Dynamics 365 Business Central Security: Control permissions, apps, partners and audit evidence

Business Central runs the general ledger, payments, vendors and inventory for many small and mid-sized organisations, so a broad permission set, an over-scoped API application or an always-on partner relationship can move money or expose financial data. Business Central online signs users in through Microsoft Entra ID, but what they can do inside an environment is governed by its own permission system: licence entitlements, permission sets, security groups and security filters. This guide explains that model, how to control administrators and partner delegated administrators, how to set up Microsoft Entra applications for service-to-service API access with least privilege, what the change log, field monitoring and telemetry record, and a hardening baseline. It is written for Business Central administrators, partners and finance system owners, and the identity and security teams who review them. Dataverse-based Dynamics 365 apps are covered separately in the Microsoft Dynamics 365 and Power Platform Security Guide.

This is an independent guide from NHI Mgmt Group, based on Microsoft's public documentation as of November 2026. It is not sponsored or reviewed by Microsoft. Product features change, so confirm settings against Microsoft's current documentation.

Key takeaways

• Two gates, two owners. Microsoft Entra ID decides who can sign in and how strongly; Business Central permission sets decide what they can touch. Configure MFA in Entra and least privilege in Business Central.
• SUPER belongs to very few people. Microsoft's guidance is to remove SUPER from everyone except the first user and administrators; build role permission sets instead and use exclusions to subtract access.
• API applications are users without MFA. Service-to-service apps use the client credentials flow, so their safety depends on the Entra credential, the Business Central permission sets assigned on the Microsoft Entra application card and the State field.
• Partner access is open by default. Environments allow all partners with tenant-level access unless an internal global administrator restricts the Partner access setting to named partner tenants.
• Turn on the evidence before you need it. The change log, field monitoring and environment telemetry to Application Insights are opt-in, and they are where permission changes and edits to bank details show up.

How identity and access work in Business Central

A Business Central online tenant contains environments, and each environment contains companies. Users are Entra identities added to Business Central according to their licence. Access is the combination of several layers:

Designing permission sets

• Compose from system sets: add Microsoft's system permission sets into your own; when you do, your set picks up Microsoft's later changes to those permissions automatically.
• Subtract with Exclude: an excluded permission wins over an included one. Use Exclude to remove an access level, or Reduce to indirect so users can change an object only through a process such as posting, not directly.
• Use indirect permissions for ledgers: Microsoft's example is posting a sales document through codeunit 80 Sales-Post, which modifies Sales Line without giving users direct write access.
• Guard the permission tables: Microsoft cautions against granting insert or modify on table 9001 User Group Member or 9003 User Group Permission Set, because holders could add themselves to more powerful groups.
• Prefer security groups: link Entra groups on the Security Groups page and assign permission sets to the group, so joiners, movers and leavers follow Entra group membership.

Segregation of duties matters in an ERP: the person who creates a vendor or changes its bank account should not be the person who approves or posts the payment. Express that in separate permission sets and approval workflows.

Admin roles and privileged access

Privilege in Business Central comes from three directions.

• Entra administrator roles: internal administrators (Microsoft recommends Dynamics 365 Business Central Administrator as the least-privileged role; Dynamics 365 Administrator and Global Administrator are also supported) manage environments in the Business Central admin center and are exempt from environment security groups. Keep these roles few, protected by phishing-resistant MFA, and eligible through just-in-time activation in Microsoft Entra Privileged Identity Management, which requires additional licences.
• SUPER permission set: full rights inside an environment. Microsoft assigns it to the first user and advises removing it from everyone else except administrators. Tasks such as Update Users from Microsoft 365 require it, so time-box SUPER for those tasks rather than leaving it standing.
• Delegated administrators: reselling partners administer customers through granular delegated admin privileges (GDAP). Microsoft names Dynamics 365 Business Central Administrator as the recommended least-privileged role for this relationship.

Controlling partner access

1. Restrict per environment: in the admin center, an internal global administrator opens Partner access for each environment and turns off Allow access to all partner tenants, then allows named partners. Up to 10 Entra tenants can be allowlisted per environment, and the change takes effect immediately.
2. Prefer short-lived GDAP: Microsoft suggests accepting short-lived relationships that do not auto-extend when a partner has a temporary need.
3. Limit what new delegated users receive: remove permissions from the licence configuration for delegated administrators, so new partner users do not automatically gain them on first sign-in, and disable individual delegated admin users when they are no longer needed.
4. Clean up on change: when a GDAP relationship ends or you switch partners, remove the settings the previous partner configured in the admin center.

Delegated administrators cannot run job queue entries themselves (they can prepare them and test with Run once (foreground)), which keeps scheduled execution under the customer's licensed users. For the wider model, see the GDAP and MSP Delegated Admin Access Guide.

Integrations, API tokens and service accounts

Unattended integrations use service-to-service (S2S) authentication with the OAuth 2.0 client credentials flow. Microsoft documents S2S for automation APIs, APIs v1.0 and v2.0, custom APIs and web services. Setup has two halves.

• Least privilege inside Business Central: the Entra permission API.ReadWrite.All only opens the door; the permission sets on the application card decide which tables and pages the app can read or write. Build an integration-specific set rather than using D365 AUTOMATION or EXTEN. MGT. - ADMIN for everyday integrations.
• Use the State field: set an application's State to Disabled to stop it immediately without deleting its configuration, which is useful when rotating credentials or investigating unusual activity.
• Protect the credential, not a user sign-in: delegated flows can require MFA, but client credentials authenticate the application alone, so credential hygiene and Entra workload identity controls carry the weight. See the Azure Entra Client Secrets Security Guide and Entra ID Applications and Consent Guide.
• Track partner applications: Microsoft advises putting partner-identifying information in the Description so all applications set up by a partner can be found later.
• Restrict multitenant apps per environment: the Partner access setting also governs multitenant applications that are not homed in your tenant.

