---
id: video/YbuO1n_Lqj0
type: video
title: "What's New: Enhanced IT Audit Reporting (2026 release wave 1)"
summary: "Business Central 2026 release wave 1 audit and internal-control reporting additions: Permission Overview page, approval overview pages, analysis tabs on change log and users list, and read-only APIs for permissions, workflows and approval entries. Most items are described as coming in 28.x, not the April release."
tier: official
language: en
tags:
  - audit reporting
  - permissions
  - approvals
  - user management
  - analysis mode
  - apis
  - security groups
  - change log
  - workflow
  - internal controls
  - security guide
  - api documentation
system: administration
review:
  state: reviewed
  by: opus
  at: "2026-10-07T22:50:53.502Z"
  flags: []
generated:
  at: "2026-10-07T22:50:53.570Z"
  pipeline: 0.2.0
  prompts:
    extract-video: 1
    summarize-video: 2
  input_hash: 07f73d628c02710e909c02434d14de984d1feca68bb38ff2f9260371195480cc
evidence:
  - kind: video
    url: https://www.youtube.com/watch?v=YbuO1n_Lqj0&t=523s
    title: "Users list last login date and inactive days: announced"
    date: "2026-04-01T12:00:27.000Z"
    commit: null
    t: 523
    quote: This is also coming in 28.x. So you just wait to to have to wait uh one or two months to get this.
  - kind: video
    url: https://www.youtube.com/watch?v=YbuO1n_Lqj0&t=523s
    title: "Users list fact box enhancements: announced"
    date: "2026-04-01T12:00:27.000Z"
    commit: null
    t: 523
    quote: This is also coming in 28.x. So you just wait to to have to wait uh one or two months to get this.
  - kind: video
    url: https://www.youtube.com/watch?v=YbuO1n_Lqj0&t=523s
    title: "User Detail View improvements: announced"
    date: "2026-04-01T12:00:27.000Z"
    commit: null
    t: 523
    quote: This is also coming in 28.x. So you just wait to to have to wait uh one or two months to get this.
  - kind: video
    url: https://www.youtube.com/watch?v=YbuO1n_Lqj0&t=883s
    title: "Permission Sets API: announced"
    date: "2026-04-01T12:00:27.000Z"
    commit: null
    t: 883
    quote: similarly also in 28.x X the permission APIs are also coming in 28.x Same thing for approval APIs
  - kind: video
    url: https://www.youtube.com/watch?v=YbuO1n_Lqj0&t=883s
    title: "Expanded Permission Sets API: announced"
    date: "2026-04-01T12:00:27.000Z"
    commit: null
    t: 883
    quote: similarly also in 28.x X the permission APIs are also coming in 28.x Same thing for approval APIs
  - kind: video
    url: https://www.youtube.com/watch?v=YbuO1n_Lqj0&t=883s
    title: "Security Groups API: announced"
    date: "2026-04-01T12:00:27.000Z"
    commit: null
    t: 883
    quote: similarly also in 28.x X the permission APIs are also coming in 28.x Same thing for approval APIs
  - kind: video
    url: https://www.youtube.com/watch?v=YbuO1n_Lqj0&t=883s
    title: "User Permission API: announced"
    date: "2026-04-01T12:00:27.000Z"
    commit: null
    t: 883
    quote: similarly also in 28.x X the permission APIs are also coming in 28.x Same thing for approval APIs
  - kind: video
    url: https://www.youtube.com/watch?v=YbuO1n_Lqj0&t=883s
    title: "Access Control API: announced"
    date: "2026-04-01T12:00:27.000Z"
    commit: null
    t: 883
    quote: similarly also in 28.x X the permission APIs are also coming in 28.x Same thing for approval APIs
  - kind: video
    url: https://www.youtube.com/watch?v=YbuO1n_Lqj0&t=883s
    title: "Workflows API: announced"
    date: "2026-04-01T12:00:27.000Z"
    commit: null
    t: 883
    quote: similarly also in 28.x X the permission APIs are also coming in 28.x Same thing for approval APIs
  - kind: video
    url: https://www.youtube.com/watch?v=YbuO1n_Lqj0&t=883s
    title: "Workflow Steps API: announced"
    date: "2026-04-01T12:00:27.000Z"
    commit: null
    t: 883
    quote: similarly also in 28.x X the permission APIs are also coming in 28.x Same thing for approval APIs
  - kind: video
    url: https://www.youtube.com/watch?v=YbuO1n_Lqj0&t=883s
    title: "Workflow Response Option API: announced"
    date: "2026-04-01T12:00:27.000Z"
    commit: null
    t: 883
    quote: similarly also in 28.x X the permission APIs are also coming in 28.x Same thing for approval APIs
  - kind: video
    url: https://www.youtube.com/watch?v=YbuO1n_Lqj0&t=883s
    title: "Approval Entries API: announced"
    date: "2026-04-01T12:00:27.000Z"
    commit: null
    t: 883
