Microsoft Dynamics 365 Business Central is an enterprise resource planning application for small and mid-sized organisations. It combines finance, purchasing, sales, inventory, and operations management in one cloud or on-premises system, with role-based permissions, audit trails, and integrations to other business applications.
What Microsoft Dynamics 365 Business Central Is Best Used For
Microsoft Dynamics 365 Business Central is an ERP platform, so its security posture starts with business process concentration: finance, purchasing, sales, inventory, and operations are all managed in a shared system with shared data flows. That makes access design, logging, and segregation of duties central to safe use rather than optional add-ons.
Because it is often the system of record for operational transactions, the main security concern is not just protecting one application, but protecting the business decisions and records that move through it. A single misconfigured role, integration, or approval flow can affect multiple departments at once.
For a broader view of SaaS hardening, tenant drift, and audit-driven control design, SaaS Security Guide is useful context.
Access Control, Roles, and Segregation of Duties
Business Central is typically governed through role-based permissions, so the practical question is not whether users have access, but whether they have the right combinations of read, create, approve, and export rights. In ERP systems, excessive access often shows up as a finance or operations issue before it is recognised as a security issue.
Segregation of duties matters because the same actor should not usually be able to initiate, approve, and post a sensitive business action without oversight. That is especially important where purchasing, payment, inventory adjustment, and journal entry workflows intersect.
For organisations that already operate Microsoft 365 controls alongside Business Central, the Microsoft Dynamics 365 and Power Platform Security Guide helps frame how application roles, admin controls, and auditing fit together.
Integrations, Extensions, and Data Exposure
Business Central rarely operates alone. It connects to identity providers, reporting tools, payroll systems, payment services, and other line-of-business applications, which means security depends on how those integrations are scoped and monitored. Every connector extends the trust boundary, and every extension introduces another place where data can be exposed or logic can be altered.
The cloud version also brings shared responsibility issues: Microsoft secures the platform, but the organisation still owns role design, integration permissions, data sharing choices, and review of business-critical settings. In practice, weak governance around connectors and customisations can be as risky as weak user access.
For related coverage of SaaS risk, configuration drift, and access governance, SaaS Security Guide is a strong companion resource.
Auditability, Monitoring, and Operational Resilience
Audit trails are valuable in ERP because they provide evidence for who changed what, when, and through which process. That evidence matters for fraud investigation, compliance review, and recovery after a mistaken or malicious change.
Monitoring should focus on privileged activity, unusual approval patterns, unexpected master-data changes, and integration failures. In an ERP environment, compromise is often detected indirectly, through accounting anomalies, inventory mismatches, or workflow breakage rather than a direct security alert.
Because Business Central often supports core business continuity, resilience also depends on backup, recovery, and tested restore procedures for both application data and connected services. If access or configuration is altered, the organisation needs a way to confirm integrity and rebuild trust in the system.
Risk and Threat Considerations
Business Central concentrates financially meaningful data and transaction authority, so misuse can quickly become fraud, supply-chain disruption, or incorrect reporting. The biggest risks usually come from overprivileged users, weak approval design, exposed integrations, and changes that bypass normal review.
Failure mechanism: An attacker or insider abuses role permissions, connector access, or workflow gaps to change records, approve transactions, extract data, or impersonate legitimate business activity inside the ERP.
Impact: The result can include fraudulent payments, inventory distortion, accounting errors, unauthorized data exposure, and loss of confidence in the integrity of business operations.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5, CIS Controls v8 and CSA Cloud Controls Matrix set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | AC-6 — Least Privilege | Business Central access should be limited to the minimum permissions each role needs. |
| AU-2 — Event Logging | ERP auditability depends on logging key business and administrative actions. | |
| Recommendation — Apply AC-6 to limit Business Central users and service accounts to the minimum required permissions. Configure AU-2 to record material Business Central activities, approvals, and administrative changes. | ||
| CIS Controls v8 | 5 — Account Management | ERP security depends on controlling user, admin, and integrated account lifecycle. |
| Recommendation — Use CIS-5 to manage Business Central accounts, approvals, and removals consistently. | ||
| ISO/IEC 27001:2022 | A.5.15 — Access control | Business Central requires governed access rules for users and integrations. |
| Recommendation — Apply A.5.15 to define and enforce access rules for Business Central roles and integrations. | ||
| CSA Cloud Controls Matrix | IAM — Identity & Access Management | Cloud ERP security depends on identity governance, access provisioning, and privilege control. |
| Recommendation — Use IAM controls to govern Business Central roles, privileged access, and connector permissions. | ||
Practitioner Guidance
Governance implication: Treat Business Central as a high-value business control system, not just an application. Ownership should sit with both security and finance or operations leadership, because the most damaging failures often combine technical misconfiguration with broken business process controls.
What to watch for: Review role assignments, admin permissions, connector scopes, and approval paths whenever the organisation adds a new integration, custom extension, or business unit using the system in a different way.
Related resources from NHI Mgmt Group
- How should security teams implement email DLP in Microsoft 365 without disrupting business workflows?
- How should organisations protect Microsoft 365 users against business email compromise across the full attack chain?
- How should security teams govern AI agents that business users can create and customize across Microsoft 365?
- What happens when external users still have access to shared Microsoft 365 files after their business relationship ends?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 28, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org