Understanding and Managing Permissions Using Exclude Feature in Dynamics 365 Business Central

Understanding and Managing Permissions Using Exclude Feature in Dynamics 365 Business Central

When it comes to managing user permissions in Dynamics 365 Business Central (BC), administrators often encounter challenges in customizing access controls to fit their organization’s needs. A common issue arises when attempting to modify the D365 BUS FULL ACCESS permission sets. Let’s delve into a scenario where an admin has replicated the full access permission set, removed certain permissions related to company setup and assisted setup, but the changes are not taking effect as expected.

 The Sum of All Permissions

In BC, when you assign multiple permission sets to a user, the platform grants the user the sum of all permissions included in these sets. This additive nature means that if any of the assigned permission sets allow a particular action, the user will be able to perform it.

 The Challenge

An administrator noticed that after modifying a copy of the D365 BUS FULL ACCESS permission set to restrict Insert, Modify, and Read access for company setup areas, the users were still able to make changes. The objective was clear: control the environment to prevent any alterations that could impact the initial setup of Business Central.

 The Solution: Using Exclude to Control Permissions

 To address this, BC allows the use of the 'Exclude' permission property. This feature is designed to negate permissions that are otherwise granted, providing a way to fine-tune access control beyond the basic additive model.

 Steps to Troubleshoot and Resolve Permission Issues

 1. Review Assigned Permission Sets: Ensure that the modified permission set is correctly assigned and that no other permission sets are counteracting the restrictions by granting broader access.

 2. Implement Exclude Permission Sets: Utilize the 'ExcludedPermissionSets' property to explicitly remove permissions that you do not want a user to have. This can be particularly useful when dealing with composite permission sets.

 3. Handle Caching and Session Issues: Sometimes, changes might not propagate immediately due to server caching or active user sessions. Logging out and logging back in can often resolve this.

 4. Avoid SUPER Permission Conflicts: Remember that the SUPER permission set grants full access and cannot be altered. Users with the SUPER set will override any other permission restrictions.

 5. Synchronize Permissions Correctly: For users synchronized from Microsoft 365, ensure that the permissions are correctly mirrored in BC, paying close attention to Azure AD group assignments.

  Best Practices

 - Test in Sandbox: Always test permission changes in a sandbox environment to ensure they do not restrict necessary access.

- Central Management: Utilize composite permission sets for central management of permissions, which can simplify the administration process.

- Regular Audits: Conduct regular permission audits to ensure compliance with your organization’s security policies.

Configuring user permissions in Dynamics 365 Business Central requires a nuanced approach, especially when dealing with complex setups. The platform’s capability to exclude permissions provides administrators with the flexibility to tailor access as needed. Remember, fine-tuning permissions is a delicate balance between ensuring security and allowing users to perform their roles effectively.