    quote: similarly also in 28.x X the permission APIs are also coming in 28.x Same thing for approval APIs
  - kind: video
    url: https://www.youtube.com/watch?v=YbuO1n_Lqj0&t=17s
    title: "What's New: Enhanced IT Audit Reporting (2026 release wave 1)"
    date: "2026-04-01T12:00:27.000Z"
    commit: null
    t: 17
    quote: we got feedback the internal controls and the reporting on that was kind of hard in business central
  - kind: video
    url: https://www.youtube.com/watch?v=YbuO1n_Lqj0&t=62s
    title: "What's New: Enhanced IT Audit Reporting (2026 release wave 1)"
    date: "2026-04-01T12:00:27.000Z"
    commit: null
    t: 62
    quote: we thought maybe we can add APIs to business central so that it can get access to APIs and do their own internal controls
  - kind: video
    url: https://www.youtube.com/watch?v=YbuO1n_Lqj0&t=128s
    title: "What's New: Enhanced IT Audit Reporting (2026 release wave 1)"
    date: "2026-04-01T12:00:27.000Z"
    commit: null
    t: 128
    quote: when you then take this list into analysis mode, then you can you can do some really compelling analysis
  - kind: video
    url: https://www.youtube.com/watch?v=YbuO1n_Lqj0&t=224s
    title: "What's New: Enhanced IT Audit Reporting (2026 release wave 1)"
    date: "2026-04-01T12:00:27.000Z"
    commit: null
    t: 224
    quote: So here in 28.x so this is not for the April release hopefully in one of the m like miners 28.1 28.2
  - kind: video
    url: https://www.youtube.com/watch?v=YbuO1n_Lqj0&t=523s
    title: "What's New: Enhanced IT Audit Reporting (2026 release wave 1)"
    date: "2026-04-01T12:00:27.000Z"
    commit: null
    t: 523
    quote: This is also coming in 28.x. So you just wait to to have to wait uh one or two months to get this.
  - kind: video
    url: https://www.youtube.com/watch?v=YbuO1n_Lqj0&t=647s
    title: "What's New: Enhanced IT Audit Reporting (2026 release wave 1)"
    date: "2026-04-01T12:00:27.000Z"
    commit: null
    t: 647
    quote: But now you can also uh see things like users with super active users or inactive 7, 30 or 90 days.
  - kind: video
    url: https://www.youtube.com/watch?v=YbuO1n_Lqj0&t=703s
    title: "What's New: Enhanced IT Audit Reporting (2026 release wave 1)"
    date: "2026-04-01T12:00:27.000Z"
    commit: null
    t: 703
    quote: the reason for this is that we learned in probably larger organizations there's kind of a natural barrier or physical barrier between the IT
  - kind: video
    url: https://www.youtube.com/watch?v=YbuO1n_Lqj0&t=796s
    title: "What's New: Enhanced IT Audit Reporting (2026 release wave 1)"
    date: "2026-04-01T12:00:27.000Z"
    commit: null
    t: 796
    quote: all of these APIs are read only
  - kind: video
    url: https://www.youtube.com/watch?v=YbuO1n_Lqj0&t=883s
    title: "What's New: Enhanced IT Audit Reporting (2026 release wave 1)"
    date: "2026-04-01T12:00:27.000Z"
    commit: null
    t: 883
    quote: similarly also in 28.x X the permission APIs are also coming in 28.x Same thing for approval APIs
  - kind: video
    url: https://www.youtube.com/watch?v=YbuO1n_Lqj0&t=938s
    title: "What's New: Enhanced IT Audit Reporting (2026 release wave 1)"
    date: "2026-04-01T12:00:27.000Z"
    commit: null
    t: 938
    quote: you can create recreate those reports without having like a login UI access to business central
  - kind: video
    url: https://www.youtube.com/watch?v=YbuO1n_Lqj0&t=977s
    title: "What's New: Enhanced IT Audit Reporting (2026 release wave 1)"
    date: "2026-04-01T12:00:27.000Z"
    commit: null
    t: 977
    quote: approval entries will list all approval entry record. So you can kind of get that uh who did what when
  - kind: video
    url: https://www.youtube.com/watch?v=YbuO1n_Lqj0&t=1023s
    title: "What's New: Enhanced IT Audit Reporting (2026 release wave 1)"
    date: "2026-04-01T12:00:27.000Z"
    commit: null
    t: 1023
    quote: We took all we learned from giving security and auditing sessions at conferences plus the work that was done internally in Microsoft
links:
  learn: []
  objects: []
  features: []
  topics: []
  localizations: []
  videos: []
  posts: []
  guidelines: []
video_id: YbuO1n_Lqj0
channel: yt-microsoft
source_name: Microsoft Dynamics 365 Business Central (YouTube)
url: https://www.youtube.com/watch?v=YbuO1n_Lqj0
published_at: "2026-04-01T12:00:27.000Z"
duration_s: 1348
captions: full
audience:
  - administrator
  - functional consultant
  - developer
  - partner
chapters:
  - t: 0
