In this post, we'll break down the technical differences between Licenses (Entitlements) and Permission Sets, and why understanding this distinction is vital for your company's security and compliance.
The First Layer: Licenses (Entitlements)
Microsoft refers to the rights granted by a license as "Entitlements." Think of this as the "outer boundary" of a user's potential. If a user has a specific license, they are technically allowed to access certain modules of the software.
In Business Central, the common license types include:
- Essentials: Access to core modules like Finance, Sales, and Purchasing.
- Premium: Everything in Essentials plus Service Management and Manufacturing.
- Team Members: Limited "read" access and basic task execution (like time entries).
The SaaS vs. On-Premises Logic
Interestingly, the way these licenses behave depends on your environment:
- In the Cloud (SaaS): You automatically gain access to new objects (from extensions), but your license dictates the functional limits.
- On-Premises: You have no access to objects until they are explicitly added to your license file.
The Second Layer: Permission Sets (The "Keys")
While a license determines what you can technically see, Permission Sets determine what you may actually do.
Even if a user has a "Premium" license, you wouldn't want a warehouse worker to have access to the General Ledger or payroll data. This is where Permission Sets come in. They allow you to define granular access at the object level:
- Read: Can they see the data?
- Insert: Can they create new records?
- Modify: Can they edit existing information?
- Delete: Can they remove records?
- Execute: Can they run a specific report or codeunit?
Why "Entitlements" aren't enough
Relying solely on licenses for security creates a scope that is far too broad. If you only managed users via licenses, every Essentials user would effectively be a "Super User" within the modules they are licensed for.
The Risks of Poor Permission Management:
- Security Breaches: Users accessing sensitive financial data they don't need for their job.
- Human Error: An employee accidentally deleting a critical record because they had "Delete" rights they didn't require.
- Compliance Failures: During an IT audit, "over-privileged" users are a major red flag for fraud risk.
Conclusion: Finding the Balance
Effective authorization management in Business Central requires a two-step approach:
- Assign the correct License to ensure the user has the technical capability to perform their role.
- Implement a modular Permission Set structure that limits their access to only the specific tables, pages, and reports they need.
By separating these two concepts, you ensure your organization remains in control, protecting your data while allowing your team to work efficiently.
Want to learn more about how to structure these permissions efficiently? Download our full whitepaper on "Authorizations in Business Central" or explore how our Authorization Box can automate this process for you.
