Business Central Permission Set Design Worksheet
Business Central permissions are built from permission sets that grant read, insert, modify, delete and execute rights on objects. Left unplanned, you end up with SUPER assigned to half the company. This worksheet lets you design the sets per role first, record who needs what, and mark segregation of duties risks before anything is configured.
| Business role | Permission set | Object type | Object ID and name | Read | Insert | Modify | Delete | Execute | SoD risk | |
|---|---|---|---|---|---|---|---|---|---|---|
Object IDs shown are standard BC objects: 17 G/L Entry, 23 Vendor, 27 Item, 38 Purchase Header, codeunit 90 Purch.-Post. In AL a permission is written as RIMDX letters; Indirect means access only through other objects and is shown as lowercase in the permission set editor. Flag High risk lines for the auditor, such as the same person creating vendors and posting payments. Build the final sets as AL permissionset objects or user-defined permission sets, and test with a real user.
Need a user access review for Business Central?
Optional: an expert look at your permission data and segregation of duties findings.
Optional. The tool and every export work without this. No spam.
How to use the worksheet
Add one row per object a role needs. Give the role, the permission set it will belong to, the object type and ID, and the level for read, insert, modify, delete and execute. Rate the segregation of duties risk. Sort by role to review a person's total access, or by risk to prepare for the auditor. Export to Excel for approval by process owners and for the audit file.
Permission model basics
A permission set is a list of object permissions. Users receive sets directly or through user groups. Table Data permissions control record access, while Table permissions control the object definition. Codeunits, reports and pages usually need Execute. Indirect permission means the user can access the data only through another object that has the right, which is the safest way to give posting access without direct edit rights. Microsoft supplies D365 sets for common roles, and you extend them with your own.
- Start from a D365 standard set and add exceptions
- Prefer Indirect for posting data
- Avoid SUPER outside of a few administrators
- Keep custom sets small and named with a prefix
Segregation of duties
Typical conflicts are creating vendors and approving payments, entering and posting purchase invoices, and maintaining bank accounts while posting payments. Mark such pairs as High risk in the sheet and decide whether to split roles, add an approval workflow, or accept the risk with a compensating review. Business Central has a permission set for each of these functions that you can use to test the combinations.
Common mistakes
Copying a power user's set to a new starter, giving Modify when Read is enough, not testing as the actual user profile, and leaving permissions for departed staff are the usual findings. Review sets after every upgrade or new extension, because new objects often need new permissions.
Frequently Asked Questions
What is a permission set in Business Central?
It is a named group of permissions on objects such as tables, pages, reports and codeunits. Users get permission sets directly or through user groups, and rights are the combined result.
What does Indirect permission mean?
Indirect lets a user read or write data only when an object with direct permission, such as a posting codeunit, does it for them. They cannot access the table directly.
Should I edit Microsoft's D365 permission sets?
No. Copy them or create your own sets, because Microsoft updates the standard ones. Use user-defined sets or AL permission set extensions to add what you need.
How often should I review permissions?
At least yearly, and after upgrades, role changes and new extensions. Many auditors expect a documented review of privileged access such as SUPER every period.
If you need a user access review or role redesign in Business Central, Netray can analyse the permission data with your auditors.
Related Tools
Business Central AL Extension Skeleton Generator
Fill in publisher, prefix and ID range to get app.json, a table extension, a page extension, an event subscriber codeunit and a permission set.
Microsoft DynamicsBusiness Central API v2.0 URL Builder
Generate correct Business Central API v2.0 endpoints, OData query strings, the OAuth token request and a test call for SaaS or on-premises.
Microsoft DynamicsBusiness Central Year-End Close Checklist
Work through preparation, subledger, inventory, closing and post-close steps for a clean Business Central fiscal year end.
More Microsoft Dynamics tools
See all- Business Central Configuration Package Worksheet
- Business Central Posting Groups Setup Worksheet
- Business Central Data Migration Field Mapping Worksheet
- Business Central Chart of Accounts Mapping Worksheet
- Business Central Implementation Statement of Work Template
- Business Central Functional Design Document Template
- Business Central User Acceptance Test Script Template
- Business Central Go-Live Cutover Plan Template
- Business Central License Cost Calculator
New to Microsoft Dynamics NAV and Business Central on-prem? Start with the Microsoft Dynamics NAV and Business Central on-prem guide and toolkit.
Keep exploring
Free tools
- Business Central User Access Request Form TemplateA fill-in form that records who needs access, which license, role center and permission sets, and who approved it.
- Business Central Functional Design Document TemplateDocument a Business Central customisation, report or integration with requirement, standard behaviour, gap, design, test and sign-off sections.
- Business Central License Cost CalculatorEstimate Business Central monthly and annual subscription cost from your user mix and your own price per user, with a chart of cost growth.
ERP fixes and how-tos
- Adding a Private AI Layer to Business Central On-PremisesAdd AI to Business Central on-prem without cloud: API v2.0, custom API pages, SQL replica, retrieval, local LLM, BC permission sets, approved write-back.
- Fixing "You do not have the following permissions on TableData (table): (permission)" in Business Central ALBusiness Central runtime error You do not have the following permissions on TableData. Why AL extensions hit this and how to add the missing permission set.
- Business Central Manufacturing Setup: Items, BOMs, Routings and Production OrdersSet up Business Central manufacturing: Manufacturing Setup, work centers, production BOMs, routings, item settings, manufacturing policy and demo data.
AI on your ERP
- AI for Dynamics 365 Business Central in Discrete ManufacturingGrounded AI for Dynamics 365 Business Central discrete manufacturers: production orders, planning worksheets, routings and costing, on a private LLM.
- AI for Business Central manufacturing operations, beyond CopilotAI for Business Central manufacturing beyond Copilot: grounded answers on production orders, routings, and capacity via APIs v2.0, on-prem capable.
Integrations
- How to build an MCP server for Dynamics 365 Business CentralBuild a Model Context Protocol server for Dynamics 365 Business Central: tools to expose, Entra auth, stdio vs HTTP, permission scoping and audit logging.
- How to add WhatsApp to Microsoft Dynamics 365 Business CentralHow to connect WhatsApp to Dynamics 365 Business Central: API v2.0 or custom API pages, webhooks, template messages, and two-way replies that post back safely.
Software
- Microsoft Dynamics 365 Business CentralDynamics 365 Business Central explained for manufacturers: modules, APIs, AL extensions, deployment, strengths, limits and alternatives for small and mid-size firms.
- Microsoft Dynamics 365 Finance and Supply ChainDynamics 365 Finance and Supply Chain Management explained for manufacturers: modules, data entities, OData, deployment, strengths, limits and alternatives.