Control Access to Business Central Using Security Groups

Note

Note:
Azure Active Directory is now Microsoft Entra ID. Learn more.

Security groups make it easier for administrators to manage user permissions. For example, for Business Central online, they're reusable across Dynamics 365 applications, such as SharePoint Online, CRM Online, and Business Central. Administrators add permissions to their Business Central security groups, and when they add users to the group the permissions apply to all members. For example, an administrator can create a Business Central security group that gives salespeople the ability to create and post sales orders. Or, let purchasers do the same for purchase orders.

Business Central online and on-premises

You can use security groups for the online and on-premises versions of Business Central. Depending on your version, create groups in one of the following ways:

Afterward, create a corresponding security group in Business Central, and then link it to the group you created. To learn more, go to Add a security group in Business Central.

Note

Note:
If you've set up a special type of user with a Windows Group license type in a version of Business Central on-prem that's earlier than 2023 release wave 1, when you upgrade Business Central converts the user to a security group. The new security group has the same name as the Windows group name. The security group gives you a better overview of the group members and their effective permissions.

Add a security group in Business Central

Note

Note:
When you add a security group in Business Central, the security group appears in all companies.

  1. Choose the Lightbulb that opens the Tell Me feature 1. icon, enter Security Groups, and then choose the related link.

  2. Choose New to create a group.

  3. Create the link to your group, as follows:

    • For Business Central online, choose the group in the Microsoft Entra security group name field.
    • For Business Central on-premises, choose the group in the Windows group name field.
Note

Note:
The users show in the Members card on the FactBox pane or the Security Group Members page only if they're added as users in Business Central. To learn more about adding users, go to To add users or update user information and license assignments in Business Central.

Assign permissions to a security group

  1. On the Security Groups page, choose the group, and then choose the Permissions action.

  2. Assign permissions in the following ways:

    • To assign permission sets individually, in the Permission Set field, choose the permissions to assign.
    • To assign multiple permission sets, choose the Add multiple action, and then choose the sets to assign.

  3. If you want the permission sets to apply only to a specific company, set the Company column to that company. If you want the permission set to apply to all companies, leave the Company column blank. To learn more, go to Control access to specific companies.

Review the permissions in a security group

On the Security Groups page, the FactBox pane shows the Permission Sets that are assigned to the group. Each user listed in the Members card has those permissions. The Permission Set by Security Group action provides a more detailed view. There you can also explore the individual permissions in each security group.

Permissions are also available on the Users page. The FactBox pane shows the Permission Sets from Security Group and Security Group Memberships cards for the selected user.

Copy a security group and all its permission sets

To quickly define a new security group, you can copy all permission sets from an existing security group to your new security group.

Note

Note:
Apply Reports to Filter to Employees, Apply Reports to Filter to Positions, Apply Reports to Filter to HR Requests values as well as any security group application area setup are not copied from the source security group to the new security group.

To copy a security group and all its permission sets

  1. Choose Lightbulb that opens the Tell Me feature., enter security groups, and then choose the related link.

    The Security Groups page opens.

  2. Select the security group that you want to copy, and then choose the Copy existing action.

    The Copy Security Group page opens.

  3. In New Microsoft Entra security group name, specify the name of the Microsoft Entra security group that is to be associated with this new security group.

  4. In New Code, specify the code that is to represent the new security group.

    The new security group appears in the Security Groups page.

Security groups and user groups

Note

Note:
User groups will no longer be available in a future release.

Security groups are very similar to the user groups that are currently available. However, user groups are only relevant for Business Central. Security groups are based on groups in Microsoft Entra ID or Windows Active Directory, depending on whether you're using Business Central online or on-premises, respectively. Administrators can use security groups with other Dynamics 365 apps, providing valuable access control. For example, if salespeople use Business Central and SharePoint, administrators don't have to recreate the group and its members.

License configurations still apply

You can configure permissions in Business Central based on licenses. Those permissions are directly assigned to new users. These configurations still apply, even if you start using security groups.

To use security groups exclusively, we recommend that you remove the license configurations. To learn more about license configurations, go to Create Users According to Licenses.

You can remove license configurations on the License Configuration page. Choose a license, and then delete all permission sets assigned to it.

See also

Set up application areas
Set up limited access budgeting and planning
Set up limited access for finance and procurement
Set up limited access HR requests
How relevant time entry units are determined

Create Users According to Licenses
Set Up Business Central Access in Teams with Microsoft 365 Licenses
Learn about groups and access rights in Microsoft Entra ID
Microsoft Entra security groups