Business Central Permission Set Design Worksheet
Business Central permissions are built from permission sets that grant read, insert, modify, delete and execute rights on objects. Left unplanned, you end up with SUPER assigned to half the company. This worksheet lets you design the sets per role first, record who needs what, and mark segregation of duties risks before anything is configured.
| Business role | Permission set | Object type | Object ID and name | Read | Insert | Modify | Delete | Execute | SoD risk | |
|---|---|---|---|---|---|---|---|---|---|---|
Object IDs shown are standard BC objects: 17 G/L Entry, 23 Vendor, 27 Item, 38 Purchase Header, codeunit 90 Purch.-Post. In AL a permission is written as RIMDX letters; Indirect means access only through other objects and is shown as lowercase in the permission set editor. Flag High risk lines for the auditor, such as the same person creating vendors and posting payments. Build the final sets as AL permissionset objects or user-defined permission sets, and test with a real user.
Need a user access review for Business Central?
Optional: an expert look at your permission data and segregation of duties findings.
Optional. The tool and every export work without this. No spam.
How to use the worksheet
Add one row per object a role needs. Give the role, the permission set it will belong to, the object type and ID, and the level for read, insert, modify, delete and execute. Rate the segregation of duties risk. Sort by role to review a person's total access, or by risk to prepare for the auditor. Export to Excel for approval by process owners and for the audit file.
Permission model basics
A permission set is a list of object permissions. Users receive sets directly or through user groups. Table Data permissions control record access, while Table permissions control the object definition. Codeunits, reports and pages usually need Execute. Indirect permission means the user can access the data only through another object that has the right, which is the safest way to give posting access without direct edit rights. Microsoft supplies D365 sets for common roles, and you extend them with your own.
- Start from a D365 standard set and add exceptions
- Prefer Indirect for posting data
- Avoid SUPER outside of a few administrators
- Keep custom sets small and named with a prefix
Segregation of duties
Typical conflicts are creating vendors and approving payments, entering and posting purchase invoices, and maintaining bank accounts while posting payments. Mark such pairs as High risk in the sheet and decide whether to split roles, add an approval workflow, or accept the risk with a compensating review. Business Central has a permission set for each of these functions that you can use to test the combinations.
Common mistakes
Copying a power user's set to a new starter, giving Modify when Read is enough, not testing as the actual user profile, and leaving permissions for departed staff are the usual findings. Review sets after every upgrade or new extension, because new objects often need new permissions.
Frequently Asked Questions
What is a permission set in Business Central?
It is a named group of permissions on objects such as tables, pages, reports and codeunits. Users get permission sets directly or through user groups, and rights are the combined result.
What does Indirect permission mean?
Indirect lets a user read or write data only when an object with direct permission, such as a posting codeunit, does it for them. They cannot access the table directly.
Should I edit Microsoft's D365 permission sets?
No. Copy them or create your own sets, because Microsoft updates the standard ones. Use user-defined sets or AL permission set extensions to add what you need.
How often should I review permissions?
At least yearly, and after upgrades, role changes and new extensions. Many auditors expect a documented review of privileged access such as SUPER every period.
If you need a user access review or role redesign in Business Central, Netray can analyse the permission data with your auditors.
Related Tools
Business Central AL Extension Skeleton Generator
Fill in publisher, prefix and ID range to get app.json, a table extension, a page extension, an event subscriber codeunit and a permission set.
Microsoft DynamicsBusiness Central API v2.0 URL Builder
Generate correct Business Central API v2.0 endpoints, OData query strings, the OAuth token request and a test call for SaaS or on-premises.
Microsoft DynamicsBusiness Central Year-End Close Checklist
Work through preparation, subledger, inventory, closing and post-close steps for a clean Business Central fiscal year end.
More Microsoft Dynamics tools
See all- Business Central Configuration Package Worksheet
- Business Central Posting Groups Setup Worksheet
- Business Central Data Migration Field Mapping Worksheet
- Business Central Chart of Accounts Mapping Worksheet
- Business Central Implementation Statement of Work Template
- Business Central Functional Design Document Template
- Business Central User Acceptance Test Script Template
- Business Central Go-Live Cutover Plan Template
- Business Central License Cost Calculator