    title: Introduction and Session Overview
  - t: 76
    title: Permission Overview Page and Analysis
  - t: 189
    title: Approval and Workflow Overviews
  - t: 288
    title: Approval Pages Enhancement and Help Experience
  - t: 356
    title: Analysis Views for Change Log and User Auditing
  - t: 472
    title: User Management Experience Improvements
  - t: 534
    title: Users List and User Detail View Enhancements
  - t: 671
    title: Permission and Approval APIs for IT Access
  - t: 1072
    title: General Business Central Resources for Partners
  - t: 1190
    title: Community Engagement and Learning Channels
features:
  - name: Permission Overview page
    status: unclear
    t: 92
    verified: false
    status_source: video
  - name: Approval User Overview page
    status: unclear
    t: 224
    verified: false
    status_source: video
  - name: Approval Entry Overview page
    status: unclear
    t: 274
    verified: false
    status_source: video
  - name: Approval pages help improvements
    status: unclear
    t: 308
    verified: false
    status_source: video
  - name: Analysis tabs on Change Log Entries
    status: unclear
    t: 374
    verified: false
    status_source: video
  - name: Analysis tabs on Users list
    status: unclear
    t: 472
    verified: false
    status_source: video
  - name: Users list last login date and inactive days
    status: announced
    t: 534
    verified: true
    status_source: video
  - name: Users list fact box enhancements
    status: announced
    t: 573
    verified: true
    status_source: video
  - name: User Detail View improvements
    status: announced
    t: 617
    verified: true
    status_source: video
  - name: Permission Sets API
    status: announced
    t: 796
    verified: true
    status_source: video
  - name: Expanded Permission Sets API
    status: announced
    t: 832
    verified: true
    status_source: video
  - name: Security Groups API
    status: announced
    t: 832
    verified: true
    status_source: video
  - name: User Permission API
    status: announced
    t: 853
    verified: true
    status_source: video
  - name: Access Control API
    status: announced
    t: 853
    verified: true
    status_source: video
  - name: Workflows API
    status: announced
    t: 883
    verified: true
    status_source: video
  - name: Workflow Steps API
    status: announced
    t: 897
    verified: true
    status_source: video
  - name: Workflow Response Option API
    status: announced
    t: 915
    verified: true
    status_source: video
  - name: Approval Entries API
    status: announced
    t: 977
    verified: true
    status_source: video
  - name: Updated Security Guide
    status: unclear
    t: 988
    verified: false
    status_source: video
objects_mentioned: []
quotes:
  - t: 17
    text: we got feedback the internal controls and the reporting on that was kind of hard in business central
    check: exact
  - t: 62
    text: we thought maybe we can add APIs to business central so that it can get access to APIs and do their own internal controls
    check: exact
  - t: 128
    text: when you then take this list into analysis mode, then you can you can do some really compelling analysis
    check: exact
  - t: 224
    text: So here in 28.x so this is not for the April release hopefully in one of the m like miners 28.1 28.2
    check: exact
  - t: 523
    text: This is also coming in 28.x. So you just wait to to have to wait uh one or two months to get this.
    check: exact
  - t: 647
    text: But now you can also uh see things like users with super active users or inactive 7, 30 or 90 days.
    check: exact
  - t: 703
    text: the reason for this is that we learned in probably larger organizations there's kind of a natural barrier or physical barrier between the IT
    check: exact
  - t: 796
    text: all of these APIs are read only
    check: exact
  - t: 883
    text: similarly also in 28.x X the permission APIs are also coming in 28.x Same thing for approval APIs
    check: exact
  - t: 938
    text: you can create recreate those reports without having like a login UI access to business central
    check: exact
  - t: 977
    text: approval entries will list all approval entry record. So you can kind of get that uh who did what when
    check: exact
  - t: 1023
    text: We took all we learned from giving security and auditing sessions at conferences plus the work that was done internally in Microsoft
    check: exact
---

