Permission sets and entitlements overview

Path: Development > Programming in the AL language > Handling security > Permission sets and entitlements overview · tier official · system administration · narrative reviewed (checked by Opus)

Overview

This area explains how access is controlled in Business Central from the AL developer side. Entitlements define what a customer’s license or Microsoft Entra role allows. Permissions are assigned by administrators, and permission sets group them logically. The overview page “Entitlements and permission sets overview” explains these differences and covers upgrade considerations from versions before 18.0.

The authoring pages cover the Permission set object, the Permission Set Extension object, composing sets from other sets, permissions on objects, inherent permissions, and the Entitlement object. Two further pages cover exporting permission sets to XML and upgrading from legacy data-based permissions to AL object-based permissions.

Three telemetry pages cover auditing and troubleshooting: permission changes, permission errors, and permission dependency cycles. Start with the overview page, then read the Permission set object and Permissions on Objects pages. Use the telemetry pages when diagnosing problems.

Key points

• Entitlements give license-based access, permissions are assigned by administrators, and permission sets are logical groups of permissions.
• Permission set objects use the Assignable, Permissions, IncludedPermissionSets and ExcludedPermissionSets properties. Sets can be composed hierarchically, and some can be nonassignable.
• Permission set extension objects add permissions to existing sets, and the permissions are applied automatically when the extension is installed.
• Permissions on objects cover read, insert, modify, delete and execute, with direct and indirect permissions, abbreviations and wildcards.
• The inherentpermissions attribute gives specific AL methods or events temporary elevated permissions without changing user permission sets.
• Entitlement objects (2023 release wave 2) support role-based, per-user plan, unlicensed, Microsoft Entra group and application scope entitlements, and support Marketplace app monetization.
• Permission sets can be exported to XML and packaged into extensions. Visual Studio Code can generate permission set XML with default permissions for extension objects.
• Upgrading from legacy data-based permissions to AL object-based permissions involves identifying customizations and creating new Permission Set and Permission Set Extension objects (versions 18 and 19).

Learn pages

• (automation API) Get permissionSet: Gets a permission set object in Dynamics 365 Business Central.
• Analyzing Permission Changes Trace Telemetry: Learn about the telemetry for permission changes made in Business Central
• Analyzing permission dependency cycle trace telemetry: Learn about the permission dependency cycle trace telemetry in Business Central
• Analyzing Permission Error Trace Telemetry: Learn about the permission error telemetry in Business Central
• Composing Permission Sets from Other Permission Sets: Learn how to create a permission set from one or more existing permission sets in AL code for Business Central.
• Entitlement object: Discover how to define and use entitlement objects in AL for Business Central.
• Entitlements and permission sets overview: Learn about the different built-in methods to control which users can do what so that you can design the Business Central permission sets more precisely.
• Export Permission Sets to XML: Learn more about exporting permission sets to XML in Business Central.
• Inherent Permissions: Description of how inherent permissions work and the InherentPermissions attribute in AL for Business Central.
• Permission Set Extension Object: Description of the permission set extension object in AL for Business Central.
• Permission set object: Describes the permission set object, which sets permissions on objects in AL for Business Central.
• Permissions on Objects: This article provides an overview of permissions on objects in Business Central.
• permissionSet resource type: A permission set object in Dynamics 365 Business Central.
• Upgrading Permission Sets and Permissions: Describes how to upgrade permissions and permission sets

Videos, posts and code changes

Linked by a Haiku matcher with a grounding quote from the item’s summary (link/topics.ts); machine-generated.

• #10449 Remove permission set ref and move the Page Inspector changes to BCApps (code change): “Removes references to the soon-to-be-obsoleted table”
• #12255 Fix overwrite import of exported system permission sets (code change): “System permission set imports with overwrite option now correctly”
• #8947 [Permissions] Add Where-Used and Permissions Overview navigation actions (code change): “Permission Sets list gains Where-Used and Permissions Overview actions”
• #9599 Add event subscriber for OpenPermissionSetPage (code change): “A new event subscriber codeunit enables programmatic opening of the permission set”
• Step-by-Step Guide to Secure Business Central Agent Implementations in AL (community post): “permission sets and profiles limit which pages and fields the agent can see”

Source: Microsoft Learn (CC BY 4.0). Descriptions are Learn’s own.