# Business Central Permission Set Design Worksheet > Source: https://netray.co/tools/business-central-permission-set-design-worksheet > Publisher: Netray (netray.co), AI and integration engineering for ERP and manufacturing systems. > Section: Free Tools ## Short answer Map roles to objects and permission levels before you build permission sets, and flag segregation of duties risks early. ## Category microsoft-dynamics ## Erp Microsoft Dynamics 365 Business Central ## Audience - BC administrator - Internal auditor - BC consultant ## Tool **Kind:** worksheet **Mode:** editable **Columns:** #### Business role **Key:** role **Type:** text #### Permission set **Key:** pset **Type:** text #### Object type **Key:** otype **Type:** select **Options:** - Table Data - Table - Report - Codeunit - XMLport - Page - Query - System #### Object ID and name **Key:** oname **Type:** text #### Read **Key:** read **Type:** select **Options:** - Yes - Indirect - No #### Insert **Key:** insert **Type:** select **Options:** - Yes - Indirect - No #### Modify **Key:** modify **Type:** select **Options:** - Yes - Indirect - No #### Delete **Key:** delete **Type:** select **Options:** - Yes - Indirect - No #### Execute **Key:** exec **Type:** select **Options:** - Yes - No #### SoD risk **Key:** risk **Type:** select **Options:** - Low - Medium - High **Rows:** **Role:** AP clerk **Pset:** CUS AP ENTRY **Otype:** Table Data **Oname:** 23 Vendor **Read:** Yes **Insert:** No **Modify:** No **Delete:** No **Exec:** No **Risk:** Medium **Role:** AP clerk **Pset:** CUS AP ENTRY **Otype:** Table Data **Oname:** 38 Purchase Header **Read:** Yes **Insert:** Yes **Modify:** Yes **Delete:** No **Exec:** No **Risk:** Medium **Role:** AP manager **Pset:** CUS AP POST **Otype:** Codeunit **Oname:** 90 Purch.-Post **Read:** No **Insert:** No **Modify:** No **Delete:** No **Exec:** Yes **Risk:** High **Role:** Buyer **Pset:** CUS PURCH ORDER **Otype:** Table Data **Oname:** 23 Vendor **Read:** Yes **Insert:** Yes **Modify:** Yes **Delete:** No **Exec:** No **Risk:** High **Role:** Warehouse **Pset:** CUS WHSE **Otype:** Table Data **Oname:** 27 Item **Read:** Yes **Insert:** No **Modify:** No **Delete:** No **Exec:** No **Risk:** Low **Role:** Controller **Pset:** CUS GL REVIEW **Otype:** Table Data **Oname:** 17 G/L Entry **Read:** Yes **Insert:** Indirect **Modify:** No **Delete:** No **Exec:** No **Risk:** Low **Totals:** #### Permission lines to review **Key:** role **Agg:** count **Format:** integer **Notes:** Object IDs shown are standard BC objects: 17 G/L Entry, 23 Vendor, 27 Item, 38 Purchase Header, codeunit 90 Purch.-Post. In AL a permission is written as RIMDX letters; Indirect means access only through other objects and is shown as lowercase in the permission set editor. Flag High risk lines for the auditor, such as the same person creating vendors and posting payments. Build the final sets as AL permissionset objects or user-defined permission sets, and test with a real user. ## Content **Intro:** Business Central permissions are built from permission sets that grant read, insert, modify, delete and execute rights on objects. Left unplanned, you end up with SUPER assigned to half the company. This worksheet lets you design the sets per role first, record who needs what, and mark segregation of duties risks before anything is configured. **Sections:** #### How to use the worksheet **Body:** Add one row per object a role needs. Give the role, the permission set it will belong to, the object type and ID, and the level for read, insert, modify, delete and execute. Rate the segregation of duties risk. Sort by role to review a person's total access, or by risk to prepare for the auditor. Export to Excel for approval by process owners and for the audit file. #### Permission model basics **Body:** A permission set is a list of object permissions. Users receive sets directly or through user groups. Table Data permissions control record access, while Table permissions control the object definition. Codeunits, reports and pages usually need Execute. Indirect permission means the user can access the data only through another object that has the right, which is the safest way to give posting access without direct edit rights. Microsoft supplies D365 sets for common roles, and you extend them with your own. **Bullets:** - Start from a D365 standard set and add exceptions - Prefer Indirect for posting data - Avoid SUPER outside of a few administrators - Keep custom sets small and named with a prefix #### Segregation of duties **Body:** Typical conflicts are creating vendors and approving payments, entering and posting purchase invoices, and maintaining bank accounts while posting payments. Mark such pairs as High risk in the sheet and decide whether to split roles, add an approval workflow, or accept the risk with a compensating review. Business Central has a permission set for each of these functions that you can use to test the combinations. #### Common mistakes **Body:** Copying a power user's set to a new starter, giving Modify when Read is enough, not testing as the actual user profile, and leaving permissions for departed staff are the usual findings. Review sets after every upgrade or new extension, because new objects often need new permissions. **Cta:** If you need a user access review or role redesign in Business Central, Netray can analyse the permission data with your auditors. **Faq:** #### What is a permission set in Business Central? **Answer:** It is a named group of permissions on objects such as tables, pages, reports and codeunits. Users get permission sets directly or through user groups, and rights are the combined result. #### What does Indirect permission mean? **Answer:** Indirect lets a user read or write data only when an object with direct permission, such as a posting codeunit, does it for them. They cannot access the table directly. #### Should I edit Microsoft's D365 permission sets? **Answer:** No. Copy them or create your own sets, because Microsoft updates the standard ones. Use user-defined sets or AL permission set extensions to add what you need. #### How often should I review permissions? **Answer:** At least yearly, and after upgrades, role changes and new extensions. Many auditors expect a documented review of privileged access such as SUPER every period. ## Search terms business central permission set, business central permissions excel, business central segregation of duties, business central user roles and permissions, business central custom permission set, business central read insert modify delete execute, business central security design --- Talk to an engineer: https://netray.co/contact?intent=erp_ai | Machine catalog: https://netray.co/agent/catalog.json