---
id: object/codeunit/153
type: object
title: Codeunit 153 "User Permissions Impl."
summary: Codeunit 153 "User Permissions Impl." in System Application (System.Security.User). 9 public procedures, 1 events, 4 event subscribers. Present since at least BC23, still in BC30, changed in BC24-26.
tier: official
language: en
tags:
  - codeunit
  - system application
versions:
  introduced: null
  last_changed: "26"
  deprecated: null
review:
  state: derived
  by: null
  at: null
  flags: []
generated:
  at: "2026-10-11T00:31:51.816Z"
  pipeline: 0.2.0
  prompts: {}
  input_hash: d769e5ef48e408992c16f957c2617de01d4fcf8592712835fe31586ff6311300
evidence:
  - kind: code
    url: https://github.com/microsoft/BCApps/blob/ea08af5ef2d6a9b5c5af4a029288abbe2c883220/src/System%20Application/App/User%20Permissions/src/UserPermissionsImpl.Codeunit.al
    title: src/System Application/App/User Permissions/src/UserPermissionsImpl.Codeunit.al (releases/29.x)
    date: null
    commit: ea08af5ef2d6a9b5c5af4a029288abbe2c883220
    t: null
    quote: null
links:
  learn: []
  objects: []
  features: []
  topics: []
  localizations: []
  videos: []
  posts: []
  guidelines: []
object_type: codeunit
object_id: 153
name: User Permissions Impl.
namespace: System.Security.User
app: System Application
extends: null
first_version: "23"
last_version: "30"
present_in:
  - "23"
  - "24"
  - "25"
  - "26"
  - "27"
  - "28"
  - "29"
  - "30"
changed_in:
  - "24"
  - "25"
  - "26"
source_major: "29"
obsolete: null
countries: []
ms_search_form_ids: []
counts:
  fields: 0
  procedures: 19
  events: 1
  subscribers: 4
relations:
  out: 0
  referenced_by: 0
  pages: 0
  extended_by: 0
  event_subscribers: 0
  calls: 1
  called_by: 1
  implements: 0
---

# Codeunit 153 "User Permissions Impl."

> Codeunit 153 "User Permissions Impl." in System Application (System.Security.User). 9 public procedures, 1 events, 4 event subscribers. Present since at least BC23, still in BC30, changed in BC24-26.

System Application · System.Security.User · BC23-30 · [source at ea08af5e](https://github.com/microsoft/BCApps/blob/ea08af5ef2d6a9b5c5af4a029288abbe2c883220/src/System%20Application/App/User%20Permissions/src/UserPermissionsImpl.Codeunit.al) · facts from BC29

## Properties

| Property | Value |
|---|---|
| Access | Internal |
| Permissions | tabledata "Access Control" = rimd, tabledata User = r |

## Events published

- `OnCanManageUsersOnTenant(UserSID: Guid; var Result: Boolean)` (internal): An event that indicates that subscribers should set the result that should be returned when the CanManageUsersOnTenant is called.

## Event subscriptions

- CheckSuperPermissionsBeforeRenameAccessControl subscribes to Table "Access Control" OnBeforeRenameEvent
- CheckSuperPermissionsBeforeDeleteAccessControl subscribes to Table "Access Control" OnBeforeDeleteEvent
- CheckSuperPermissionsBeforeModifyUser subscribes to Table "User" OnBeforeModifyEvent
- CheckSuperPermissionsBeforeDeleteUser subscribes to Table "User" OnBeforeDeleteEvent

## Procedures

- `IsSuper(UserSecurityId: Guid): Boolean`
- `RemoveSuperPermissions(UserSecurityId: Guid): Boolean`
- `CanManageUsersOnTenant(UserSID: Guid): Boolean`
- `HasUserPermissionSetAssigned(UserSecurityId: Guid; Company: Text; RoleId: Code[20]; ItemScope: Option; AppId: Guid): Boolean`
- `HasUserPermissionSetDirectlyAssigned(UserSecurityId: Guid; Company: Text; RoleId: Code[20]; ItemScope: Option; AppId: Guid): Boolean`
- `GetEffectivePermission(UserSecurityIdToCheck: Guid; CompanyNameToCheck: Text; PermissionObjectType: Option "Table Data","Table",,"Report",,"Codeunit","XMLport",MenuSuite,"Page","Query","System",,,,,,,,,; ObjectId: Integer): Text` (internal)
- `GetEffectivePermission(PermissionObjectType: Option "Table Data","Table",,"Report",,"Codeunit","XMLport",MenuSuite,"Page","Query","System",,,,,,,,,; ObjectId: Integer): Record "Expanded Permission" temporary`
- `AssignPermissionSets(var UserSecurityId: Guid; CompanyName: Text; var AggregatePermissionSet: Record "Aggregate Permission Set")`
- `AssignPermissionSet(var UserSecurityId: Guid; CompanyName: Text; var AggregatePermissionSet: Record "Aggregate Permission Set")`

Plus 5 local procedures.

## Calls

From the extracted call graph of BC29 (graphify-al on the snapshot checkout): calls whose target is known from a declared type or an `Object::"Name"` argument. Interface dispatch and calls through events are not counted, so the list is not complete.

- [Codeunit 457 "Environment Information"](../codeunit/457.md) (3 calls: `CheckSuperPermissionsBeforeDeleteAccessControl → IsSaaS`, `CheckSuperPermissionsBeforeDeleteUser → IsSaaS`, `CheckSuperPermissionsBeforeRenameAccessControl → IsSaaS`)

## Called by

- [Codeunit 152 "User Permissions"](../codeunit/152.md) (6 calls: `AssignPermissionSets → AssignPermissionSets`, `CanManageUsersOnTenant → CanManageUsersOnTenant`, `GetEffectivePermission → GetEffectivePermission`, …)

## Across versions

- Present in: BC23-30
- Changed (declaration) in: BC24-26

Source: AL metadata extracted from the code (names, ids, signatures, properties); no code bodies (D10).

## Ask your agent

Procedure bodies are not stored here (D10). The call sections above are our own, per object, from the BC29 call graph. For a procedure body or the calls of one procedure, ask bc-code-atlas (external, by Stefan Maron, MIT; default corpus w1-28), which the bc-observatory plugin connects: `bcatlas_resolve_node(object_type: "codeunit", object_name: "User Permissions Impl.")`, then `bcatlas_get_procedure_body` or `bcatlas_get_neighbors` on the returned id.