Application security

Path: Security, privacy, and compliance > Security > Application security · tier official · system none · narrative reviewed (checked by Opus)

Overview

This section explains how Business Central protects an installation and how administrators control who can do what. It applies to both online and on-premises deployments. The layered security model page gives the big picture: authentication, authorization, data encryption, auditing, and change logging.

The other two pages go into detail on access. “Create users according to licenses” covers creating users, assigning permission sets, managing licenses, and using security groups, user groups, and delegated admin. “Permissions on Objects” covers how read, insert, modify, delete, and execute permissions are given to tables, pages, reports, and other objects through AL permission sets.

Start with the layered security model for context. Then use the user and license page for administration tasks, and the object permissions page when you build or review permission sets.

Key points

• The layered security model covers authentication, authorization, data encryption, auditing, and change logging.
• Sign-in protection includes multifactor authentication; monitoring includes sensitive field monitoring, change log, and audit trails.
• Administrators create users, assign permission sets, and manage licenses, with permissions that depend on license type.
• User creation guidance covers security groups, user groups, and delegated admin, for online and on-premises.
• Object permissions are read, insert, modify, delete, and execute, applied to tables, pages, reports, and other objects.
• Permissions can be direct or indirect, and the page explains permission abbreviations and wildcard permissions.
• Permission sets are defined in AL.

Learn pages

• Create users according to licenses: Describes how to add users to Business Central online or on-premises based on licenses.
• Layered security model in Business Central: Helps you understand and improve the security of your Business Central application regardless of where it’s hosted.
• Permissions on Objects: This article provides an overview of permissions on objects in Business Central.

Business Central pages and reports

The pages, reports and queries this hub’s Learn pages name (ms.search.form, API reference), joined to the code by exact object id (data/index/docs-objects.json); a page shows the table it runs on.

• Page 119 “User Setup” · on Table 91 “User Setup”
• Page 774 “User Details” · captioned “Users” · on Table 774 “User Details”
• Page 6300 “Azure AD App Setup Wizard” · captioned “Set Up Microsoft Entra ID”
• Page 6301 “Azure AD App Setup Part” · captioned “” · on Table 6300 “Azure AD App Setup”
• Page 6302 “Azure AD Access Dialog” · captioned “Microsoft Entra service permissions”
• Page 8930 “Email View Policy List” · captioned “User Email View Policies” · on Table 8930 “Email View Policy”
• Page 9061 “Plan Configuration List” · captioned “License Configuration” · on Table 9017 “Plan Configuration”
• Page 9062 “User Security Activities” · on Table 9062 “User Security Status”
• Page 9069 “Plan Configuration Card” · captioned “License Configuration” · on Table 9017 “Plan Configuration”
• Page 9800 “Users”
• Page 9807 “User Card”
• Page 9808 “User Permission Sets”
• Page 9816 “Permission Set by User”
• Page 9818 “User Security Status List” · captioned “User Security Status” · on Table 9062 “User Security Status”
• Page 9874 “Permission Set By Sec. Group” · captioned “Permission Set by Security Group”

Learn also names 4 objects with no object page: page/9173, page/9830, page/9831, page/9838.

Source: Microsoft Learn (CC BY 4.0). Descriptions are Learn’s own.