How to manage user permissions in Business Central

How user permissions in Business Central stack up

First, you create users in the Microsoft 365 admin center and give them a license such as Essentials, Premium or Team Members. Then you bring them into Business Central from the Users page with the update from Microsoft 365 action. The license sets the most a user could ever do, whatever you assign inside the application.

Within that limit, permission sets grant access to specific tables, pages, reports and codeunits. On the License Configuration page, an administrator chooses which permission sets each new user of a license type receives. Trim those defaults early. That way, no new starter arrives with broader access than the role needs.

Permission sets for user permissions in Business Central

A permission set is a named list of objects with a permission for each: Read, Insert, Modify, Delete and Execute. You can grant each one directly or as Indirect. Indirect means the user may use it only through another object, such as a posting routine. That is how someone can post an invoice without editing ledger entries.

Microsoft ships system permission sets, and extensions add their own. You cannot edit those. Instead, you can copy one, or create a new set that includes others and excludes specific permissions. SUPER grants everything and belongs only with administrators. Keep the number of SUPER holders small.

Assign user permissions in Business Central by security group

Assigning sets one user at a time does not scale. Instead, create security groups in Microsoft Entra, such as BC Accounts Payable or BC Warehouse. Then open the Security Groups page in Business Central, link each group and assign permission sets to it. Members inherit the permissions. When someone joins or leaves the group, their access changes with it.

Security groups replaced the older user groups feature, so companies upgrading from earlier versions should convert. You can also limit a permission set to one company or give it to all companies. That helps when a user keeps the books for one entity but should only view another.

Build custom user permissions in Business Central by recording

Guessing which tables a task touches is slow. So create a new permission set, open its permissions and start the recording action. Then do the task in another browser tab exactly as the user would. For example, create and post a purchase invoice. Stop the recording, and Business Central adds every object the task needed.

Next, go through the recorded lines and lower anything that looks too generous. Then test with a real user account. Adding exclusions to a broad standard set is often quicker than building from nothing. Include the standard set, then exclude the few permissions this role must not have, such as changing vendor bank accounts.

Checking user permissions in Business Central

The Effective Permissions page answers the question every administrator hears: why can this person do that, or why not? Pick a user and it lists each object and the resulting permission. It also shows which permission set or license right gives it. That resolves most reported permission errors quickly.

Permissions are not the only control. User Setup limits the allowed posting dates per user. Security filters can limit records for certain tables. The change log can record edits to sensitive fields such as bank details. Go through access whenever someone changes role. Our consultants can assess your current setup and propose a cleaner role design.

User permissions in Business Central: questions

How do I add a new user?

Create the account and assign a Business Central license in the Microsoft 365 admin center. Then open Users in Business Central and run the update from Microsoft 365. The user appears with the default permission sets for that license. After that, add the user to the right security group so the role permissions apply. Finally, ask them to sign in and test one daily task.

What is the difference between a permission set and a profile?

A permission set controls what data and functions a user may use. A profile, also called a role, controls what the user sees. That means the Role Center, the navigation menu and the page layouts. A user needs both, and you assign them in different places. So a clerk can see a clean menu and still lack rights they do not need.

Can I give access to only one company?

Yes. When you assign a permission set to a user or security group, you can leave the Company field blank for all companies or set it to one. The same user can therefore have full access in one company and read-only access in another. That suits an accountant who keeps the books for one entity and only views a second.

Why does a user get a permission error when posting?

Posting touches many tables indirectly, and the user's sets may lack one of them. The error message names the object. Look it up for that user on the Effective Permissions page. Then add the missing permission to the role's set, not to the single user. That way, the next person in the same role does not hit the same error.

Who should have the SUPER permission set?

Only administrators who maintain the system, and at least one must exist. Day-to-day finance and operations users should not hold it. It bypasses every restriction, so you could not show an auditor that duties stay separate. For these reasons, keep user permissions in Business Central tight and check the SUPER list often.

More on user permissions in Business Central

User permissions in Business Central work best alongside approvals and an audit trail. These pages cover those controls and the services we offer for checking how you have set up a system. If your roles have grown messy over the years, start there. Then bring your current permission sets and we will go through user permissions in Business Central with you. For the product detail, see Assign permissions to users and groups on Microsoft Learn.