---
id: object/codeunit/9002
type: object
title: Codeunit 9002 "Permission Manager"
summary: Codeunit 9002 "Permission Manager" in Base Application (System.Security.AccessControl). 11 public procedures, 2 event subscribers. Present since at least BC23, still in BC30, changed in BC25-29.
tier: official
language: en
tags:
  - codeunit
  - base application
versions:
  introduced: null
  last_changed: "29"
  deprecated: null
review:
  state: derived
  by: null
  at: null
  flags: []
generated:
  at: "2026-10-11T00:31:51.816Z"
  pipeline: 0.2.0
  prompts: {}
  input_hash: e03705ec80560a47a1c96905275d27fc9176a2b80da4e168df6fbee701ff9513
evidence:
  - kind: code
    url: https://github.com/microsoft/BCApps/blob/ea08af5ef2d6a9b5c5af4a029288abbe2c883220/src/Layers/W1/BaseApp/Modules/System/PermissionSets/PermissionManager.Codeunit.al
    title: src/Layers/W1/BaseApp/Modules/System/PermissionSets/PermissionManager.Codeunit.al (releases/29.x)
    date: null
    commit: ea08af5ef2d6a9b5c5af4a029288abbe2c883220
    t: null
    quote: null
links:
  learn: []
  objects: []
  features: []
  topics: []
  localizations: []
  videos: []
  posts: []
  guidelines: []
  changes:
    - change/bcapps/9946
object_type: codeunit
object_id: 9002
name: Permission Manager
namespace: System.Security.AccessControl
app: Base Application
extends: null
first_version: "23"
last_version: "30"
present_in:
  - "23"
  - "24"
  - "25"
  - "26"
  - "27"
  - "28"
  - "29"
  - "30"
changed_in:
  - "25"
  - "26"
  - "27"
  - "28"
  - "29"
source_major: "29"
obsolete: null
countries: []
ms_search_form_ids: []
counts:
  fields: 0
  procedures: 20
  events: 0
  subscribers: 2
relations:
  out: 0
  referenced_by: 0
  pages: 0
  extended_by: 0
  event_subscribers: 0
  calls: 4
  called_by: 12
  implements: 0
---

# Codeunit 9002 "Permission Manager"

> Codeunit 9002 "Permission Manager" in Base Application (System.Security.AccessControl). 11 public procedures, 2 event subscribers. Present since at least BC23, still in BC30, changed in BC25-29.

Base Application · System.Security.AccessControl · BC23-30 · [source at ea08af5e](https://github.com/microsoft/BCApps/blob/ea08af5ef2d6a9b5c5af4a029288abbe2c883220/src/Layers/W1/BaseApp/Modules/System/PermissionSets/PermissionManager.Codeunit.al) · facts from BC29

## Properties

| Property | Value |
|---|---|
| SingleInstance | true |
| Permissions | TableData "Permission Set Link" = rd, TableData "Aggregate Permission Set" = rimd |

## Event subscriptions

- OnBeforeDeleteTenantPermissionSet subscribes to Table "Tenant Permission Set" OnBeforeDeleteEvent
- CheckCurrentUserCanModifyUser subscribes to Table "User" OnBeforeModifyEvent

## Procedures

- `AssignDefaultPermissionsToUser(UserSecurityID: Guid): Boolean`
- `AssignDefaultPermissionsToUser(UserSecurityID: Guid; Company: Text[30]): Boolean`
- `ResetUserToDefaultPermissions(UserSecurityID: Guid)`
- `GetOfficePortalUserAdminUrl(): Text`
- `UpdateUserAccessForSaaS(UserSID: Guid): Boolean`
- `CanCurrentUserManagePlansAndGroups(): Boolean`
- `GenerateHashForPermissionSet(PermissionSetId: Code[30]): Text[250]`
- `IsFirstPermissionHigherThanSecond(First: Option; Second: Option): Boolean`
- `ResetUsersToIntelligentCloudPermissions()`
- `IsIntelligentCloud(): Boolean`
- `SetTestabilityIntelligentCloud(EnableIntelligentCloudForTest: Boolean)`

Plus 7 local procedures.

