---
id: object/codeunit/9031
type: object
title: Codeunit 9031 "Security Group"
summary: Codeunit 9031 "Security Group" in System Application (System.Security.AccessControl). 19 public procedures. Present since at least BC23, still in BC30, changed in BC24.
tier: official
language: en
tags:
  - codeunit
  - system application
versions:
  introduced: null
  last_changed: "24"
  deprecated: null
review:
  state: derived
  by: null
  at: null
  flags: []
generated:
  at: "2026-10-11T00:31:51.816Z"
  pipeline: 0.2.0
  prompts: {}
  input_hash: 4a71f4f00a11626c9f2e87d38e1194b3e3984f7733335a9b13040f948dfaf4a6
evidence:
  - kind: code
    url: https://github.com/microsoft/BCApps/blob/ea08af5ef2d6a9b5c5af4a029288abbe2c883220/src/System%20Application/App/Security%20Groups/src/SecurityGroup.Codeunit.al
    title: src/System Application/App/Security Groups/src/SecurityGroup.Codeunit.al (releases/29.x)
    date: null
    commit: ea08af5ef2d6a9b5c5af4a029288abbe2c883220
    t: null
    quote: null
links:
  learn: []
  objects: []
  features: []
  topics: []
  localizations: []
  videos: []
  posts: []
  guidelines: []
object_type: codeunit
object_id: 9031
name: Security Group
namespace: System.Security.AccessControl
app: System Application
extends: null
first_version: "23"
last_version: "30"
present_in:
  - "23"
  - "24"
  - "25"
  - "26"
  - "27"
  - "28"
  - "29"
  - "30"
changed_in:
  - "24"
source_major: "29"
obsolete: null
countries: []
ms_search_form_ids: []
counts:
  fields: 0
  procedures: 19
  events: 0
  subscribers: 0
relations:
  out: 0
  referenced_by: 0
  pages: 0
  extended_by: 0
  event_subscribers: 0
  calls: 1
  called_by: 14
  implements: 0
---

# Codeunit 9031 "Security Group"

> Codeunit 9031 "Security Group" in System Application (System.Security.AccessControl). 19 public procedures. Present since at least BC23, still in BC30, changed in BC24.

System Application · System.Security.AccessControl · BC23-30 · [source at ea08af5e](https://github.com/microsoft/BCApps/blob/ea08af5ef2d6a9b5c5af4a029288abbe2c883220/src/System%20Application/App/Security%20Groups/src/SecurityGroup.Codeunit.al) · facts from BC29

## Properties

| Property | Value |
|---|---|
| Access | Public |

## Procedures

- `Create(GroupCode: Code[20]; GroupId: Text)`: Creates a new security group.
- `Delete(GroupCode: Code[20])`: Deletes a security group.
- `Copy(SourceGroupCode: Code[20]; DestinationGroupCode: Code[20]; DestinationGroupId: Text)`: Copies a security group.
- `CopyPermissions(SourceGroupCode: Code[20]; DestinationGroupCode: Code[20])`: Copies permission sets from the source security group to the destination security group.
- `AddPermissionSet(GroupCode: Code[20]; RoleId: Code[20]; Company: Text[30]; Scope: Option System,Tenant; AppId: Guid)`: Adds a permission set to a security group.
- `RemovePermissionSet(GroupCode: Code[20]; RoleId: Code[20]; Company: Text[30]; Scope: Option System,Tenant; AppId: Guid): Boolean`: Removes a permission set from a security group.
- `GetGroups(var SecurityGroupBuffer: Record "Security Group Buffer")`: Gets all the defined security groups.
- `GetGroups(var SecurityGroupBuffer: Record "Security Group Buffer"; FetchGroupNames: Boolean)`: Gets all the defined security groups.
- `GetMembers(var SecurityGroupMemberBuffer: Record "Security Group Member Buffer"): List of [Code[20]]`: Gets all the security group memberships.
- `ValidateGroupId(GroupId: Text)`: Validates the group ID that can be used for a security group.
- `GetGroupUserSecurityId(GroupCode: Code[20]): Guid`: Gets the user security ID of a special user record that corresponds to a Microsoft Entra security group or Windows group.
- `GetName(GroupCode: Code[20]; var GroupName: Text[250]): Boolean`: Gets the name of the security group.
- `GetId(GroupCode: Code[20]): Text[250]`: Gets the SID of a Windows group or an object ID of a Microsoft Entra security group by group code.
- `GetCode(GroupId: Text[250]; var GroupCode: Code[20]): Boolean`: Gets the code of the security group by its ID.
- `GetIdByName(GroupName: Text): Text` (internal): Gets the SID of a Windows group or an object ID of a Microsoft Entra security group by group name.
- `SendNotificationForDeletedGroups(var SecurityGroupBuffer: Record "Security Group Buffer")` (internal): Shows the notification listing deleted Windows / Microsoft Entra groups.
- `IsWindowsAuthentication(): Boolean`: Checks whether the current authentication type is Windows, meaning that Windows groups will be used for defining security groups.
- `Export(SecurityGroupCodes: List of [Code[20]]; Destination: OutStream)`: Exports the provided list of security groups.
- `Import(Source: InStream)`: Imports a list of security groups.

