---
id: object/codeunit/152
type: object
title: Codeunit 152 "User Permissions"
summary: Codeunit 152 "User Permissions" in System Application (System.Security.User). 6 public procedures. Present since at least BC23, still in BC30, changed in BC25-26.
tier: official
language: en
tags:
  - codeunit
  - system application
versions:
  introduced: null
  last_changed: "26"
  deprecated: null
review:
  state: derived
  by: null
  at: null
  flags: []
generated:
  at: "2026-10-11T00:31:51.816Z"
  pipeline: 0.2.0
  prompts: {}
  input_hash: 8874c9628f403aa22ab033ce4bfca442059c797ad804aab041e2d209f87ce16a
evidence:
  - kind: code
    url: https://github.com/microsoft/BCApps/blob/ea08af5ef2d6a9b5c5af4a029288abbe2c883220/src/System%20Application/App/User%20Permissions/src/UserPermissions.Codeunit.al
    title: src/System Application/App/User Permissions/src/UserPermissions.Codeunit.al (releases/29.x)
    date: null
    commit: ea08af5ef2d6a9b5c5af4a029288abbe2c883220
    t: null
    quote: null
links:
  learn: []
  objects: []
  features: []
  topics: []
  localizations: []
  videos: []
  posts: []
  guidelines: []
object_type: codeunit
object_id: 152
name: User Permissions
namespace: System.Security.User
app: System Application
extends: null
first_version: "23"
last_version: "30"
present_in:
  - "23"
  - "24"
  - "25"
  - "26"
  - "27"
  - "28"
  - "29"
  - "30"
changed_in:
  - "25"
  - "26"
source_major: "29"
obsolete: null
countries: []
ms_search_form_ids: []
counts:
  fields: 0
  procedures: 6
  events: 0
  subscribers: 0
relations:
  out: 0
  referenced_by: 0
  pages: 0
  extended_by: 0
  event_subscribers: 0
  calls: 1
  called_by: 44
  implements: 0
---

# Codeunit 152 "User Permissions"

> Codeunit 152 "User Permissions" in System Application (System.Security.User). 6 public procedures. Present since at least BC23, still in BC30, changed in BC25-26.

System Application · System.Security.User · BC23-30 · [source at ea08af5e](https://github.com/microsoft/BCApps/blob/ea08af5ef2d6a9b5c5af4a029288abbe2c883220/src/System%20Application/App/User%20Permissions/src/UserPermissions.Codeunit.al) · facts from BC29

## Properties

| Property | Value |
|---|---|
| Access | Public |

## Procedures

- `IsSuper(UserSecurityId: Guid): Boolean`: Checks whether the user has the SUPER permissions set.
- `RemoveSuperPermissions(UserSecurityId: Guid): Boolean`: Removes the SUPER permissions set from a user.
- `CanManageUsersOnTenant(UserSecurityId: Guid): Boolean`: Checks whether the user has permission to manage users in the tenant.
- `HasUserPermissionSetAssigned(UserSecurityId: Guid; Company: Text; RoleId: Code[20]; Scope: Option; AppId: Guid): Boolean`: Checks whether a user has a specific permission set assigned.
- `AssignPermissionSets(var UserSecurityId: Guid; CompanyName: Text; var AggregatePermissionSet: Record "Aggregate Permission Set")`: Assign a permission set to a given user
- `GetEffectivePermission(PermissionObjectType: Option "Table Data","Table",,"Report",,"Codeunit","XMLport",MenuSuite,"Page","Query","System",,,,,,,,,; ObjectId: Integer): Record "Expanded Permission" temporary`: Gets the effective permissions for the current user in the current company.

## Calls

From the extracted call graph of BC29 (graphify-al on the snapshot checkout): calls whose target is known from a declared type or an `Object::"Name"` argument. Interface dispatch and calls through events are not counted, so the list is not complete.

