VNE PMO Toolkit — One workspace to plan, govern and go live with Microsoft Dynamics 365 rollouts

Overview

The project at a glance.

52pages across the project and programme workspaces

148automated tests (128 unit, 20 end-to-end)

7integrations, all handled on the server

1runtime package dependency (the PostgreSQL driver)

VNE PMO Toolkit is a programme management platform for Microsoft Dynamics 365 Finance and Supply Chain Management implementations. Each rollout gets one workspace for the plan, risks, testing, cutover, budget and change management, and the steering committee gets a programme view calculated live from the same records. Dynamics 365 partners, consultancies and customer PMOs can run it under their own brand, on their own hosting.

Who it serves
Dynamics 365 partners and consultanciesA branded delivery platform they can deploy for each customer programme, with a ready-made demo programme for sales and training.
Customer PMOs and programme leadershipA single, trusted view of every rollout: progress against plan, risks, readiness and budget, plus an exportable steering pack.
Consultants, architects and test managersFit-gap, extensions, test evidence, defects, releases and the cutover runbook in one traceable place.
AdministratorsControl over users, module-level permissions, branding, integrations and a full audit trail.

The challenge

Dynamics 365 rollouts outgrow their spreadsheets

A Dynamics 365 Finance and Supply Chain programme is rarely one project. It is a global template followed by country rollouts in waves, each with its own legal entity, currency, plan, risks, test cycles, cutover weekend and go-live date.

Programme teams often track all of this in separate spreadsheets and trackers. The plan, the RAID log, test evidence, the cutover runbook and the budget drift apart, and each steering committee pack is rebuilt by hand from figures that do not agree. The question the board cares about most, whether the business is ready to go live, becomes hard to answer with confidence.

Partners who deliver these programmes face a second problem. They need tooling they can put in front of each customer under the right brand, with that customer's data kept completely separate.

What we built

A live record of the programme, from first plan to hypercare

VNE designed and built a browser-based PMO platform around how Dynamics 365 programmes are actually run. Each legal-entity rollout gets its own project workspace covering planning, solution delivery, RAID and governance, testing, releases, cutover, budget and organisational change. A Programme (PMO) workspace rolls every project up for the steering committee.

Nothing is reported twice. Dashboards, forecasts, earned value, readiness scores and the steering committee pack are calculated live from the underlying records, and one status date per project sets the "as at" date for every figure.

The product is white-label and self-hosted: one deployment per customer or programme, branded through configuration or an admin page, with role-based permissions enforced on the server, single sign-on, an audit trail and integrations with the tools delivery teams already use.

Key features

What it does.

Plan, Gantt and critical path

A Workstream › Stage › Task plan with dependencies, baselines and working-day scheduling. Drag a Gantt bar to reschedule and preview the knock-on effect on dependent tasks and milestones before it is saved.

Live executive reporting

Overview, trends, baseline variance, earned value and a forecast based on recent delivery pace, all calculated from the plan. The steering pack exports to editable PowerPoint or PDF.

Programme roll-up

A PMO workspace combines every rollout: project health, progress against plan, milestones and stage gates, programme RAID, budget and a cross-project resource capacity heatmap.

RAID, change and go-live readiness

Risks, assumptions, issues and dependencies scored on a 5 × 5 matrix, change requests with approvals, and Go/No-Go criteria with named sign-off.

Requirements to release traceability

Fit-gap and localisation requirements traced through extensions, test cases (SIT, UAT, end-to-end, RSAT regression and more) and releases, with Excel import for test cases.

Cutover runbook and War Room

One shared, day-by-day cutover plan dated from go-live, and a live War Room for the go-live window: countdown, what is running, next and blocked, and one-tap status updates.

White-label by configuration

Product name, logo, colours and wording are set through environment settings or an admin page with live preview. Text and link colours derived from any brand colour are adjusted to meet WCAG AA contrast.

Permissions, sign-in and audit

Per-module access levels enforced on the server, optional two-factor sign-in or Microsoft Entra ID single sign-on, and a server-side log of every sign-in and change.

Automations and integrations

No-code rules that notify, set fields or raise RAID items, plus Microsoft Teams, Jira Cloud, Power BI feeds, email-in and scheduled digests.

Inside the product

See it in action.

Screens captured from the working application using fictional demo data.

Programme Overview dashboard with programme KPIs and health cards for four country rollouts — The Programme (PMO) workspace rolls four legal-entity rollouts into one view: completion, overdue and blocked work, open risks and the health of each project. Every figure is calculated from the project records.

