Codeunit 9852 "Effective Permissions Mgt."

Base Application · System.Security.AccessControl · BC23-30 · source at ea08af5e · facts from BC29

Events published

• OnTenantPermissionModified(PermissionSetId: Code[20]) (integration)
  • subscribers: Codeunit 1351 “Telemetry Subscribers” EffectivePermissionsChangeInPage

Event subscriptions

• OnInitializingNotificationWithDefaultState subscribes to Page “My Notifications” OnInitializingNotificationWithDefaultState

Procedures

• OpenPageForUser(UserSID: Guid)
• DisallowViewingEffectivePermissionsForNonAdminUsers(OtherUserSecurityId: Guid)
• PopulatePermissionConflictsTable(PlanOrRole: Enum Licenses; RoleId: Code[20]; var PermissionConflicts: Record "Permission Conflicts" temporary) (internal)
• PopulatePermissionConflictsOverviewTable(var PermissionConflictsOverview: Record "Permission Conflicts Overview" temporary; PlansExist: Dictionary of [Guid, Boolean]) (internal)
• PopulatePermissionBuffer(var PermissionBuffer: Record "Permission Buffer"; PassedUserID: Guid; PassedCompanyName: Text[50]; PassedObjectType: Integer; PassedObjectId: Integer)
• PopulatePermissionBufferWithEntitlementPermissionsForObject(var PermissionBuffer: Record "Permission Buffer"; PassedUserID: Guid; PassedObjectType: Option; PassedObjectId: Integer) + BC26
• PopulateEffectivePermissionsBuffer(var Permission: Record Permission; PassedUserID: Guid; PassedCompanyName: Text[50]; PassedObjectType: Integer; PassedObjectId: Integer; ShowAllObjects: Boolean)
• PopulatePermissionRecordWithEffectivePermissionsForObject(var Permission: Record Permission; PassedUserID: Guid; PassedCompanyName: Text[50]; PassedObjectType: Option; PassedObjectId: Integer)
• ModifyPermission(FieldNumChanged: Integer; PermissionBuffer: Record "Permission Buffer"; PassedObjectType: Integer; PassedObjectId: Integer; PassedUserID: Guid)
• NotificationShowUsers(Notification: Notification)
• NotificationUndoChange(Notification: Notification)
• DisableNotification(Notification: Notification)
• ConvertToPermission(PermissionOption: Option): enum Permission
• ShowPermissionConflict(Permissions: Enum Permission; EntitlementPermissions: Enum Permission; IsSourceEntitlement: Boolean) (internal)
• GetPermissionStatus(Permissions: Enum Permission; EntitlementPermissions: Enum Permission; IsSourceEntitlement: Boolean): Text (internal)
• OpenPermissionConflicts(PermissionSetID: Code[20]; PlanOrRole: Enum Licenses) (internal)
• HasDirectRIMPermissionsOnTableData(TableId: Integer): Boolean (internal): Checks if the user has direct read, insert and modify permissions on the given table id.

Plus 22 local procedures.

Triggers

OnRun

Calls

From the extracted call graph of BC29 (graphify-al on the snapshot checkout): calls whose target is known from a declared type or an Object::"Name" argument. Interface dispatch and calls through events are not counted, so the list is not complete.

• Codeunit 9027 “Plan Ids” (22 calls: GetPlanId → GetBasicPlanId, GetPlanId → GetD365AdminPlanId, GetPlanId → GetDelegatedAdminPlanId, …)
• Codeunit 9031 “Security Group” (5 calls: GetAccessControlFilterForUser → GetGroupUserSecurityId, GetAccessControlFilterForUser → GetMembers, MarkUsersWithAssignedPermissionSet → GetGroups, …)
• Codeunit 8615 “Config. Progress Bar” (3 calls: PopulatePermissionConflictsOverviewTable → Close, PopulatePermissionConflictsOverviewTable → Init, PopulatePermissionConflictsOverviewTable → Update)
• Codeunit 152 “User Permissions” (1 call: DisallowViewingEffectivePermissionsForNonAdminUsers → CanManageUsersOnTenant)
• Codeunit 457 “Environment Information” (1 call: PopulatePermissionBufferWithEntitlementPermissionsForObject → IsSaaS)
• Codeunit 9002 “Permission Manager” (1 call: IsPermissionRestrictedByLicense → IsFirstPermissionHigherThanSecond)
• Page 9800 “Users” (1 call: NotificationShowUsers → (object))

Called by

• Page 9852 “Effective Permissions” (3 calls: FillByObject → PopulateEffectivePermissionsBuffer, OnAfterGetCurrRecord → PopulatePermissionRecordWithEffectivePermissionsForObject, OnOpenPage → DisallowViewingEffectivePermissionsForNonAdminUsers)
• Page 9853 “Effective Permissions By Set” (3 calls: RefreshDisplayTexts → ConvertToPermission, RefreshDisplayTexts → GetPermissionStatus, SetRecordAndRefresh → PopulatePermissionBuffer)
• Page 5557 “Permission Conflicts” (2 calls: OnOpenPage → PopulatePermissionConflictsTable, RefreshDisplayTexts → GetPermissionStatus)
• Codeunit 1392 “Monitor Sensitive Field” (1 call: CheckPermission → PopulatePermissionRecordWithEffectivePermissionsForObject)
• Codeunit 8616 “Config. Management” (1 call: InsertTempInt → HasDirectRIMPermissionsOnTableData)
• Page 5555 “Permission Conflicts Overview” (1 call: OnOpenPage → PopulatePermissionConflictsOverviewTable)

Recent changes

• 2026-09-30 #9692 Fix effective permission filtering (main, BC30, fix)
• 2026-09-29 #11961 Cache security group resolution in Effective Permissions (main, BC30, performance)

Ask your agent

Procedure bodies are not stored here (D10). The call sections above are our own, per object, from the BC29 call graph. For a procedure body or the calls of one procedure, ask bc-code-atlas (external, by Stefan Maron, MIT; default corpus w1-28), which the bc-observatory plugin connects: bcatlas_resolve_node(object_type: "codeunit", object_name: "Effective Permissions Mgt."), then bcatlas_get_procedure_body or bcatlas_get_neighbors on the returned id.