Dynamics 365 Business Central: Permissions

Dynamics 365 Business Central: Permissions

Hey everyone, we got a request from Sandra for permissions, so we're going to do permissions my one of my least favorite topics by the way but anyways it's something that we all must deal with in the world. 

Here goes, basically in Business Central permissions are set up in such a way that they have extremely high flexibility, you can set up any type of permissions pretty much that you want. Now, with that flexibility it comes also complexity, so even though it looks simple on the surface, it can be complicated when you dive into it. 

The way it works is, of course, you have a user which you will give permissions to, that user can be put into a group user group so that you can set the permissions for the group and then if the user is inside the group it gets the group's permissions. You could have user 1 user 2 etc. Then you have something called permission set, this permission set has a name, let's say its item, so you have access to items; so, it's an example; so inside here, is where the detail comes in. Let's call this modify item, in here will be everything that do you need access to in order to modify an item and you can look at this in the system.  

You would need access to the item table, here we have actually you know execute, read and write and so forth permissions that could be indirect; and this gets really technical and that's your how technical I'm going to get in this video; in the item table let's say in order to modify the item you need definitely read, write and execute permissions, I think there's also delete and then there is just a list of tables that you need to access. When you're actually creating an item, you might need to be able to read let's say the item tracking information table because you look up into that or the base unit of measure or units to measure table. Let's do that one. 

Units of measure table, you will definitely need a read access to that because you look up into units of measure, you pick what you want and you put it into the item table and so there are all these extra tables that you will need access to in order to create an item it's a lot. And for a normal person who just wants the system to allow you to create an item and not really keep track of all of this, you can use existing permission sets in business central that are already set up for most of these things. 

If you don't have a permission set for what you need to do and it's something completely new, you might need to go down to this level and figure out which tables will actually work and there is a tool out there called easy security, go ahead and take a look at that if you have to do a lot of permissions, that tool does everything regarding permissions and it's really good at managing, creating new permission sets, moving them around between users, keeping track of the groups and all of those things. If you're frustrated with what you have in business central, look at easy security. 

I'm going to go into the application and show you at least this concept there and hopefully that will kind of open up a little bit of clarity on the subject. Let's look at the system, when we're dealing with permissions we just go in here and type in permissions, we get here into permission sets, so this is the base of the permissions. Basically, each one of these sets can be assigned to a user and it's one of these sets has permissions right here, so for example, if I pick banking, you're going to see that the permissions that are given for banking are going to be all these tables here.  

So you can actually give permissions based on tables but also on pages or code units, those are kind of system entities but most of the time all of the provisions are given just based on tables and then all pages and code units are allowed, as long as you have access to the table which is the base of that. For example, here I can look at permissions and you get this big technical thing here, all of the tables list that for that, for the banking and whether they have a read, insert, modify, delete, execute etc. for that. 

If we go out of this, we can also look at the user groups, so the user groups that we have here are basically groups that will have permission sets. If the user is inside a group then they will have many permission sets that are connected to that group, so it's easy, you basically put the user an accountant Kelton's group and they will have access to those. You can see here for the accountants we have basic jobs edit and here local region, so these are the permission sets for that. 

You can also so here you can see the permission set for user group and here you have a cross you have all the user groups and then down here you have the permission sets and you have which one has what, so it's the kind of nice matrix, this gets really involved because of so many permission sets and you know the use group, so if you're setting this up, maybe you want to trim down the user groups that you have to as few as possible and then set that up for the permission sets. 

Also, what I think is cool is, here you can see user by user group, so who is in which user group which is very nice. I think all our users here are administrators or super users you can see that here, so they don't really have to belong to any group, this makes it a little bit simpler. Finally, what I think is cool which is sort of new in business central, you can see effective permissions, so here you can look at Paul, which I look at logged in as.  I can see what permission set I’m in said I'm in and I can see the effective permissions on every single table according to all the permission sets that I’m in. 

I've been given several permission sets and I can then see overall how does that affect all the tables in the system, what can I do? I can here do anything with payment terms, anything with currency, anything with customer price all of that so that basically gives me the total permission. If for some reason, my user cannot edit the customer and they were supposed to be able to, you can then come in here and see the effective permissions, notice that, and then possibly fix that in one of the in one of the groups or permission sets. 

I know this is it's a bit complicated and in its simplest terms, you just go into permissions permission sets, you can then go into the user permission set per user and you can see here just check off who was supposed to be in what and then you've set it up and if you can you work with these groups that are automatically set up in the system by default, then you should be fairly good and I hope that's set some light on it.