## Calls

From the extracted call graph of BC29 (graphify-al on the snapshot checkout): calls whose target is known from a declared type or an `Object::"Name"` argument. Interface dispatch and calls through events are not counted, so the list is not complete.

- [Codeunit 9871 "Security Group Impl."](../codeunit/9871.md) (18 calls: `AddPermissionSet → AddPermissionSet`, `Copy → Copy`, `CopyPermissions → CopyPermissions`, …)

## Called by

- [Codeunit 9852 "Effective Permissions Mgt."](../codeunit/9852.md) (5 calls: `GetAccessControlFilterForUser → GetGroupUserSecurityId`, `GetAccessControlFilterForUser → GetMembers`, `MarkUsersWithAssignedPermissionSet → GetGroups`, …)
- [Codeunit 9874 "User Security Groups PBT"](../codeunit/9874.md) (3 calls: `GetSecurityGroupMemberBuffer → GetCode`, `IsAnySecurityGroupPresent → GetGroups`, `IsFetchingGroupsPerUserAvailable → IsWindowsAuthentication`)
- [Page 9871 "Security Groups"](../page/9871.md) (3 calls: `OnOpenPage → IsWindowsAuthentication`, `OnOpenPage → SendNotificationForDeletedGroups`, `RefreshData → GetGroups`)
- [Page 9872 "New Security Group"](../page/9872.md) (3 calls: `OnOpenPage → IsWindowsAuthentication`, `ValidateGroupName → GetIdByName`, `ValidateGroupName → ValidateGroupId`)
- [Page 9873 "Copy Security Group"](../page/9873.md) (3 calls: `OnOpenPage → IsWindowsAuthentication`, `ValidateGroupName → GetIdByName`, `ValidateGroupName → ValidateGroupId`)
- [Page 30082 "APIV2 - Aut. Security Groups"](../page/30082.md) (2 calls: `LoadRecords → GetGroups`, `OnDeleteRecord → Delete`)
- [Page 9883 "Permissions Overview"](../page/9883.md) (2 calls: `LoadPermAssignmentBuffer → GetGroups`, `LoadPermAssignmentBuffer → GetMembers`)
- [Page 30081 "APIV2 - Aut. Sec. Gr. Members"](../page/30081.md) (1 call: `LoadRecords → GetMembers`)
- [Page 9821 "Inherited Permission Sets Part"](../page/9821.md) (1 call: `Refresh → GetMembers`)
- [Page 9848 "User Security Groups Part"](../page/9848.md) (1 call: `OnOpenPage → GetMembers`)
- [Page 9866 "Security Group Members Part"](../page/9866.md) (1 call: `Refresh → GetMembers`)
- [Page 9869 "Security Group Members"](../page/9869.md) (1 call: `OnOpenPage → GetMembers`)
- [Page 9874 "Permission Set By Sec. Group"](../page/9874.md) (1 call: `OnOpenPage → GetGroups`)
- [Table 30432 "User Permissions Buffer"](../table/30432.md) (1 call: `FillBuffer → GetMembers`)

## Across versions

- Present in: BC23-30
- Changed (declaration) in: BC24

Source: AL metadata extracted from the code (names, ids, signatures, properties); no code bodies (D10).

## Ask your agent

Procedure bodies are not stored here (D10). The call sections above are our own, per object, from the BC29 call graph. For a procedure body or the calls of one procedure, ask bc-code-atlas (external, by Stefan Maron, MIT; default corpus w1-28), which the bc-observatory plugin connects: `bcatlas_resolve_node(object_type: "codeunit", object_name: "Security Group")`, then `bcatlas_get_procedure_body` or `bcatlas_get_neighbors` on the returned id.