Permission sets, along with a user's license type, determine which objects and functionality a user can access within a Business Central environment. Business Central uses five permission types:

• Read
• Insert
• Modify
• Delete
• Execute

The Execute permission is typically used for running reports or background processes. In most situations, users who can modify or delete data also require read and insert permissions. When assigning permissions to an object, you can choose:

• Yes: The user can directly perform the action.
• Indirect: The user can perform the action through another object they have access to.
• Blank: The user has no permission for that object.

Method 1: Create a permission set from scratch

A new permission set can be created by navigating to the Permission Sets page and selecting New. After creating the permission set, permissions must be manually assigned for individual objects such as:

• Tables
• Pages
• Reports
• Codeunits

While this method provides complete control, it is often the most time-consuming option because administrators must know every object and dependency required for a user's tasks. For that reason, creating permissions entirely from scratch is generally not recommended unless there is a specific need for complete customization.

Method 2: Copy and modify an existing permission set

A more practical approach is to start with one of Microsoft's built-in permission sets. For example:

1. Locate a standard permission set such as D365 Accounts Payable.
2. Select Copy Permission Set.
3. Create a cloned version.
4. Modify the copied permission set to fit your organization's requirements.

Microsoft's standard permission sets are designed to include all activities that a typical role might perform. However, every organization operates differently, and some permissions may not be appropriate for all users in that role. After copying a permission set, administrators can remove access to areas that are not needed. For example, if accounts payable users should not access price worksheets, those permissions can be removed from the copied permission set.

Best practice when editing copied permissions

Be careful when removing permissions. Many Business Central processes rely on background objects, tables, and codeunits that users do not directly interact with. Removing too many permissions can lead to unexpected errors when users perform their daily tasks. The copy-and-edit method works best when:

• Only a limited number of permissions need to be removed.
• The standard Microsoft permission set is already close to your desired security model.
• You want a faster setup process without building everything from scratch.

Method 3: Use permission recording

Business Central includes a Permission Recording feature that automatically captures the permissions required to perform specific tasks. This method is especially useful when creating highly targeted permission sets. To use Permission Recording:

1. Create a new permission set.
2. Open the Permissions page.
3. Select Actions > Record Permissions.
4. Start recording.
5. Perform the tasks users need access to.
6. Return to the permission set and stop the recording.
7. Save the recorded permissions.

Business Central will automatically add the permissions required for all actions performed during the recording session.

Example: Creating vendor creation permissions

A practical use case is creating a permission set that allows users to create and maintain vendor records. During recording:

• Create a new vendor.
• Enter vendor information.
• Modify at least one field.
• Perform any ribbon actions users will need.

Simply viewing a vendor record records read permissions. Creating a new vendor record inserts permissions. Modifying a field record modifies permissions.

Important consideration for ribbon actions

If users need access to commands in the ribbon, those actions must be executed during the recording session. Examples include:

• Send approval request
• Create contact
• Merge records
• Create purchase invoice
• Create purchase order
• View statistics
• Modify dimensions

These actions often call additional reports, pages, or background processes that require separate permissions. If they are not included during recording, users may encounter permission errors later.

Why permission recording is so valuable

Permission recording reveals many system dependencies that are not obvious to administrators. For example, creating and editing a vendor may automatically require access to:

• Number series
• Payment terms
• Supporting tables
• Related codeunits

Because of these hidden dependencies, permission recording is often the most efficient way to create granular permission sets. Organizations can use this approach to build specialized permission sets for tasks such as:

• Creating vendors
• Creating customers
• Processing payment journals
• Creating sales orders
• Posting sales orders

These permission sets can then be assigned to specific users or departments as needed.

Using a sandbox environment

If you are concerned about creating test data in production, use a sandbox environment. You can:

1. Create and test permission sets in sandbox.
2. Export the completed permission set.
3. Import it into production.

This approach allows administrators to safely build and validate permissions without impacting live business data.

Exporting and importing permission sets

To move a permission set between environments:

1. Select the permission set.
2. Choose Export Permission Sets.
3. Save the generated XML file.
4. Open the target environment.
5. Select Import Permission Sets.
6. Import the XML file.

This makes it easy to develop permissions in sandbox and deploy them to production when ready.

Key takeaways

Custom permission sets provide precise control over user access in Business Central. The three available approaches are:

• Create from scratch
• Copy and modify an existing permission set
• Use Permission Recording

For most organizations:

• Copying and modifying standard permission sets is the quickest and most practical approach.
• Permission Recording is the best option when highly granular security is needed.
• Sandbox environments provide a safe place to build and test permissions before deploying them to production.

Business Central's flexible permission model allows organizations to tailor security to their exact operational requirements while maintaining strong control over system access.