# What's New: Enhanced IT Audit Reporting (2026 release wave 1)

> Business Central 2026 release wave 1 audit and internal-control reporting additions: Permission Overview page, approval overview pages, analysis tabs on change log and users list, and read-only APIs for permissions, workflows and approval entries. Most items are described as coming in 28.x, not the April release.

[Watch on YouTube](https://www.youtube.com/watch?v=YbuO1n_Lqj0) · Microsoft Dynamics 365 Business Central (YouTube) · 2026-04-01 · 22:28 · tier official · reviewed (checked by Opus)

## Overview

The session covers changes made after feedback that internal controls and reporting were hard in Business Central. It demos a Permission Overview page for filtering and pivoting permissions in analysis mode, approval overview pages showing who can approve what and approval statuses, and better help on approval pages.

It also shows analysis tabs on Change Log Entries and the Users list, new last login and inactive days columns, fact box and user detail view improvements, and a set of read-only APIs for permissions, security groups, workflows and approval entries. These let IT teams rebuild audit reports without UI login access. An updated security guide is also mentioned.

## Key points

- Permission Overview page lets you filter permissions by object type, ID, permission set scope and app source, see which security groups and users hold each permission set, and pivot in analysis mode.
- Approval User Overview page shows who can approve what, and to which limits, across workflow types on one screen. It is said to come in 28.1 or 28.2, not the April release.
- Change Log Entries get analysis tabs showing who changed which table and field data and when. They are coming in 28.x and need the change log enabled for the relevant tables and fields.
- Users list in 28.x adds last login date and inactive days columns, analysis views by user status and license type, and fact box details with navigation links to user settings, approval user setup and user setup.
- User Detail View gets last login date, inactive days and prefiltered views such as super active users and users inactive 7, 30 or 90 days, usable in analysis mode.
- New APIs, all read-only and coming in 28.x, cover permission sets, expanded permission sets, security groups, user permissions, access control, workflows, workflow steps, workflow response options, workflow approvers, approval user setup and approval entries (normal and posted).
- The APIs are meant to let IT staff recreate audit reports without login UI access to Business Central, reflecting a separation between IT and business in larger organizations.

## Chapters

- [0:00](https://www.youtube.com/watch?v=YbuO1n_Lqj0&t=0s) Introduction and Session Overview
- [1:16](https://www.youtube.com/watch?v=YbuO1n_Lqj0&t=76s) Permission Overview Page and Analysis
- [3:09](https://www.youtube.com/watch?v=YbuO1n_Lqj0&t=189s) Approval and Workflow Overviews
- [4:48](https://www.youtube.com/watch?v=YbuO1n_Lqj0&t=288s) Approval Pages Enhancement and Help Experience
- [5:56](https://www.youtube.com/watch?v=YbuO1n_Lqj0&t=356s) Analysis Views for Change Log and User Auditing
- [7:52](https://www.youtube.com/watch?v=YbuO1n_Lqj0&t=472s) User Management Experience Improvements
- [8:54](https://www.youtube.com/watch?v=YbuO1n_Lqj0&t=534s) Users List and User Detail View Enhancements
- [11:11](https://www.youtube.com/watch?v=YbuO1n_Lqj0&t=671s) Permission and Approval APIs for IT Access
- [17:52](https://www.youtube.com/watch?v=YbuO1n_Lqj0&t=1072s) General Business Central Resources for Partners
- [19:50](https://www.youtube.com/watch?v=YbuO1n_Lqj0&t=1190s) Community Engagement and Learning Channels

