Business Central security, from sign-in to posting rights
Business Central security has three layers. First, who can sign in. Second, what each person may do once inside. Third, what record you keep of changes. Microsoft secures the online service itself. Your side covers identity rules in Microsoft Entra ID, permission sets that match real jobs and tracking on key fields. We set up and tidy all three.
Last updated
Business Central security starts with sign-in rules
Business Central signs people in through Microsoft Entra ID. So the strongest controls live there. Multifactor sign-in and conditional access rules decide who gets in. They also decide which devices and places can connect. A stolen password should never be enough to open your ledger. We check that both apply to every account.
Next, we list the accounts that can reach each environment. That means licensed users, guest accounts, partner admins and service accounts for integrations. We remove leavers. We swap shared logins for named users. Integration access moves to service-to-service sign-in with its own narrow permissions.
Check who can sign in →
- ✓Multifactor authentication enforced
- ✓Conditional access policies
- ✓Leavers removed promptly
- ✓No shared user accounts
- ✓Partner admin access listed
Business Central security roles built around real jobs
Many companies go live with everyone on SUPER, because it made testing easier. We replace that with a permission set for each role. We assign them through security groups. So a new hire gets the right access by joining a group, not by copying a colleague.
We build sets by recording what a role really does in a sandbox. Then we trim them. Some people should see only part of the data, such as one location. For them, security filters narrow the records. The effective permissions page shows exactly why a user can or cannot do something.
Clean up your permission sets →- ✓SUPER limited to administrators
- ✓One set per job role
- ✓Security groups for assignment
- ✓Security filters on records
- ✓Effective permissions checked
Business Central security and segregation of duties
Good Business Central security also means one person cannot add a vendor, change its bank account and pay it. We map the sensitive steps in purchasing, payables, payroll journals and customer credit. Then we split them across roles. So every risky action needs a second pair of eyes.
If the team is too small to split duties, approval workflows fill the gap. A change to a vendor bank account waits for sign-off. So does a journal above a limit. Posting date ranges in user setup stop entries landing in closed periods. Auditors ask about this every time.
Map your risky steps →- ✓Vendor creation and payment
- ✓Bank account changes
- ✓Journal entry and approval
- ✓Credit limit changes
- ✓Posting period control
Business Central security audit: who changed what
The change log records edits to the tables and fields you choose. It stores the old value, the new value, the user and the time. Field monitoring goes a step further. It sends a notification when someone changes a sensitive field, such as a bank account number. Both are off by default.
We turn them on narrowly. Logging everything slows the system and buries the signal. Data classification marks fields that hold personal data. That helps with privacy requests. You can also send sign-in activity and permission changes to telemetry for a longer record. That helps during an audit. It also keeps Business Central security checks honest.
Set up change tracking →- ✓Vendor bank details
- ✓Customer credit limits
- ✓Posting group setup
- ✓Permission set assignments
- ✓General ledger setup fields
Business Central security: what Microsoft covers and what you own
For the online service, Microsoft runs the datacenters and patches the platform. It encrypts data at rest and in transit. It also takes database backups. That is a strong base. Still, it does not decide which of your users may post a payment journal. You still own the configuration.
Access drifts as people change roles. So we leave you with a simple routine. Managers confirm a regular list of users, groups and sets. A joiner and leaver checklist covers moves. A sandbox policy keeps copies of live data closed to most people. That routine keeps Business Central security working.
Plan a security routine →- ✓User and group listing
- ✓Joiner and leaver checklist
- ✓Sandbox access policy
- ✓Integration account register
- ✓Documented role matrix
Business Central security questions
Is Business Central online secure by default?
The platform is well protected by Microsoft: encryption, patching, backups and isolation between tenants. Your own access design is not set by default. You or a consultant must set up multifactor sign-in, tight permission sets and change tracking.
What is wrong with giving users the SUPER permission set?
SUPER allows everything in every company, including changing setup, deleting records and assigning permissions. A mistake or a compromised account then has no limits. A few administrators should hold it. Everyone else needs sets that fit their job.
Can we restrict a user to one company or one location?
Yes. You assign permission sets per company or for all companies. So a user can have one entity only. Within a company, security filters limit records by values such as location. Test them, because they affect speed.
How do we track changes to vendor bank accounts?
Turn on the change log for the vendor bank account table. Add field monitoring to send an alert when the account number changes. Then place an approval workflow on the change. Together these give prevention, alerting and an audit record.
Does our partner have access to our environment?
A partner with a delegated administration relationship can reach your environments for support. You can see and end these relationships in the Microsoft admin portal. We recommend listing them, keeping only the active ones and using granular roles instead of broad admin rights.
Book a discovery call
Let's talk through your move to Business Central.
A focused call with a senior consultant. We learn how your business runs today, give you an honest view on whether Business Central fits, and outline scope and next steps before you commit to anything.
What happens after you send the form