build comprehensive expense reports , grouping lines by trip, project, grant, or period. Each expense can include category, project, payment method, taxes, and any additional fields your organization has configured.
The receipt capture system is flexible: you have the option to create new receipts, attach them, unlink them, or delete them if they were uploaded by mistake. This detailed control over attached documents is very useful for audits or when you need to justify internal grants and subsidies.
Expense reports can be saved as drafts, submitted for approval, retrieved if needed, and edited again as long as company policy allows it. This way, if you spot a mistake before approval, you can correct it without having to start from scratch.
Furthermore, both employees who generate expenses and those responsible for approving reports can access the application from the Power Apps mobile app , with real-time connection to Dynamics 365 Finance data thanks to the Dataverse infrastructure and virtual entities.
Another strength is the ability to customize the experience to meet the company's needs . The canvas app can be adapted in terms of visible fields, navigation flows, or business rules to align with the spending, grant, and project policies already defined in Dynamics 365 Finance.
Technical configuration in Finance and Dataverse to use the expense app
To use this mobile expense app seamlessly, it's essential that the expense management setup in Dynamics 365 Finance is fully implemented . This includes spending policies, approval workflows, categories, travel parameters, and report field visibility.
In terms of versions, to benefit from the latest improvements, Finance must be at 10.0.42 (10.0.2095.147 or higher) or 10.0.43 (10.0.2177.72 or higher ), always with the most recent quality update applied in the production environment.
The central component of integration is Dataverse . Your Dynamics 365 Finance environment must be linked to a properly configured Dataverse environment. If it isn't already, you'll need to enable Power Platform integration by following the "Enable Power Platform integration" guide and explicitly enabling Dynamics 365 apps when creating your Dataverse environment.
Once you have Finance and Dataverse set up, you need to manage users in Dynamics 365 Finance . Each person who will use the mobile app needs a user account associated with an employee record, with an active job in the default legal entity and the assigned Employee role, in addition to having the default company configured in their user preferences.
In parallel, the mobile expense management app must be installed in Dataverse. To do this, access the Power Platform admin center , choose the desired environment, open the Resources > Dynamics 365 apps section, and install the “Dynamics 365 Expense Management” app.
Next comes a highly technical but critical step: updating the virtual entities used by the mobile app. These entities serve to expose Finance's information to Dataverse without duplicating data, and they must be synchronized so that the canvas app has up-to-date metadata and functions smoothly.
Key virtual entities and code components for the mobile experience
The mobile expense management app relies on a broad set of virtual entities prefixed with mserp_ , covering everything from currency catalogs to specific parameters for travel, addresses, and taxes. Keeping these up-to-date ensures that when a user creates an expense on their mobile device, they see the same lists, categories, and parameters as in the Finance web interface.
Among the entities that need to be reviewed and updated are, for example, mserp_currencyentity for currencies , expense field visibility entities, country and region translations, travel parameter tables, mileage settings, and multiple specific entities dedicated to the mobile version of expenses and reports.
There are entities designed to handle master data (mserp_trvexpmobilemasterdataentity) , others dedicated to travel activities and locations, and a relevant group for the control of documents and receipts: from those that manage documents attached to expense lines and reports, to those that collect information on taxes, projects or payment methods.
Additionally, to enable the app to display localized labels and advanced controls, you need to enable the Power Apps component framework code components in your environment. This step must be completed before installing the mobile expense app, as some interface controls rely on these components to display information correctly in different languages.
Once the solution is installed and the entities are updated, it's time to grant access in Dataverse . Since it's a canvas app, it's shared with users following the standard Power Apps procedure, typically granting access to a security team or specific users.
Licenses and roles to access the mobile expense app
In order for users to connect and register their payments, aid, or travel expenses from their mobile device, they must meet two conditions: have an appropriate Dynamics 365 license and have security roles configured in Dataverse.
In terms of licensing, each user must have at least one Teams for Dynamics 365 member license or higher , assigned from the Microsoft Entra admin center. This ensures that the user has the right to use the capabilities of enterprise applications published through Dataverse.
On the Dataverse side, the best practice is to assign each person the Basic User and Expense Mobile User roles . These security roles enable the connection to the custom connector and guarantee access to the virtual tables necessary to work with expense reports, receipts, documents, and parameters.
