Security
Security best practices for Business Central development: the layered security model (authentication, authorization, encryption, auditing, change logging) and how to use Azure Key Vault to store secrets for extensions that call external web services. Answers questions on protecting online and on-premises installations and handling secrets.
Path: Development > Rules, guidelines, and best practices > Best practices > Security · tier official · system development · narrative reviewed (checked by Opus)
Overview
This section has two pages that cover security from complementary angles. The layered security model page describes the overall approach: how users sign in, how permissions are administered, how data is encrypted, and how auditing and change logs help monitor sensitive fields. It also touches on secure development practices and applies to online and on-premises deployments.
The Azure Key Vault page is a focused, practical guide for extension developers. It explains how to keep secrets out of code when an extension calls external web services, how to set up key vaults, and how to configure the Business Central service to access them in online and on-premises setups.
Start with the layered security model page for the big picture, then move to the Azure Key Vault page when you need to handle secrets in an extension.
Key points
- The layered security model covers authentication, authorization, data encryption, auditing, and change logging.
- Authentication topics include user sign-in methods such as multifactor authentication.
- Permission administration and sensitive field monitoring through the change log and audit trails are part of the model.
- Azure Key Vault stores secrets for extensions that call external web services.
- Key vault setup covers an app key vault, support for multiple key vaults, and access control.
- Key vault configuration differs between online and on-premises deployments, as the Business Central service must be set up to access the vault.
- Telemetry monitoring and publisher validation are listed as features of the key vault integration.
Learn pages
- Azure Key Vaults with Business Central: Provides an overview of Azure key vaults with Business Central extensions.
- Layered security model in Business Central: Helps you understand and improve the security of your Business Central application regardless of where it’s hosted.
Videos, posts and code changes
Linked by a Haiku matcher with a grounding quote from the item’s summary (link/topics.ts); machine-generated.
- #10346 Fix activity log indirect permissions (code change): “All activity writes remain code-mediated through Expense Activity Log Mgt”
- #8556 [Quality Management] Enforce rules and restrictions with indirect and implicit permissions (code change): “Quality Management uses InherentPermissions so that, when”
- #157 18 more AL/BC patterns: data-modeling, testing, style, security, error-handling, ui, upgrade, web-services, appsource (code change): “Security, error handling, UI, upgrade, web services and AppSource guidance on permission sets”
- #187 Code reviewer skill for recognizing and validating unauthenticated responses (code change): “Helps enforce security best practices in extension code”
- #49 Promote security knowledge from community to Microsoft layer (code change): “Best practice guidance improved for temporary table data protection”
- #99 Add lifecycle error and privacy knowledge (code change): “ErrorInfo privacy exposure, and FeatureTelemetry logging, plus related review skills”
- Dynamics 365 Business Central: new strict URI validation in AL Http Client (community post): “Business Central v28 introduces stricter URI validation in AL HttpClient to prevent Server-Side Request Forgery”
Source: Microsoft Learn (CC BY 4.0). Descriptions are Learn’s own.