Security

Path: Security, privacy, and compliance > Security · tier official · system none · narrative reviewed (checked by Opus)

Overview

This section explains how Business Central is secured, mainly for online (cloud) tenants. It covers authentication, access control, data protection, encryption, Privileged Identity Management, and auditing. Specific pages cover multifactor authentication through Microsoft Entra ID, Azure service tags for network filtering, and security filters for record-level access.

Guidance is split by audience. The persona guide gives recommendations to partners, administrators, developers, and auditors. The business user tips page covers separation of duties, approval workflows, and shared devices. The FAQ answers questions on data isolation, penetration testing, cipher suites, and incident management.

Two subtopics go deeper. Application security covers the layered security model, users and licenses, and permission sets. On-premises security covers authentication, server hardening, certificates, and database encryption. Start with “Security in Business Central” for the overall picture, then move to the page that fits your role or deployment.

Key points

• The online security overview covers Conditional Access, data isolation, Transparent Data Encryption, customer-managed encryption keys, and Customer Lockbox.
• MFA through Microsoft Entra ID supports phone calls, text messages, mobile app notifications, and one-time passwords, with conditional access policies.
• The Dynamics365BusinessCentral Azure service tag lets you control firewall and network security group rules for traffic to Business Central.
• Security filters limit table data at record level and are created through permission sets. The SecurityFiltering property sets filtered, validated, ignored, or disallowed behavior.
• The persona guide covers Privileged Identity Management, GDAP group-based access, Federated Identity Credentials, certificate-based authentication, and Azure Key Vault.
• Business user tips cover separation of duties, approval workflows, out-of-band verification, kiosk sign-out, and private browsing.
• The security FAQ covers data isolation, penetration testing, RSA-CBC cipher support, and security incident management.
• Subtopics cover application security (users, licenses, AL permission sets) and on-premises security (SSL/HTTPS, X.509 certificates, TDE, BitLocker, SQL Server permissions).

Subtopics

• Application security (3 pages)
• On-premises (6 pages)

More Learn pages

• Multifactor authentication (MFA) for Business Central: This article explains how to add multifactor authentication (MFA) when your solution uses Microsoft Entra ID as authentication mechanism.
• Security FAQ for Business Central: Find useful links and other answers to frequently asked questions about security in Dynamics 365 Business Central.
• Security in Business Central: Learn about the main aspects of security in your online deployment of Dynamics 365 Business Central.
• Security scenarios Guide by Persona: Practical security scenarios and best practices for partners, administrators, auditors, and developers working with Dynamics 365 Business Central.
• Security Tips for Business Users: Learn essential security tips for business users to protect devices and data in Business Central. Discover best practices for safe browsing, MFA, and more.
• Use Azure security service tags: List of Azure service tags for Dynamics 365 Business Central
• Using Security Filters: Learn how you can configure security filters at different levels in your Business Central solution so that you can limit access to data.

Business Central pages and reports

The pages, reports and queries this hub’s Learn pages name (ms.search.form, API reference), joined to the code by exact object id (data/index/docs-objects.json); a page shows the table it runs on.

• Page 119 “User Setup” · on Table 91 “User Setup” · via Application security
• Page 774 “User Details” · captioned “Users” · on Table 774 “User Details” · via Application security
• Page 6300 “Azure AD App Setup Wizard” · captioned “Set Up Microsoft Entra ID” · via Application security
• Page 6301 “Azure AD App Setup Part” · captioned “” · on Table 6300 “Azure AD App Setup” · via Application security
• Page 6302 “Azure AD Access Dialog” · captioned “Microsoft Entra service permissions” · via Application security
• Page 8930 “Email View Policy List” · captioned “User Email View Policies” · on Table 8930 “Email View Policy” · via Application security
• Page 9061 “Plan Configuration List” · captioned “License Configuration” · on Table 9017 “Plan Configuration” · via Application security
• Page 9062 “User Security Activities” · on Table 9062 “User Security Status” · via Application security
• Page 9069 “Plan Configuration Card” · captioned “License Configuration” · on Table 9017 “Plan Configuration” · via Application security
• Page 9800 “Users” · via Application security
• Page 9807 “User Card” · via Application security
• Page 9808 “User Permission Sets” · via Application security
• Page 9816 “Permission Set by User” · via Application security
• Page 9818 “User Security Status List” · captioned “User Security Status” · on Table 9062 “User Security Status” · via Application security
• Page 9874 “Permission Set By Sec. Group” · captioned “Permission Set by Security Group” · via Application security

Learn also names 4 objects with no object page: page/9173, page/9830, page/9831, page/9838.

Source: Microsoft Learn (CC BY 4.0). Descriptions are Learn’s own.