Project Overview executive dashboard for the USMF rollout with KPI tiles and recently added tasks — Each project has an executive overview: completion, critical-path work, escalations, scope growth and overall RAG, with a go-live countdown in the top bar and a board pack export.

Gantt chart of cutover tasks with dependency arrows and the critical path highlighted in red — The Gantt chart computes the critical path from task dependencies, draws the links, and shows slippage against the frozen baseline. Month-end close windows, when changes are frozen, are shaded.

Cutover War Room showing a live clock, go-live countdown and columns for in-progress, next and blocked activities — During the go-live window, the War Room shows what is running now, what is next and what is blocked, with one-tap Complete, Start and Block actions that reach other connected users straight away.

Test Management dashboard with test status donut chart, breakdown by category and module, and a readiness banner — Test Management tracks SIT, UAT, end-to-end, data migration and RSAT regression cases with evidence and linked defects, and turns them into a go-live testing readiness verdict.

Resource Capacity heatmap of weekly allocated hours per team member across four projects — The programme capacity heatmap shows each person's allocated hours by project for the week, flagging anyone approaching or over capacity across rollouts.

My Work on a phone showing a project manager's task count, open risks and task list — On a phone, My Work gives each person their own tasks, approvals and risks, with a bottom tab bar for the pages they use most. The app can be installed as a PWA.

Cutover War Room on a phone with live clock, go-live countdown and cutover progress tiles — The War Room works on a phone too, so cutover leads can follow progress and clear blockers away from their desks.

Branding and Organisation admin page with white-label identity fields, a live preview and a WCAG contrast check — Administrators white-label the product from one page: name, logo, colours and wording, with a live preview of the workspace and sign-in page and an automatic WCAG 2.1 contrast check.

Role access audit table showing Admin, Edit and View rights per module for five role presets — Access & Permissions audits what each role preset can do in every module. Restricted data is removed on the server before it reaches the browser.

Automation rule editor with a trigger, conditions and actions to notify the owner and raise a risk — No-code automations: when a task becomes blocked, notify its owner and raise a risk. Each rule shows how many times it has fired.

Audit Log filtered to changes, listing who changed which cutover activity and the status before and after — The server-side audit log records every sign-in and change: who changed what, from which value to which, and when. Only admins can annotate or delete entries, and those actions are logged too.

Workflow

How a rollout goes from set-up to go-live

01
Set up the deployment
Brand the workspace, start from the fictional demo programme or a blank project, and create a project for each legal entity with its country, currency and rollout wave.
02
Build the plan
Start from the organisation's own template, an Agile plan or a work breakdown structure using a guided wizard. The plan flows straight into the Gantt, capacity and dashboards.
03
Deliver and govern
Teams update tasks, RAID items, tests, defects and budget in one place. Automations, @mentions and live sync keep everyone on the same version.
04
Report without rework
Export the board pack, send weekly digests and a Teams status card, or connect Power BI, all from the same live figures.
05
Cut over and go live
Sign off Go/No-Go criteria, run the shared cutover runbook, and manage the go-live window from the War Room, then track hypercare defects.

Under the hood

How it's built.

The toolkit is a web app that people open in a browser and a small server that stores the data, checks who is allowed to see what, and talks to other systems such as email, Microsoft Teams, Jira and Power BI. Each customer or programme gets its own deployment with its own database, users and brand.

Technically, the front end is plain JavaScript with no framework or build step: 29 modules share a single namespace and calculate the dashboards, critical path, earned value and forecasts in the browser. The whole programme is one versioned JSON document. The Node.js server uses only Node's built-in modules plus the PostgreSQL driver, redacts that document per user on every read, protects hidden data on every write, diffs each save into the audit log and broadcasts new versions to other users over Server-Sent Events.

01Clients

Browser appindex.html plus 29 plain-JavaScript modules, no bundler
Compute engineKPIs, RAG, critical path, earned value, forecasts
Installable PWAService worker app shell, mobile tab bar
ExportsPowerPoint and PDF board packs built in the browser

02Edge & API

Node.js HTTP serverNode core only; strict CSP, HSTS, rate limits
REST API51 routes under /api, versioned saves (HTTP 409 on conflict)
Live syncServer-Sent Events for new versions and presence

03Services

Sessions and sign-inscrypt, HMAC-signed cookies, TOTP, OIDC with PKCE
Permission redactionStrip unreadable modules on read, restore on write
Audit diffWho changed what, from and to, computed on save
SchedulerWeekly digest, per-user digests, board pack email