- [Codeunit 153 "User Permissions Impl."](../codeunit/153.md) (6 calls: `AssignPermissionSets → AssignPermissionSets`, `CanManageUsersOnTenant → CanManageUsersOnTenant`, `GetEffectivePermission → GetEffectivePermission`, …)

## Called by

- [Codeunit 20406 "Qlty. Permission Mgmt."](../codeunit/20406.md) (5 calls: `CanDeleteTableData → GetEffectivePermission`, `CanInsertTableData → GetEffectivePermission`, `CanModifyTableData → GetEffectivePermission`, …)
- [Codeunit 3307 "Payables Agent Setup"](../codeunit/3307.md) (3 calls: `ApplyAgentSetup → AssignPermissionSets`, `ApplyAgentSetup → HasUserPermissionSetAssigned`, `ApplyAgentSetup → IsSuper`)
- [Codeunit 6922 "Expense Agent Entra App Mgt."](../codeunit/6922.md) (3 calls: `HasSecurityPermission → HasUserPermissionSetAssigned`, `VerifyCurrentUserCanManageExpenseAgent → HasUserPermissionSetAssigned`, `VerifyCurrentUserCanManageExpenseAgent → IsSuper`)
- [Codeunit 3904 "Apply Retention Policy Impl."](../codeunit/3904.md) (2 calls: `TruncateTableRecords → GetEffectivePermission`, `VerifyIndirectDeletePermission → GetEffectivePermission`)
- [Codeunit 4001 "Hybrid Cloud Management"](../codeunit/4001.md) (2 calls: `CanGrantPermission → IsSuper`, `CanSetupIntelligentCloud → IsSuper`)
- [Codeunit 489 "IC Partner Change Monitor"](../codeunit/489.md) (2 calls: `CheckHasPermissionsToChangeSensitiveFields → HasUserPermissionSetAssigned`, `CheckHasPermissionsToChangeSensitiveFields → IsSuper`)
- [Codeunit 9001 "Permission Pages Mgt."](../codeunit/9001.md) (2 calls: `CheckAndRaiseNotificationIfAppDBPermissionSetsChanged → CanManageUsersOnTenant`, `DisallowEditingPermissionSetsForNonAdminUsers → CanManageUsersOnTenant`)
- [Codeunit 9002 "Permission Manager"](../codeunit/9002.md) (2 calls: `CheckCurrentUserCanModifyUser → CanManageUsersOnTenant`, `ResetUsersToIntelligentCloudPermissions → IsSuper`)
- [Codeunit 9018 "Azure AD Plan Impl."](../codeunit/9018.md) (2 calls: `AddNewlyAssignedUserPlans → RemoveSuperPermissions`, `AssignPlanToUserWithDelegatedRole → RemoveSuperPermissions`)
- [Codeunit 9175 "User Settings Impl."](../codeunit/9175.md) (2 calls: `CheckPermissionsInternal → IsSuper`, `HideUsersDependingOnPermissions → CanManageUsersOnTenant`)
- [Page 9192 "Company Creation Wizard"](../page/9192.md) (2 calls: `OnInit → CanManageUsersOnTenant`, `OnInit → IsSuper`)
- [Page 9515 "Azure AD User Update Wizard"](../page/9515.md) (2 calls: `OnOpenPage → CanManageUsersOnTenant`, `OnOpenPage → IsSuper`)
- [Page 9800 "Users"](../page/9800.md) (2 calls: `OnInit → CanManageUsersOnTenant`, `OnInit → IsSuper`)
- [Page 9807 "User Card"](../page/9807.md) (2 calls: `OnAfterGetRecord → CanManageUsersOnTenant`, `SetPermissionsVisibility → CanManageUsersOnTenant`)
- [Codeunit 1430 "Role Center Notification Mgt."](../codeunit/1430.md) (1 call: `ShowNotifications → IsSuper`)
- [Codeunit 1932 "Scheduled Perf. Profiler Impl."](../codeunit/1932.md) (1 call: `ValidateScheduleCreationPermissions → CanManageUsersOnTenant`)
- [Codeunit 2027 "Image Analyzer Ext. Mgt."](../codeunit/2027.md) (1 call: `IsSetupNotificationEnabled → IsSuper`)
- [Codeunit 40032 "Migration Validation"](../codeunit/40032.md) (1 call: `CanStartBackgroundJob → IsSuper`)
- [Codeunit 4035 "Wizard Integration"](../codeunit/4035.md) (1 call: `CanStartBackgroundJob → IsSuper`)
