Manage access to Business Central

Path: Development and administration > Administration tasks in Business Central > Manage access to Business Central · tier official · system administration · narrative reviewed (checked by Opus)

Overview

This section describes a layered approach to controlling who can use Business Central. The layers are licenses (Dynamics 365 Business Central and Microsoft 365), user accounts, environment access, permissions, and security groups. Multi-Factor Authentication and Azure service tags are also named among the topics.

The main page, Manage Access to Business Central, gives the overview and is the best place to start. From there, Control Access Using Security Groups explains how to apply permissions to all members of a group, with Microsoft Entra ID or Windows Active Directory, online or on-premises.

Two subtopics go deeper. Grant user permissions covers creating users by license type, assigning permission sets, and defining granular permission sets with record-level security filters. Access with Microsoft 365 licenses covers read-only access to Business Central data through Microsoft Teams.

Key points

• Access control has layers: licenses, user accounts, environment access, permissions, and security groups.
• Security groups apply permissions to all members and support Microsoft Entra ID and Windows Active Directory, online and on-premises.
• Security groups can carry company-specific permissions and give access to multiple companies; group membership is managed in the groups.
• The security groups page lists versions 25.11, 26.5 and 27.4.
• Users are created according to license type and given permission sets, with license assignment, user groups and delegated admin also covered.
• Granular permission sets define read, insert, modify, delete and execute access, plus indirect permissions and security filters for record-level security.
• Permissions can be imported and exported.
• Microsoft 365 license holders get read-only access to Business Central data through Teams; the subtopic covers setup, authentication, provisioning and licensing questions.

Subtopics

• Access with Microsoft 365 licenses (4 pages)
• Grant user permissions (2 pages)

More Learn pages

• Control Access Using Security Groups: This article describes how to use security groups to define user permissions.
• Manage Access to Business Central: Administrators use a layered approach to controlling access to Business Central and its capabilities.

Videos, posts and code changes

Linked by a Haiku matcher with a grounding quote from the item’s summary (link/topics.ts); machine-generated.

• #11989 [Bug 500351] Allow Effective Permissions for delegated admins and helpdesk (code change): “Effective Permissions page now works for delegated admins and helpdesk”
• BC Friday Tips #31 Block Users using Security Group (community post): “Environment-level security groups in Azure AD restrict access to Business Central”

Business Central pages and reports

The pages, reports and queries this hub’s Learn pages name (ms.search.form, API reference), joined to the code by exact object id (data/index/docs-objects.json); a page shows the table it runs on.

• Page 1 “Company Information” · on Table 79 “Company Information”
• Page 119 “User Setup” · on Table 91 “User Setup”
• Page 8930 “Email View Policy List” · captioned “User Email View Policies” · on Table 8930 “Email View Policy”
• Page 9800 “Users”
• Page 9802 “Permission Sets” · on Table 9009 “Permission Set Buffer”
• Page 9807 “User Card”
• Page 9808 “User Permission Sets”
• Page 9855 “Permission Set” · on Table 9862 “PermissionSet Buffer”
• Page 9862 “Expanded Permissions”
• Page 9868 “Security Group Permission Sets”
• Page 9869 “Security Group Members” · on Table 9021 “Security Group Member Buffer”
• Page 9871 “Security Groups” · on Table 9022 “Security Group Buffer”
• Page 9872 “New Security Group”
• Page 9873 “Copy Security Group”
• Page 9874 “Permission Set By Sec. Group” · captioned “Permission Set by Security Group”
• Page 9875 “Permission Set Assignments”
• Page 9877 “Security Group Lookup” · captioned “Available Security Groups” · on Table 9022 “Security Group Buffer”
• Page 774 “User Details” · captioned “Users” · on Table 774 “User Details” · via Grant user permissions
• Page 1978 “MS 365 License Setup Wizard” · captioned “Set up access with Microsoft 365 licenses” · via Access with Microsoft 365 licenses
• Page 6300 “Azure AD App Setup Wizard” · captioned “Set Up Microsoft Entra ID” · via Grant user permissions
• Page 6301 “Azure AD App Setup Part” · captioned “” · on Table 6300 “Azure AD App Setup” · via Grant user permissions
• Page 6302 “Azure AD Access Dialog” · captioned “Microsoft Entra service permissions” · via Grant user permissions
• Page 9061 “Plan Configuration List” · captioned “License Configuration” · on Table 9017 “Plan Configuration” · via Access with Microsoft 365 licenses
• Page 9062 “User Security Activities” · on Table 9062 “User Security Status” · via Grant user permissions
• Page 9069 “Plan Configuration Card” · captioned “License Configuration” · on Table 9017 “Plan Configuration” · via Grant user permissions
• Page 9816 “Permission Set by User” · via Grant user permissions
• Page 9818 “User Security Status List” · captioned “User Security Status” · on Table 9062 “User Security Status” · via Grant user permissions
• Page 9865 “Permission Lookup List” · on Table 9865 “Permission Lookup Buffer” · via Grant user permissions
• Page 9878 “Permission Set Lookup List” · captioned “Permission Set Lookup” · on Table 9862 “PermissionSet Buffer” · via Grant user permissions
• Page 9883 “Permissions Overview” · via Grant user permissions

Learn also names 4 objects with no object page: page/9173, page/9830, page/9831, page/9838.

Source: Microsoft Learn (CC BY 4.0). Descriptions are Learn’s own.