04Data

PostgreSQL7 tables, created and upgraded automatically at start-up
Programme containerOne versioned JSON document per deployment
Version historyRolling admin-only snapshots with one-click restore

05External services

Microsoft Entra IDOptional single sign-on
SMTP and Microsoft TeamsNotifications, digests, status cards
Jira CloudPush tasks, RAID and decisions; pull status
Power BIToken-protected CSV and JSON feeds
Anthropic Claude APIOptional AI-written executive narrative

Technology

Frontend

Plain JavaScript (no build step)
HTML and CSS design tokens
Progressive web app (service worker)
PptxGenJS (vendored)
jsPDF and AutoTable (vendored)
Inter and Plus Jakarta Sans

Backend

Node.js 18+ (CI on Node 22)
Node core http, crypto, net and tls
Server-Sent Events

Data

PostgreSQL (pg 8.13)
Versioned JSON programme container
JSON file store (development)

AI & ML

Anthropic Claude API (optional)

Integrations & APIs

SMTP email relay
Microsoft Teams webhooks
Jira Cloud REST API
Power BI CSV and JSON feeds
Inbound email webhook

Auth & Security

scrypt password hashing
HMAC-signed session cookies
TOTP two-factor sign-in (RFC 6238)
Microsoft Entra ID SSO (OIDC with PKCE)
Module-level RBAC
Strict Content Security Policy

Hosting & DevOps

Single Node.js process
Any Node 18+ host (Azure, Railway)
GitHub Actions CI
Health endpoint
Production fail-fast checks

Testing & Quality

Node test runner (128 unit tests)
Playwright 1.56 (20 end-to-end tests)
White-label protected-term guard
Demo programme validator

Engineering highlights

The hard parts, solved.

01
Exact permissions on a single-document data model
The whole programme is stored as one JSON document, which keeps reporting consistent but makes access control harder. The server removes every module a user cannot read before sending the document, including budget figures embedded in other records. When that user saves, anything they could not see is restored from the stored copy, so a restricted user can never delete hidden data. Saves are version-checked, so a stale browser cannot overwrite newer work.
02
Scheduling maths that planners can trust
The critical path is calculated with early and late start, finish and float over working days that skip weekends and each project's public holidays. The same engine drives a what-if preview: dragging a Gantt bar projects the shift on every dependent task and milestone before anything is written. Earned value (CPI, SPI, EAC) is calculated in effort hours, and the forecast projects completion from the last six weeks of delivery pace, falling back to the average pace since the project started. The critical path and earned value have their own unit tests.
03
Almost no third-party code
The server has one runtime package dependency: the PostgreSQL driver. Sessions, password hashing, TOTP, the SMTP client and OpenID Connect sign-in are built on Node's own modules. In the browser, the only third-party code is three vendored, MIT-licensed libraries for PowerPoint, PDF and QR codes, loaded on first use, and Excel import reads the .xlsx ZIP format directly with the browser's built-in decompression. With a strict Content Security Policy, this keeps the attack surface small and easy to review.
04
White-label without leaks
One brand schema is shared by the browser and the server, so the UI, emails, Teams cards, the authenticator label and the installed-app name always match. Text-safe colour variants are derived from any primary colour and darkened until they meet WCAG AA contrast. A CI guard scans every file for protected names and colours supplied only as secrets or hashes, so a partner's rebranded copy cannot ship with another customer's name in it.
05
A demo programme that never goes stale
Sales demos and training need a realistic programme that always looks current. A deterministic, seeded generator builds a fictional four-country Contoso rollout with plans, RAID, tests, defects, budget and cutover, all dated relative to the current week. A headless validator checks it in CI on every pull request.

Outcome

Production-ready at version 2.0

Continuous integration runs a syntax check, the unit tests, a demo-programme validation and a Playwright end-to-end suite against the real server. In a local run, all 20 end-to-end tests and 126 of the 128 unit tests passed; the other two need secrets that exist only in CI. The product ships with deployment, security, single sign-on, staging and white-label guides, and a new-customer onboarding checklist.

It started as an interactive replacement for a spreadsheet-based Dynamics 365 rollout plan and has grown into a full delivery and governance platform, packaged as a white-label product. Each customer runs a private deployment, so there is no public instance to link to. It shows what VNE can deliver: domain-specific product design for ERP programmes, secure multi-user web engineering and integration with the Microsoft ecosystem.