- [Codeunit 4318 "Agent System Permissions Impl."](../codeunit/4318.md) (1 call: `CurrentUserHasExecuteSystemPermission → GetEffectivePermission`)
- [Codeunit 47005 "SL Wizard Integration"](../codeunit/47005.md) (1 call: `CanStartBackgroundJob → IsSuper`)
- [Codeunit 6301 "Power BI Service Mgt."](../codeunit/6301.md) (1 call: `IsUserAdminForPowerBI → IsSuper`)
- [Codeunit 7774 "Copilot Capability Impl"](../codeunit/7774.md) (1 call: `IsAdmin → IsSuper`)
- [Codeunit 9822 "Plan Configuration Impl."](../codeunit/9822.md) (1 call: `VerifyUserHasRequiredPermissionSet → HasUserPermissionSetAssigned`)
- [Codeunit 9852 "Effective Permissions Mgt."](../codeunit/9852.md) (1 call: `DisallowViewingEffectivePermissionsForNonAdminUsers → CanManageUsersOnTenant`)
- [Codeunit 9856 "Permission Set Relation Impl."](../codeunit/9856.md) (1 call: `VerifyUserCanEditPermissionSet → CanManageUsersOnTenant`)
- [Page 4000 "Hybrid Cloud Setup Wizard"](../page/4000.md) (1 call: `OnInit → IsSuper`)
- [Page 4003 "Intelligent Cloud Management"](../page/4003.md) (1 call: `OnOpenPage → IsSuper`)
- [Page 40063 "Cloud Migration Management"](../page/40063.md) (1 call: `OnOpenPage → IsSuper`)
- [Page 4007 "Intelligent Cloud Ready"](../page/4007.md) (1 call: `OnOpenPage → IsSuper`)
- [Page 4017 "Intelligent Cloud Update"](../page/4017.md) (1 call: `OnInit → IsSuper`)
- [Page 8700 "Table Information"](../page/8700.md) (1 call: `OnInit → IsSuper`)
- [Page 9200 "Personalized Pages"](../page/9200.md) (1 call: `PrivacyFilterUserPersonalizations → CanManageUsersOnTenant`)
- [Page 9802 "Permission Sets"](../page/9802.md) (1 call: `OnInit → CanManageUsersOnTenant`)
- [Page 9811 "User ACS Setup"](../page/9811.md) (1 call: `OnInit → CanManageUsersOnTenant`)
- [Page 9812 "Set Web Service Access Key"](../page/9812.md) (1 call: `OnOpenPage → CanManageUsersOnTenant`)
- [Page 9855 "Permission Set"](../page/9855.md) (1 call: `OnDeleteRecord → CanManageUsersOnTenant`)
- [Page 9871 "Security Groups"](../page/9871.md) (1 call: `OnOpenPage → CanManageUsersOnTenant`)
- [Page extension 4015 "Intelligent Cloud Extension"](../pageextension/4015.md) (1 call: `OnOpenPage → IsSuper`)
- [Page extension 9800 "Users Perf. Factboxes"](../pageextension/9800.md) (1 call: `OnOpenPage → CanManageUsersOnTenant`)
- [Page extension 9807 "User Card Perf. Factboxes"](../pageextension/9807.md) (1 call: `OnOpenPage → CanManageUsersOnTenant`)
- [Table 1853 "MS - Sales Forecast Setup"](../table/1853.md) (1 call: `CheckEnabled → IsSuper`)
- [Table extension 2025 "MS - Image Analyzer Setup"](../tableextension/2025.md) (1 call: `OnBeforeModify → IsSuper`)
- [XMLport 9864 "Import Permission Sets"](../xmlport/9864.md) (1 call: `DisallowEditingPermissionSetsForNonAdminUsers → CanManageUsersOnTenant`)

## Across versions

- Present in: BC23-30
- Changed (declaration) in: BC25-26

Source: AL metadata extracted from the code (names, ids, signatures, properties); no code bodies (D10).

## Ask your agent

Procedure bodies are not stored here (D10). The call sections above are our own, per object, from the BC29 call graph. For a procedure body or the calls of one procedure, ask bc-code-atlas (external, by Stefan Maron, MIT; default corpus w1-28), which the bc-observatory plugin connects: `bcatlas_resolve_node(object_type: "codeunit", object_name: "User Permissions")`, then `bcatlas_get_procedure_body` or `bcatlas_get_neighbors` on the returned id.