Who Can Do What in Business Central?

Did you ever need to know who can create a new item, a new customer, a new G/L account, or any other master record in your Business Central or Dynamics NAV system?

You can certainly use effective permissions to check user by user. In the image below, you can see that this user can insert (create), modify, and delete items, customers, vendors, and G/L Accounts (I have set up a filter for these specific tables in this example).

If you know which permission set(s) allow users to perform a specific function, then you can use the Permission Set by User lookup. Search Users then in the ribbon. Now from the Users page select Related > Permissions > Permission Set by User.

A way to get a definitive list of everyone who can create a master record in BC, is to run the permissions and access pages. You will need to know some of the technical information like the following:

Master Record Tables (There are other tables you can query as necessary)

• Table # Table
• 15 G/L Account
• 18 Customer
• 23 Vendor
• 27 Item

Permissions Tables (I put commas in the table numbers for readability)

• 2,000,000,004 Permission Sets (contains out-of-the-box permission sets)
• 2,000,000,005 Permissions (contains out-of-the-box permissions)
• 2,000,000,165 Tenant Permission Sets (contains only your custom permission sets)
• 2,000,000,166 Tenant Permissions (contains custom permissions)
• 9002 User Groups
• 2,000,000,053 Access Control (lists permissions assigned each user)

The next thing you need to know is how to run an object in Business Central or for our purpose, how to run a table object. To run a table object in Business Central, first go to your BC role center page. Now look at the URL (web address) in the address bar of your web browser. It should look something like this:

https://businesscentral.dynamics.com/?company=CRONUS%20USA%2C%20Inc.&dc=0

Notice that the URL contains your BC company name and ends in &dc=0.

If we change the &dc=0 to &table=2000000005, we will run the permissions page (or &table=2000000166 for your tenant (custom) permissions).

https://businesscentral.dynamics.com/?company=CRONUS%20USA%2C%20Inc.&table=2000000005

With the above information and the power of filtering, we are set to learn who can do that.

Suppose we need to know who has permission to create new items. We would perform the following tasks to get our answer:

1. First run table 2000000005 (Permissions) or table 2000000166 (Tenant Permissions) if you are using custom permissions and filter by:
2. Object Type = TableData
3. Object ID = 27 (Item)
4. Insert = Yes

Note: If you do not used out-of-the-box permissions sets and instead use custom permission sets with a specific prefix – something I always recommend – then you can also add a filter for Role ID. In my case, our custom permission sets all begin with a prefix of MFC, so I can filter by ROLE ID= MFC.

Your result will be a list of all permissions sets that allow INSERT permission for Table 27 (Items). Hopefully, this list only contains one or two permission sets. (My result below has two permission sets, but I know that the first one is obsolete and not assigned to anyone).

Now for each active permission set that we identified (above), we can run the Access Control table (2000000053) and filter by the permission set to see the users who have it assigned.

In the image below, I set a filter for my permission set (ROLE ID = MFC-ITEM CREATE) and my Company Name (MFC-US) since I have a multi-company environment. As a result, I can see a list of ten users who can create new items.

This is a great way to do security reviews or answer questions that come up during an audit. If you know of any other ways to identify who can do that in BC/NAV, please post them to the DynamicsCommunities.com Business Central discussion board.

The post Who Can Do What in Business Central? appeared first on Dynamics Communities.