Business Central permissions, driven by your Azure AD groups
How Business Central uses Microsoft Entra security groups: assign permission sets to a group, limit them by company, and manage starters, leavers and role changes in one place.
Managing user permissions in Business Central starts simple and can drift. Permission sets are added when someone joins, removed when they leave, and a starters-and-leavers spreadsheet grows in between.
If your business already uses Microsoft 365, you have a cleaner answer: Microsoft Entra security groups. This guide explains how Business Central uses them.
Key PointBusiness Central security groups link to Microsoft Entra groups, so permissions follow group membership.
Security groups in Business Central
Microsoft's guide to controlling access using security groups explains the idea. Administrators add permissions to a Business Central security group, and when users are added to the group the permissions apply to all members.
For Business Central online, you create the groups in Microsoft Entra and link each one to a security group in Business Central. Microsoft notes that security groups replaced user groups starting in 2023 release wave 1 (version 22).
Assign permissions to a group
- On the Security Groups page, select the group and choose Permissions.
- Assign permission sets one at a time, or several with Add multiple.
- Set the Company column to limit a permission set to one company, or leave it blank for all companies.
Microsoft's guide to assigning permissions covers how permission sets combine.
Pro TipUse the Company column to give one group different permissions in different companies.
What changes when you work this way
- Starters. IT already adds a new joiner to groups for Teams and SharePoint. The same group can carry their Business Central permissions.
- Leavers and role changes. Membership is managed in one place, in Microsoft Entra, rather than in two systems.
- Several companies. The Company column lets one group carry different permissions in different companies.
Note that Microsoft says group members only appear in Business Central once they have been added as users.
Watch OutTest group-based permissions in a sandbox first. A wrong mapping applies to every member at once.
Controlling access to whole environments
Security groups can also control who can reach an environment at all. Microsoft's guide to managing access to environments explains how to assign a group to an environment, and notes that the restriction does not apply to administrators.
Next steps
Review your current permission sets, decide which Microsoft Entra groups should carry them, and test the set-up in a sandbox before production. The NCSC's guidance on identity and access management is a useful frame for who should have access to what, and the ICAEW technology resources are a good independent reference for finance teams.
We are also building an Amplio Smart Permissions extension in this area; it is not yet available on Microsoft AppSource. For help with your own Business Central permissions, contact us, or read our article on managing Business Central environments.