---
id: object/codeunit/9852
type: object
title: Codeunit 9852 "Effective Permissions Mgt."
summary: Codeunit 9852 "Effective Permissions Mgt." in Base Application (System.Security.AccessControl). 17 public procedures, 1 events, 1 event subscribers. Present since at least BC23, still in BC30, changed in BC26, BC29.
tier: official
language: en
tags:
  - codeunit
  - base application
versions:
  introduced: null
  last_changed: "29"
  deprecated: null
review:
  state: derived
  by: null
  at: null
  flags: []
generated:
  at: "2026-10-11T00:31:51.816Z"
  pipeline: 0.2.0
  prompts: {}
  input_hash: ddffdfc3a5ca2ad51ab5f8750453b4390b918b2194f76a3eb5fb5b63c14088ea
evidence:
  - kind: code
    url: https://github.com/microsoft/BCApps/blob/ea08af5ef2d6a9b5c5af4a029288abbe2c883220/src/Layers/W1/BaseApp/System/Permissions/EffectivePermissionsMgt.Codeunit.al
    title: src/Layers/W1/BaseApp/System/Permissions/EffectivePermissionsMgt.Codeunit.al (releases/29.x)
    date: null
    commit: ea08af5ef2d6a9b5c5af4a029288abbe2c883220
    t: null
    quote: null
links:
  learn: []
  objects: []
  features: []
  topics: []
  localizations: []
  videos: []
  posts: []
  guidelines: []
  changes:
    - change/bcapps/9692
    - change/bcapps/11961
object_type: codeunit
object_id: 9852
name: Effective Permissions Mgt.
namespace: System.Security.AccessControl
app: Base Application
extends: null
first_version: "23"
last_version: "30"
present_in:
  - "23"
  - "24"
  - "25"
  - "26"
  - "27"
  - "28"
  - "29"
  - "30"
changed_in:
  - "26"
  - "29"
source_major: "29"
obsolete: null
countries: []
ms_search_form_ids: []
counts:
  fields: 0
  procedures: 41
  events: 1
  subscribers: 1
relations:
  out: 0
  referenced_by: 0
  pages: 0
  extended_by: 0
  event_subscribers: 1
  calls: 7
  called_by: 6
  implements: 0
---

# Codeunit 9852 "Effective Permissions Mgt."

> Codeunit 9852 "Effective Permissions Mgt." in Base Application (System.Security.AccessControl). 17 public procedures, 1 events, 1 event subscribers. Present since at least BC23, still in BC30, changed in BC26, BC29.

Base Application · System.Security.AccessControl · BC23-30 · [source at ea08af5e](https://github.com/microsoft/BCApps/blob/ea08af5ef2d6a9b5c5af4a029288abbe2c883220/src/Layers/W1/BaseApp/System/Permissions/EffectivePermissionsMgt.Codeunit.al) · facts from BC29

## Events published

- `OnTenantPermissionModified(PermissionSetId: Code[20])` (integration)
  - subscribers: [Codeunit 1351 "Telemetry Subscribers"](../codeunit/1351.md) EffectivePermissionsChangeInPage

## Event subscriptions

- OnInitializingNotificationWithDefaultState subscribes to Page "My Notifications" OnInitializingNotificationWithDefaultState

## Procedures

- `OpenPageForUser(UserSID: Guid)`
- `DisallowViewingEffectivePermissionsForNonAdminUsers(OtherUserSecurityId: Guid)`
- `PopulatePermissionConflictsTable(PlanOrRole: Enum Licenses; RoleId: Code[20]; var PermissionConflicts: Record "Permission Conflicts" temporary)` (internal)
- `PopulatePermissionConflictsOverviewTable(var PermissionConflictsOverview: Record "Permission Conflicts Overview" temporary; PlansExist: Dictionary of [Guid, Boolean])` (internal)
- `PopulatePermissionBuffer(var PermissionBuffer: Record "Permission Buffer"; PassedUserID: Guid; PassedCompanyName: Text[50]; PassedObjectType: Integer; PassedObjectId: Integer)`
- `PopulatePermissionBufferWithEntitlementPermissionsForObject(var PermissionBuffer: Record "Permission Buffer"; PassedUserID: Guid; PassedObjectType: Option; PassedObjectId: Integer)`
- `PopulateEffectivePermissionsBuffer(var Permission: Record Permission; PassedUserID: Guid; PassedCompanyName: Text[50]; PassedObjectType: Integer; PassedObjectId: Integer; ShowAllObjects: Boolean)`
- `PopulatePermissionRecordWithEffectivePermissionsForObject(var Permission: Record Permission; PassedUserID: Guid; PassedCompanyName: Text[50]; PassedObjectType: Option; PassedObjectId: Integer)`
- `ModifyPermission(FieldNumChanged: Integer; PermissionBuffer: Record "Permission Buffer"; PassedObjectType: Integer; PassedObjectId: Integer; PassedUserID: Guid)`
- `NotificationShowUsers(Notification: Notification)`
- `NotificationUndoChange(Notification: Notification)`
- `DisableNotification(Notification: Notification)`
- `ConvertToPermission(PermissionOption: Option): enum Permission`
- `ShowPermissionConflict(Permissions: Enum Permission; EntitlementPermissions: Enum Permission; IsSourceEntitlement: Boolean)` (internal)
- `GetPermissionStatus(Permissions: Enum Permission; EntitlementPermissions: Enum Permission; IsSourceEntitlement: Boolean): Text` (internal)
- `OpenPermissionConflicts(PermissionSetID: Code[20]; PlanOrRole: Enum Licenses)` (internal)
- `HasDirectRIMPermissionsOnTableData(TableId: Integer): Boolean` (internal): Checks if the user has direct read, insert and modify permissions on the given table id.

