SaaS (The Cloud): Entitlements Set the Ceiling
In a Business Central SaaS environment, Microsoft manages the infrastructure, and the classic license file no longer exists. Instead, access is governed by entitlements: permissions that are generated automatically based on the license a user has purchased (Essentials, Premium, Team Member) or the Microsoft Entra role assigned to them.
- Automatic object access. When you install an app or when Microsoft pushes an update, the new objects (tables, pages, reports) are technically available in your environment right away. There is no license file to update and no objects to renumber. The system handles the technical plumbing.
- The entitlement ceiling. Your entitlement defines the maximum a user can ever access. The permissions a user actually has are the intersection of their entitlement and the permission sets assigned to them, and the entitlement always wins. A user with a Team Member license who is accidentally granted SUPER permissions is still limited to the objects covered by the Team Member entitlement.
- The admin benefit. You never manually update a license file when adding an app from AppSource. Subscriptions and additional users are available immediately after purchase. Your job is to assign the right permission sets, not to manage the license plumbing.
On-Premises: The License File Defines What Exists
In an on-premises environment, the logic is reversed: your license file (.bclicense, or the legacy .flf format that Microsoft removed in 2023 release wave 1) contains the specific object ranges you are allowed to use.
- Manual license updates. If you add a new ISV solution or purchase additional custom objects, those objects remain locked until an updated license file is imported into the database. And a license import is not the end of it: all Business Central Server instances must be restarted before the new license takes effect for users.
- Hard blocks. If an object is not in your license, the system refuses to run it. Users see a permission error before any functional permission set is even evaluated. This is a technical barrier rather than a functional one.
- The admin burden. Administrators must be proactive around major upgrades and new modules. The license file has to stay in sync with the objects in the database, which requires coordination between your partner, the license, and the deployment.
Why Does This Distinction Matter?
Whether you are in the cloud or on your own servers, these differences impact your daily operations in three ways:
- Troubleshooting. In on-prem, a permission error can mean the object simply is not in the license file. In SaaS, the blocker can sit at two levels: the entitlement (the user's license type does not cover the object) or the assigned permission sets. The Effective Permissions page on the User card shows exactly how entitlements and permission sets combine for a specific user, which makes it the first place to look.
- Upgrades. SaaS updates are seamless from a licensing perspective. On-prem upgrades require careful coordination between the software version and the license file, plus a server restart after every license import.
- Third-party apps. SaaS users can genuinely plug and play: install from AppSource, assign permission sets, done. On-premises the difference is bigger than most people realize. AppSource apps cannot be installed on-prem through the Extension Management page at all. Your partner has to deploy the solution manually and make sure the license file covers the new object ranges before anyone can use it.
One Constant: The Permission Set
Despite these differences at the license level, both environments still rely on permission sets to define what a user can do. Whether the ceiling is set by an entitlement (SaaS) or a license file (on-prem), you still need to decide who gets a key to which room. That decision, and keeping it auditable, is where most of the real security work happens.
At 2-Controlware, our solutions like the Authorization Box are designed to bridge this gap, providing a consistent management experience regardless of where your Business Central environment lives.
Moving from on-prem to SaaS and worried about your permission structure? Check out our "Is your Dynamics application fraud proof?" checklist to ensure your transition is secure.