Instead of assigning roles to individual users, many organizations prefer to create a team in Dataverse and assign those roles to it. Any employee added to that team automatically inherits the permissions, making it much easier to manage employee additions and removals.
With everything ready (Finance set up, Dataverse linked, virtual entities updated, solution installed and roles assigned), employees can download the Power Apps mobile app, log in with their corporate account and find the expense app to start recording receipts, payments, trips and requests for help.
eSIM and Mobile Plans application in Windows: control data connectivity
In addition to purely financial applications, Microsoft also facilitates the management of mobile data plans directly from Windows , which is very useful when you use your laptop to connect to help portals, online banking, or corporate tools outside of your home.
The so-called Always Connected PCs, based on ARM processors, point to a new generation of lightweight laptops with good battery life and constant connectivity . These devices integrate eSIMs, that is, digital SIM cards soldered onto the motherboard that allow users to subscribe to and change data plans without having to insert a physical card.
To manage these plans, Microsoft developed the Mobile Plans app for Windows 10 , designed to make signing up for a data plan with a carrier as easy as connecting to your usual Wi-Fi network. From this app, you can choose your provider, configure your plan, view your data usage, and manage the data connection associated with your laptop.
The idea is that you can activate a temporary plan when you need a connection outside the office or home , which is very useful if you are going to process aid online, access your ERP in the cloud or review financial reports from a hotel, train or airport.
Initially, Mobile Plans only had a few integrated operators (such as KDDI in Japan, Swisscom in Switzerland or Tele2 in Sweden), but the intention is that more and more operators will adopt the platform as the use of eSIM in laptops and Windows tablets becomes more widespread.
Mobile device management with Microsoft Intune and Endpoint Manager
Traditionally, device management was done with on-premises tools like Configuration Manager, designed for company-owned equipment. However, the rise of the BYOD (Bring Your Own Device) model means that many employees use their personal mobile phones to access email, expense apps, corporate banking, or help portals.
To address this scenario, Microsoft offers a suite of Mobile Device Management (MDM) and Mobile Application Management (MAM) solutions that enable the management and protection of data on both company-owned and personal devices without invading user privacy.
Endpoint Manager brings Intune and Configuration Manager together under a single console and integrates with Azure Active Directory (currently Microsoft Entra ID) , where user and group identities reside. Before anyone accesses the corporate network, Endpoint Manager checks Azure AD to see who they are, what permissions they have, and whether their device complies with security policies.
Intune also incorporates specific mobile application management functions , which the IT department can use to distribute internal apps, control their updates, limit copy and paste actions, or delete only corporate data if the device is lost or the employee leaves the company.
What are Microsoft MDM and MAM really used for?
In practice, MDM policies allow you to define in great detail how a device behaves when accessing sensitive content , such as financial reports, grant portals, or expense management apps.
A typical policy might require employees to access the corporate portal only from secure Wi-Fi networks or via VPN , block the use of open public networks, and restrict suspicious connections. This is key to preventing credential theft when working from coffee shops, airports, or shared networks.
Another essential capability is remote wiping: if a device is lost, stolen, or the employee leaves, administrators can restore the terminal to factory settings or delete only company data , keeping personal information (photos, private apps, chats, etc.) intact.
Regarding applications, Intune allows you to publish line-of-business apps on the corporate portal , so each user only sees the applications relevant to them and can install, update, or uninstall them in a controlled manner. This is very useful if you deploy apps for internal support, expense management, or specific corporate banking.
In the field of data protection, the combinations of MDM and MAM allow for the application of measures such as conditional access to confidential information, blocking the export of data to personal storage, or prohibiting the sending of emails to external domains when dealing with critical financial data.
Key features of Microsoft mobile management
Among the main advantages of the Microsoft ecosystem for managing devices that handle payments and aid, the centralized administration with Intune and Endpoint Manager stands out , compatible with Android, iOS/iPadOS, Windows, macOS and some Windows Server devices.
Organizations already using on-premises Configuration Manager can opt for co-management , distributing the load between the on-premises environment and the cloud. This option is particularly well-suited for a mix of corporate and BYOD devices , allowing for gradual service migration without a sudden shutdown.