Plus 22 local procedures.

## Triggers

OnRun

## Calls

From the extracted call graph of BC29 (graphify-al on the snapshot checkout): calls whose target is known from a declared type or an `Object::"Name"` argument. Interface dispatch and calls through events are not counted, so the list is not complete.

- [Codeunit 9027 "Plan Ids"](../codeunit/9027.md) (22 calls: `GetPlanId → GetBasicPlanId`, `GetPlanId → GetD365AdminPlanId`, `GetPlanId → GetDelegatedAdminPlanId`, …)
- [Codeunit 9031 "Security Group"](../codeunit/9031.md) (5 calls: `GetAccessControlFilterForUser → GetGroupUserSecurityId`, `GetAccessControlFilterForUser → GetMembers`, `MarkUsersWithAssignedPermissionSet → GetGroups`, …)
- [Codeunit 8615 "Config. Progress Bar"](../codeunit/8615.md) (3 calls: `PopulatePermissionConflictsOverviewTable → Close`, `PopulatePermissionConflictsOverviewTable → Init`, `PopulatePermissionConflictsOverviewTable → Update`)
- [Codeunit 152 "User Permissions"](../codeunit/152.md) (1 call: `DisallowViewingEffectivePermissionsForNonAdminUsers → CanManageUsersOnTenant`)
- [Codeunit 457 "Environment Information"](../codeunit/457.md) (1 call: `PopulatePermissionBufferWithEntitlementPermissionsForObject → IsSaaS`)
- [Codeunit 9002 "Permission Manager"](../codeunit/9002.md) (1 call: `IsPermissionRestrictedByLicense → IsFirstPermissionHigherThanSecond`)
- [Page 9800 "Users"](../page/9800.md) (1 call: `NotificationShowUsers → (object)`)

## Called by

- [Page 9852 "Effective Permissions"](../page/9852.md) (3 calls: `FillByObject → PopulateEffectivePermissionsBuffer`, `OnAfterGetCurrRecord → PopulatePermissionRecordWithEffectivePermissionsForObject`, `OnOpenPage → DisallowViewingEffectivePermissionsForNonAdminUsers`)
- [Page 9853 "Effective Permissions By Set"](../page/9853.md) (3 calls: `RefreshDisplayTexts → ConvertToPermission`, `RefreshDisplayTexts → GetPermissionStatus`, `SetRecordAndRefresh → PopulatePermissionBuffer`)
- [Page 5557 "Permission Conflicts"](../page/5557.md) (2 calls: `OnOpenPage → PopulatePermissionConflictsTable`, `RefreshDisplayTexts → GetPermissionStatus`)
- [Codeunit 1392 "Monitor Sensitive Field"](../codeunit/1392.md) (1 call: `CheckPermission → PopulatePermissionRecordWithEffectivePermissionsForObject`)
- [Codeunit 8616 "Config. Management"](../codeunit/8616.md) (1 call: `InsertTempInt → HasDirectRIMPermissionsOnTableData`)
- [Page 5555 "Permission Conflicts Overview"](../page/5555.md) (1 call: `OnOpenPage → PopulatePermissionConflictsOverviewTable`)

## Recent changes

- 2026-09-30 [#9692 Fix effective permission filtering](../../changes/bcapps/9692.md) (main, BC30, fix)
- 2026-09-29 [#11961 Cache security group resolution in Effective Permissions](../../changes/bcapps/11961.md) (main, BC30, performance)

## Across versions

- Present in: BC23-30
- Changed (declaration) in: BC26, BC29

Source: AL metadata extracted from the code (names, ids, signatures, properties); no code bodies (D10).

## Ask your agent

Procedure bodies are not stored here (D10). The call sections above are our own, per object, from the BC29 call graph. For a procedure body or the calls of one procedure, ask bc-code-atlas (external, by Stefan Maron, MIT; default corpus w1-28), which the bc-observatory plugin connects: `bcatlas_resolve_node(object_type: "codeunit", object_name: "Effective Permissions Mgt.")`, then `bcatlas_get_procedure_body` or `bcatlas_get_neighbors` on the returned id.