Permission Concept

Set up and review the user and permission concept with users, permission sets, security groups, user setup, warehouse employees, and profiles.

Benefits

A structured user and permission concept ensures that:

  • users only access data relevant to them
  • postings are carried out in a controlled way
  • responsibilities are clearly defined
  • interfaces are provided on a role basis

Setup is done per company and follows the standard of Microsoft Dynamics 365 Business Central (Cloud).

The user and permission concept governs:

  1. Who is allowed to sign in?
  2. Which data may the user view or edit?
  3. Which functions may the user perform?
  4. Which interface does the user get?

Control is exercised via:

  • Users
  • Permission sets
  • Security groups
  • User setup
  • Warehouse employees
  • Profiles (roles)

Important: A profile controls the interface. A permission set controls data access.

Prerequisites

  • The user is set up in Microsoft 365 (Microsoft Entra ID).
  • The user exists in Business Central.
  • An authorized user (e.g. IT or a key user with SUPER rights) performs the setup.

Process Overview

  1. Check or create the user
  2. Assign permission sets
  3. Optional: use a security group
  4. Maintain user setup
  5. Assign a warehouse employee (if required)
  6. Set a profile (role)
  7. Check permissions (effective permissions)

Check or Create the User

  1. Open the search.
  2. Open the Users page.
  3. Check whether the user exists.
  4. If required, update the users from Microsoft 365.

In the cloud variant, authentication is handled via Microsoft 365. A separate password setup in Business Central is not required.

Assign Permission Sets

  1. Open the User Card.
  2. Switch to the Permission Sets area.
  3. Select a permission set in an empty line.

Important standard permission sets

Permission Set Meaning
SUPER Full access to the system
D365 BASIC Basic rights for using the system
further functional sets e.g. purchase, sales, warehouse

Note: Several permission sets can be combined.

Instead of maintaining individual users, permission sets can be assigned to a security group.

Procedure:

  1. Open the Permission Set by Security Group page.
  2. Set the desired assignments in the matrix.
  3. Assign users to the security group in Microsoft 365.

Advantage:

  • Central maintenance
  • Reduced maintenance effort

Maintain User Setup

User setup controls functional restrictions.

  1. Open the User Setup page.
  2. Add the user.
  3. Maintain the relevant fields.

Relevant fields

Field Description Note
Allow Posting From / To Restriction of the posting period In finance, posting periods can be defined centrally, e.g. for month-end closings. Here, deviating allowed posting periods are defined for individual users.
Salespers./Purch. Code Automatic assignment on documents The user can be linked to a salesperson/purchaser. This is then automatically assigned on orders.
Responsibility Center Restriction of documents in sales/purchase Responsibility centers can be used to restrict views in purchasing and sales by responsibility center. For example, a user can be assigned the responsibility “Purchase Women”. Documents such as orders are then automatically filtered to vendors that also have the responsibility “Purchase Women” assigned. This also prevents sales employees from viewing or changing the orders of other sales employees.
E-Mail Stored email address of the user
Request Approval Setup Control of approval processes Additional fields for approval setups can be shown to configure purchase limits, substitute rules, etc.

These settings do not replace permission sets, they complement them functionally.

Assign a Warehouse Employee

For a user to be able to process warehouse activities:

  1. Open the Warehouse Employees page.
  2. Create a new entry.
  3. Assign:
    • User ID
    • Location code
  4. Optional: mark a location as Default.

Only assigned locations are available for warehouse activities.

Assign a Profile (Role)

A profile controls:

  • Home page (role center)
  • Navigation
  • Visible reports and actions

Procedure:

  1. Open the User Personalization page.
  2. Select the user.
  3. Enter the desired role in the Profile ID field.

Examples:

  • Sales role
  • Purchase role
  • Warehouse role
  • Finance

Important: The profile does not affect permissions at the data level.

Control Personalization

The profile can determine whether users are allowed to:

  • personalize pages
  • show or hide fields
  • save their own views

Setting in the profile:

  • Disable Personalization = personalization not possible
  • disabled = personalization allowed

Check Effective Permissions

To verify:

  1. Open the Effective Permissions page.
  2. Select the user and company.
  3. Check the actual rights.

This shows the sum of all assigned permission sets.

Relevant Fields and Options

User Card

Field Description
User Name Sign-in ID
State Enabled / Disabled
Permission Sets Assigned rights
Company Optional company-specific restriction

Permission Set by Object Type

Setting Meaning
Read Permission View data
Insert Permission Create new records
Modify Permission Edit data
Delete Permission Delete data
Execute Permission Run actions/processes

Examples

Example 1: Purchaser

  • Permission sets: D365 BASIC + Purchase
  • User setup:
    • Responsibility = Purchase Women
    • Salesperson/Purchaser code set
  • Profile: Purchase role

Example 2: Store Warehouse Employee

  • Permission sets: D365 BASIC + Warehouse
  • Warehouse employee:
    • Location = FIL01
  • Profile: Warehouse role

Example 3: Finance

  • Permission sets: D365 BASIC + Financial Management
  • User setup:
    • Posting period restricted
  • Profile: Accountant

Best Practices

  • Prefer using security groups instead of individual assignments.
  • Combine several small permission sets instead of one large one.
  • Grant SUPER rights only temporarily.
  • Clearly separate:
    • Interface (profile)
    • Functional restriction (user setup)
    • Technical permission (permission set)
  • Regularly check the Effective Permissions.
  • Document role concepts per business area.