## Features

| Feature | Status | At | Evidence |
|---|---|---|---|
| Permission Overview page | status not stated, demoed | [1:32](https://www.youtube.com/watch?v=YbuO1n_Lqj0&t=92s) |  |
| Approval User Overview page | status not stated, demoed | [3:44](https://www.youtube.com/watch?v=YbuO1n_Lqj0&t=224s) |  |
| Approval Entry Overview page | status not stated | [4:34](https://www.youtube.com/watch?v=YbuO1n_Lqj0&t=274s) |  |
| Approval pages help improvements | status not stated, demoed | [5:08](https://www.youtube.com/watch?v=YbuO1n_Lqj0&t=308s) |  |
| Analysis tabs on Change Log Entries | status not stated, demoed | [6:14](https://www.youtube.com/watch?v=YbuO1n_Lqj0&t=374s) |  |
| Analysis tabs on Users list | status not stated, demoed | [7:52](https://www.youtube.com/watch?v=YbuO1n_Lqj0&t=472s) |  |
| Users list last login date and inactive days | announced, demoed | [8:54](https://www.youtube.com/watch?v=YbuO1n_Lqj0&t=534s) | "This is also coming in 28.x. So you just wait to to have to wait uh one or two months to get this." ([8:43](https://www.youtube.com/watch?v=YbuO1n_Lqj0&t=523s)) |
| Users list fact box enhancements | announced, demoed | [9:33](https://www.youtube.com/watch?v=YbuO1n_Lqj0&t=573s) | "This is also coming in 28.x. So you just wait to to have to wait uh one or two months to get this." ([8:43](https://www.youtube.com/watch?v=YbuO1n_Lqj0&t=523s)) |
| User Detail View improvements | announced, demoed | [10:17](https://www.youtube.com/watch?v=YbuO1n_Lqj0&t=617s) | "This is also coming in 28.x. So you just wait to to have to wait uh one or two months to get this." ([8:43](https://www.youtube.com/watch?v=YbuO1n_Lqj0&t=523s)) |
| Permission Sets API | announced | [13:16](https://www.youtube.com/watch?v=YbuO1n_Lqj0&t=796s) | "similarly also in 28.x X the permission APIs are also coming in 28.x Same thing for approval APIs" ([14:43](https://www.youtube.com/watch?v=YbuO1n_Lqj0&t=883s)) |
| Expanded Permission Sets API | announced | [13:52](https://www.youtube.com/watch?v=YbuO1n_Lqj0&t=832s) | "similarly also in 28.x X the permission APIs are also coming in 28.x Same thing for approval APIs" ([14:43](https://www.youtube.com/watch?v=YbuO1n_Lqj0&t=883s)) |
| Security Groups API | announced | [13:52](https://www.youtube.com/watch?v=YbuO1n_Lqj0&t=832s) | "similarly also in 28.x X the permission APIs are also coming in 28.x Same thing for approval APIs" ([14:43](https://www.youtube.com/watch?v=YbuO1n_Lqj0&t=883s)) |
| User Permission API | announced | [14:13](https://www.youtube.com/watch?v=YbuO1n_Lqj0&t=853s) | "similarly also in 28.x X the permission APIs are also coming in 28.x Same thing for approval APIs" ([14:43](https://www.youtube.com/watch?v=YbuO1n_Lqj0&t=883s)) |
| Access Control API | announced | [14:13](https://www.youtube.com/watch?v=YbuO1n_Lqj0&t=853s) | "similarly also in 28.x X the permission APIs are also coming in 28.x Same thing for approval APIs" ([14:43](https://www.youtube.com/watch?v=YbuO1n_Lqj0&t=883s)) |
| Workflows API | announced | [14:43](https://www.youtube.com/watch?v=YbuO1n_Lqj0&t=883s) | "similarly also in 28.x X the permission APIs are also coming in 28.x Same thing for approval APIs" ([14:43](https://www.youtube.com/watch?v=YbuO1n_Lqj0&t=883s)) |
| Workflow Steps API | announced | [14:57](https://www.youtube.com/watch?v=YbuO1n_Lqj0&t=897s) | "similarly also in 28.x X the permission APIs are also coming in 28.x Same thing for approval APIs" ([14:43](https://www.youtube.com/watch?v=YbuO1n_Lqj0&t=883s)) |
| Workflow Response Option API | announced | [15:15](https://www.youtube.com/watch?v=YbuO1n_Lqj0&t=915s) | "similarly also in 28.x X the permission APIs are also coming in 28.x Same thing for approval APIs" ([14:43](https://www.youtube.com/watch?v=YbuO1n_Lqj0&t=883s)) |
| Approval Entries API | announced | [16:17](https://www.youtube.com/watch?v=YbuO1n_Lqj0&t=977s) | "similarly also in 28.x X the permission APIs are also coming in 28.x Same thing for approval APIs" ([14:43](https://www.youtube.com/watch?v=YbuO1n_Lqj0&t=883s)) |
| Updated Security Guide | status not stated | [16:28](https://www.youtube.com/watch?v=YbuO1n_Lqj0&t=988s) |  |