## Calls

From the extracted call graph of BC29 (graphify-al on the snapshot checkout): calls whose target is known from a declared type or an `Object::"Name"` argument. Interface dispatch and calls through events are not counted, so the list is not complete.

- [Codeunit 152 "User Permissions"](../codeunit/152.md) (2 calls: `CheckCurrentUserCanModifyUser → CanManageUsersOnTenant`, `ResetUsersToIntelligentCloudPermissions → IsSuper`)
- [Codeunit 457 "Environment Information"](../codeunit/457.md) (2 calls: `AllowUpdateUserAccessForSaaS → IsSaaS`, `ResetUsersToIntelligentCloudPermissions → IsSaaS`)
- [Codeunit 1266 "Cryptography Management"](../codeunit/1266.md) (1 call: `GenerateHashForPermissionSet → GenerateHash`)
- [Codeunit 9843 "User Selection"](../codeunit/9843.md) (1 call: `ResetUsersToIntelligentCloudPermissions → FilterSystemUserAndAADGroupUsers`)

## Called by

- [Page 4003 "Intelligent Cloud Management"](../page/4003.md) (2 calls: `OnOpenPage → IsIntelligentCloud`, `UpdateEditablityOfControls → IsIntelligentCloud`)
- [Page 40063 "Cloud Migration Management"](../page/40063.md) (2 calls: `OnOpenPage → IsIntelligentCloud`, `UpdateControlProperties → IsIntelligentCloud`)
- [Table 9802 "Permission Set Link"](../table/9802.md) (2 calls: `MarkWithChangedSource → GenerateHashForPermissionSet`, `UpdateSourceHashesOnAllLinks → GenerateHashForPermissionSet`)
- [Codeunit 4001 "Hybrid Cloud Management"](../codeunit/4001.md) (1 call: `AddCloudMigrationWizardToAssistedSetup → IsIntelligentCloud`)
- [Codeunit 9020 "User Access Update"](../codeunit/9020.md) (1 call: `OnUpdateUserAccessForSaaS → UpdateUserAccessForSaaS`)
- [Codeunit 9852 "Effective Permissions Mgt."](../codeunit/9852.md) (1 call: `IsPermissionRestrictedByLicense → IsFirstPermissionHigherThanSecond`)
- [Page 4007 "Intelligent Cloud Ready"](../page/4007.md) (1 call: `OnOpenPage → IsIntelligentCloud`)
- [Page 4017 "Intelligent Cloud Update"](../page/4017.md) (1 call: `OnInit → IsIntelligentCloud`)
- [Page 9192 "Company Creation Wizard"](../page/9192.md) (1 call: `FinishAction → AssignDefaultPermissionsToUser`)
- [Page 9802 "Permission Sets"](../page/9802.md) (1 call: `OnOpenPage → IsIntelligentCloud`)
- [Page extension 4009 "Hybrid O365 Activities"](../pageextension/4009.md) (1 call: `OnOpenPage → IsIntelligentCloud`)
- [Page extension 4011 "Hybrid Accountant Activities"](../pageextension/4011.md) (1 call: `OnOpenPage → IsIntelligentCloud`)

## Recent changes

- 2026-08-10 [#9946 Fix Retrieve Users overwriting existing users' custom Role Center (AB#641534)](../../changes/bcapps/9946.md) (main, BC30, fix)

## Across versions

- Present in: BC23-30
- Changed (declaration) in: BC25-29

Source: AL metadata extracted from the code (names, ids, signatures, properties); no code bodies (D10).

## Ask your agent

Procedure bodies are not stored here (D10). The call sections above are our own, per object, from the BC29 call graph. For a procedure body or the calls of one procedure, ask bc-code-atlas (external, by Stefan Maron, MIT; default corpus w1-28), which the bc-observatory plugin connects: `bcatlas_resolve_node(object_type: "codeunit", object_name: "Permission Manager")`, then `bcatlas_get_procedure_body` or `bcatlas_get_neighbors` on the returned id.