Dynamics 365 Business Central – Why when I create new users do they get full access by default
New users in Business Central automatically receive full access to their first company based on their assigned license. Administrators can prevent this by modifying permission sets in the License Configuration page.
"Now when I create a new user that's been assigned this licence they won't have full access."
Key points
- New users get default permissions from their security groups and from the licence they are assigned
- By default a licence such as Business Central Essential grants full access to the first company a user logs into
- In the Licence Configuration page, edit the licence, turn on Customise Permissions and delete permission sets such as D365 BUS FULL ACCESS
- Partner access can be controlled the same way by editing the Delegated Admin agent - Partner licence
Quotes
- “Now when I create a new user that’s been assigned this licence they won’t have full access.” (Demonstrates the practical outcome of modifying license configuration to enforce principle of least privilege)
AL objects mentioned
As named in the post. A name that matches one object page by exact type and name links to it; the others stay as named.
- page “Licence Configuration”
Not found in BC28-30: page “Licence Configuration”.
Context
- Features: License Configuration, Permission Set Management, Default User Permissions, User Access Control
Source: The Dynamics Explorer, community blog. Summary, key points and quotes are derived (CONTENT-NOTICE.md); read the original for the full text.