Endpoint Manager can also attach the tenant to the local Configuration Manager to manage it from the cloud, which is very useful when you want to monitor from a single control panel which devices access finance applications, help portals, or banking platforms.
In addition, data loss prevention policies can be defined to force the automatic saving of critical information in the cloud or on central servers , preventing a user from accidentally deleting relevant data from payments, receipts or aid reports.
How to deploy Intune to protect payment and aid management
If your organization is starting from scratch, the fastest way to get started is to purchase Microsoft 365 licenses that include Intune and Endpoint Manager , such as the Enterprise, Business Premium, Education, or Government editions that integrate MDM and MAM.
Once you have the licenses in hand, the next step is to configure the domain name in Azure AD/Entra , add users and groups or synchronize local Active Directory, and assign licenses to those who will enroll devices and use corporate apps.
Next, you need to establish which tool will be the MDM authority (Intune or Configuration Manager) , upload the applications to be managed (for example, the company's expense app, banking apps or help portals) and define the device configuration and data protection policies.
The company portal, where users connect to register their devices and install apps, can be customized with the company logo and text . This helps employees easily recognize the environment and know they are installing official applications.
Finally, device registration is enabled for supported platforms (Windows, iOS, Android, macOS) and compliance and conditional access rules are created that will define who can access which resources and from what type of device.
Mobile Link and Windows Link: Connect your mobile device to your PC for better performance
Another very interesting tool for everyday use is Phone Link in Windows , which allows you to link your Android or iPhone device to your PC and manage calls, SMS, notifications, and in many cases, mobile apps from your desktop.
For Android, the Link to Windows app comes pre-installed on many Samsung, HONOR, OPPO, ASUS, vivo, and other phones , or can be downloaded from Google Play or the Samsung Galaxy Store. For the best experience, it's recommended to use Android 10 or later and a PC running Windows 10 (October 2022 Update or later) or Windows 11.
Once linked, you can read and reply to text messages, view your recent photos, use compatible mobile apps, make and receive calls, and manage notifications without touching your phone—perfect if you're filling out aid forms or reviewing expense reports on the big screen.
To get started from your PC, simply search for Mobile Link in the taskbar, sign in with your Microsoft account, follow the instructions to install or open Link to Windows on your mobile device, and use the QR code that appears on your computer to complete the pairing.
By granting the necessary permissions (notifications, access to photos, calls, etc.), the two devices are linked and you can customize what you want to sync from the Mobile Link itself: activate or deactivate notifications, messages, calls, photos, location of received file storage, audio playback, instant wireless coverage zone, clipboard between devices and more.
Link iPhone with Mobile Link and manage permissions
With an iPhone, the experience is slightly different, but it also adds value if you use your phone for bank authentication, verification SMS messages, or calls related to your financial transactions . In this case, pairing is primarily done via Bluetooth Low Energy (BLE).
To use it, you need a PC with Windows 10 (May 2019 Update or later) or Windows 11, BLE compatibility, and an iPhone with iOS 15 or later . Open Mobile Link on your computer, select iPhone as your phone type, scan the generated QR code with your iPhone's camera, and follow the instructions.
During the process, the system will ask you to grant permissions for notifications, messages, and contact synchronization . These permissions are essential for you to read SMS messages on your device, see who's calling, reply using your PC keyboard, and receive important notifications related to payments or assistance.
If you ever want to stop using the pairing feature, you can forget the device in the Bluetooth settings on both Android and iPhone , and remove it from Mobile Link on Windows. If a pairing failure occurs, simply turning Bluetooth off and on again and scanning the QR code is usually sufficient.
It's worth remembering that, just like with Intune, you control what data you share . Unchecking a permission box means that function (for example, viewing messages or notifications) will no longer be available on your PC, keeping the information only on your mobile device.
With this entire set of tools—the Dynamics 365 mobile expense app, Dataverse and its virtual entities, data plan management with eSIM and Mobile Plans, the security of Intune and Endpoint Manager, and daily integration with Mobile Link—you have a fairly complete ecosystem for processing payments, justifying subsidies, controlling expenses, and working securely between mobile and Windows , taking advantage of the best of each device and minimizing paperwork and technical headaches.
