What's New: Enhanced IT Audit Reporting (2026 release wave 1)

Overview

The session covers changes made after feedback that internal controls and reporting were hard in Business Central. It demos a Permission Overview page for filtering and pivoting permissions in analysis mode, approval overview pages showing who can approve what and approval statuses, and better help on approval pages.

It also shows analysis tabs on Change Log Entries and the Users list, new last login and inactive days columns, fact box and user detail view improvements, and a set of read-only APIs for permissions, security groups, workflows and approval entries. These let IT teams rebuild audit reports without UI login access. An updated security guide is also mentioned.

Key points

• Permission Overview page lets you filter permissions by object type, ID, permission set scope and app source, see which security groups and users hold each permission set, and pivot in analysis mode.
• Approval User Overview page shows who can approve what, and to which limits, across workflow types on one screen. It is said to come in 28.1 or 28.2, not the April release.
• Change Log Entries get analysis tabs showing who changed which table and field data and when. They are coming in 28.x and need the change log enabled for the relevant tables and fields.
• Users list in 28.x adds last login date and inactive days columns, analysis views by user status and license type, and fact box details with navigation links to user settings, approval user setup and user setup.
• User Detail View gets last login date, inactive days and prefiltered views such as super active users and users inactive 7, 30 or 90 days, usable in analysis mode.
• New APIs, all read-only and coming in 28.x, cover permission sets, expanded permission sets, security groups, user permissions, access control, workflows, workflow steps, workflow response options, workflow approvers, approval user setup and approval entries (normal and posted).
• The APIs are meant to let IT staff recreate audit reports without login UI access to Business Central, reflecting a separation between IT and business in larger organizations.

Features

Quotes

• 0:17 “we got feedback the internal controls and the reporting on that was kind of hard in business central”
• 1:02 “we thought maybe we can add APIs to business central so that it can get access to APIs and do their own internal controls”
• 2:08 “when you then take this list into analysis mode, then you can you can do some really compelling analysis”
• 3:44 “So here in 28.x so this is not for the April release hopefully in one of the m like miners 28.1 28.2”
• 8:43 “This is also coming in 28.x. So you just wait to to have to wait uh one or two months to get this.”
• 10:47 “But now you can also uh see things like users with super active users or inactive 7, 30 or 90 days.”
• 11:43 “the reason for this is that we learned in probably larger organizations there’s kind of a natural barrier or physical barrier between the IT”
• 13:16 “all of these APIs are read only”
• 14:43 “similarly also in 28.x X the permission APIs are also coming in 28.x Same thing for approval APIs”
• 15:38 “you can create recreate those reports without having like a login UI access to business central”
• 16:17 “approval entries will list all approval entry record. So you can kind of get that uh who did what when”
• 17:03 “We took all we learned from giving security and auditing sessions at conferences plus the work that was done internally in Microsoft”

Disclaimers in the video

• 3:44 not-in-this-release: So here in 28.x so this is not for the April release hopefully in one of the m like miners 28.1 28.2
• 6:25 coming-later: you will in 28.x X when this is surfacing
• 8:43 coming-later: This is also coming in 28.x. So you just wait to to have to wait uh one or two months to get this.
• 14:43 coming-later: similarly also in 28.x X the permission APIs are also coming in 28.x Same thing for approval APIs