## Quotes

- [0:17](https://www.youtube.com/watch?v=YbuO1n_Lqj0&t=17s) "we got feedback the internal controls and the reporting on that was kind of hard in business central"
- [1:02](https://www.youtube.com/watch?v=YbuO1n_Lqj0&t=62s) "we thought maybe we can add APIs to business central so that it can get access to APIs and do their own internal controls"
- [2:08](https://www.youtube.com/watch?v=YbuO1n_Lqj0&t=128s) "when you then take this list into analysis mode, then you can you can do some really compelling analysis"
- [3:44](https://www.youtube.com/watch?v=YbuO1n_Lqj0&t=224s) "So here in 28.x so this is not for the April release hopefully in one of the m like miners 28.1 28.2"
- [8:43](https://www.youtube.com/watch?v=YbuO1n_Lqj0&t=523s) "This is also coming in 28.x. So you just wait to to have to wait uh one or two months to get this."
- [10:47](https://www.youtube.com/watch?v=YbuO1n_Lqj0&t=647s) "But now you can also uh see things like users with super active users or inactive 7, 30 or 90 days."
- [11:43](https://www.youtube.com/watch?v=YbuO1n_Lqj0&t=703s) "the reason for this is that we learned in probably larger organizations there's kind of a natural barrier or physical barrier between the IT"
- [13:16](https://www.youtube.com/watch?v=YbuO1n_Lqj0&t=796s) "all of these APIs are read only"
- [14:43](https://www.youtube.com/watch?v=YbuO1n_Lqj0&t=883s) "similarly also in 28.x X the permission APIs are also coming in 28.x Same thing for approval APIs"
- [15:38](https://www.youtube.com/watch?v=YbuO1n_Lqj0&t=938s) "you can create recreate those reports without having like a login UI access to business central"
- [16:17](https://www.youtube.com/watch?v=YbuO1n_Lqj0&t=977s) "approval entries will list all approval entry record. So you can kind of get that uh who did what when"
- [17:03](https://www.youtube.com/watch?v=YbuO1n_Lqj0&t=1023s) "We took all we learned from giving security and auditing sessions at conferences plus the work that was done internally in Microsoft"

## Disclaimers in the video

- [3:44](https://www.youtube.com/watch?v=YbuO1n_Lqj0&t=224s) not-in-this-release: So here in 28.x so this is not for the April release hopefully in one of the m like miners 28.1 28.2
- [6:25](https://www.youtube.com/watch?v=YbuO1n_Lqj0&t=385s) coming-later: you will in 28.x X when this is surfacing
- [8:43](https://www.youtube.com/watch?v=YbuO1n_Lqj0&t=523s) coming-later: This is also coming in 28.x. So you just wait to to have to wait uh one or two months to get this.
- [14:43](https://www.youtube.com/watch?v=YbuO1n_Lqj0&t=883s) coming-later: similarly also in 28.x X the permission APIs are also coming in 28.x Same thing for approval APIs