Your Approver Just Left the Company. Does Your AP System Know?
Most AP approval workflows are built on a foundation that quietly rots. Someone sets up the approver list: invoices over $10k go to Sarah, invoices over $50k go to Michael. It works fine until the org chart moves.
Sarah gets promoted, Michael leaves, and a new director joins while nobody updates the routing. Invoices keep flowing into an approval chain that no longer matches reality.
This is what happens when your approval logic lives in configuration screens instead of where the actual org chart lives.
Where hardcoded invoice approval workflows fail
Promotions and role changes. Sarah was a manager with a $10k approval limit. Now she’s a director who can sign off on $50k, but the AP system still routes her the same invoices she used to see. The workflow doesn’t know her authority changed, so either payments go through the wrong person or IT gets a ticket.
Departures. The approver leaves and their account gets deactivated. Invoices start piling up in a queue nobody’s watching. By the time someone notices, you’ve got three weeks of stuck payments and a vendor calling about overdue invoices.
And even when everyone’s employed and in the right role, someone is always on vacation. If the workflow can’t handle delegation on its own, invoices sit for a week waiting for a signature that won’t come, and finance ends up running the manual escalation process that automation was supposed to eliminate.
None of this is unusual for an organization with more than 50 people. It’s Tuesday.
Invoice approvals driven by Microsoft Entra ID
The org chart already lives somewhere: Microsoft Entra ID (formerly Azure AD). Every time HR adds a new manager, updates a reporting relationship, or deactivates an account, that change flows into Entra ID automatically. Your AP workflow should pull from the same source.
Here’s how we built the logic on top of Invoice capture for Dynamics 365 Finance.
Step 1: Pull the hierarchy live. When an invoice arrives, Power Automate queries Entra ID to identify the requester and their current manager. There are no lookup tables to maintain; whatever Entra ID says today is what the workflow uses.
Step 2: Escalate by authority limit. Each role carries an approval limit, either set as a custom attribute in Entra ID or mapped to a role table in Dataverse. When an invoice exceeds the manager’s limit, the workflow recursively walks up the hierarchy (manager’s manager, then theirs) until it finds someone with sufficient authority. A $75k invoice doesn’t sit in a mid-level queue hoping someone figures out it should have gone higher.
Step 3: Handle delegation automatically. When an approver has their out-of-office set in Outlook, the workflow reads the delegate from Entra ID and routes the invoice there. Nobody sends “please approve this while I’m away” emails, and nothing waits in an unattended queue.
What this changes for finance and IT
The practical payoff is that nobody maintains approver lists anymore. The workflow reflects whatever HR has already done in Entra ID – one less system to keep in sync, zero IT tickets when roles change.
It also means compliance by default. Every invoice gets approved by someone who currently has the authority, not someone who used to. If a $100k invoice tries to route to a manager with a $20k limit, it escalates automatically, so nothing gets approved outside policy and patched up after the fact.
Stuck invoices stop being a category of problem altogether, because departures, vacations and reorgs no longer create bottlenecks. The workflow adapts as the org changes.
Under the hood
The implementation uses standard Power Platform components.
Power Automate handles the orchestration. The Office 365 Users connector pulls manager relationships and user attributes directly from Entra ID at runtime, not from a synced copy that might be stale.
Approval limits live in Dataverse, mapped to Entra ID roles or groups. When the workflow needs to know whether someone can sign off on a $40k invoice, it reads the limit from their current assignment.
For matrix structures, where an invoice needs both a line manager and a project owner to approve, the workflow runs parallel approval paths with dependency logic. Both must approve before the invoice posts.
Delegation uses the built-in Entra ID delegation attributes plus Outlook’s automatic replies. If either is set, the workflow respects it.
The org chart is already a source of truth
Every company maintains its hierarchy somewhere, whether that’s an HR system, Entra ID or Workday. The problem starts when that source of truth doesn’t reach your financial workflows.
Hardcoded approvers in an AP system are a small copy of the org chart that starts drifting the day it’s created. Dynamic approvals pull from the real one – you digitize the approval policy once, and it keeps itself current.