For the inventory and ownership side of these identities, see the Service Account Security Guide.

Logging and detection

Change log

The change log records direct modifications to data in the tables and fields you choose on the Change Log Setup page (Tables action). Microsoft advises choosing Some Fields rather than All Fields, prioritising fields such as Created By and Created Date, and avoiding ledger entries and posted documents for performance and storage reasons. Turning the log on or off is itself logged. Entries appear on Change Log Entries after the user's session restarts, the log is paused during version upgrades, and retention policies control deletion. Track at least vendor and customer bank accounts, payment methods, user setup and permission tables.

Field monitoring

The Monitor Field Change Setup assisted setup monitors sensitive fields, selectable by data sensitivity classification, and can email a notification when a value changes. Notifications must come from a Microsoft 365 or SMTP account that is not tied to a real user. The Monitored Fields Worksheet sets per-field behaviour. This is the most direct control against payment diversion through altered bank details.

Telemetry

Environment-level telemetry sends operational signals to an Azure Application Insights resource you own, where they land in the traces and pageViews tables for KQL queries and alerts. Configure the Application Insights connection string for each production environment.

Pair Business Central telemetry with Entra sign-in and audit logs for the authentication side; see the Entra ID Sign-In and Audit Log Detection Guide.

Metrics: users holding SUPER (target: administrators only); Microsoft Entra applications with an owner in the Description and a credential expiry under 12 months; environments with Partner access limited to named tenants; production environments sending telemetry; monitored sensitive fields covering all bank and payment fields; and time from a permission-change event to review.

Hardening baseline

1. Secure sign-in in Entra: Microsoft recommends a baseline Conditional Access policy requiring MFA for all users and all resources, which covers Business Central; add phishing-resistant authentication strength for administrators. See the Conditional Access Guide.
2. Gate environments: assign an Entra security group to each environment so only intended users reach production and sandboxes.
3. Inventory privilege: list SUPER holders, Entra administrators, GDAP relationships, Partner access settings and every Microsoft Entra application with its permission sets.
4. Rebuild roles: create role permission sets from system sets with exclusions, assign them through security groups and remove SUPER from non-administrators. Test each role in a sandbox copy before production.
5. Tighten partners: limit Partner access to named partner tenants, prefer short-lived GDAP and trim delegated admin licence permissions.
6. Fix integrations: one Entra app per integration, certificate credentials, integration-specific permission sets and owner details in the Description.
7. Switch on evidence: enable the change log for key tables, field monitoring for bank and payment fields, and environment telemetry with alerts on the events above.
8. Roll back safely: keep the previous permission set assignments exported before changes; restoring a user's previous sets or re-enabling an application's State reverses most access changes quickly.

Small and large organisations

A small business with a partner-managed tenant should focus on MFA, removing SUPER, Partner access limits and field monitoring of bank details. A larger group with several environments and companies should add environment security groups, security filters by company or dimension, telemetry into a central workspace and formal segregation of duties reviews each quarter.

Common misconfigurations

• SUPER for everyone from onboarding: left in place after the first users were set up. Replace with role sets and keep SUPER for administrators.
• Permission tables writable: insert or modify on tables 9001 or 9003 granted in a custom set, allowing self-escalation. Remove those rights.
• Integration apps with broad sets: D365 AUTOMATION or similar broad sets on a reporting integration that only reads. Build a read-focused set.
• Long-lived client secrets: secrets with long durations stored in scripts. Use certificates or short-lived secrets in a vault.
• Partner access left at default: every partner with tenant-level access can reach every environment. Allowlist named partners only.
• Bank detail edits unmonitored: no field monitoring on vendor bank accounts. Turn on the Monitor Field Change Setup for those fields.

Framework mapping

Practitioner checklist

• Require MFA through Conditional Access for all Business Central users, phishing-resistant for administrators.
• Remove SUPER from everyone except the first user and named administrators.
• Assign role permission sets through Entra-linked security groups, using exclusions and indirect permissions.
• Check that no custom set grants insert or modify on tables 9001 and 9003.
• Restrict Partner access on each environment to named partner tenants and prefer short-lived GDAP.
• Give each S2S integration its own Entra app, certificate credential and minimal permission sets, with the owner in the Description.
• Enable the change log and field monitoring for bank, payment and permission data.
• Send environment telemetry to Application Insights and alert on permission and sensitive field events.
• Review SUPER holders, applications and partner access every quarter.

Standards and references

• Microsoft Learn: Assign permissions to users and groups
• Microsoft Learn: Control access to Business Central using security groups
• Microsoft Learn: Using service-to-service (S2S) authentication
• Microsoft Learn: Delegated administrator access to Business Central Online
• Microsoft Learn: Manage Access to Environments
• Microsoft Learn: Audit changes
• Microsoft Learn: Monitoring and analyzing telemetry
• Microsoft Learn: Business Central tenant administration
• Microsoft Learn: Require MFA for all users with Conditional Access
• Microsoft Learn: What is Privileged Identity Management?
• NIST: SP 800-53 Rev. 5

Related NHI Mgmt Group resources: Microsoft Dynamics 365 and Power Platform Security Guide · Entra ID Security Guide · GDAP and MSP Delegated Admin Access Guide · Non-Human Identity (NHI) Guide