The “soft security” trap: why your Role Center isn’t a shield

What is soft security?

Soft security is using the interface to restrict access. When an administrator assigns a profile such as Sales Order Processor or Purchasing Agent, the workspace is tailored for that job: a focused Role Center, trimmed actions, hidden fields. That is great for productivity.

Microsoft is clear about the split. Profiles and page customizations define the workspace. Permissions define the features users can access. Business Central has three UI layers that sit on top of the permission system and work independently from it:

• Profiles (roles) set the Role Center and page layouts for a group of users.
• Customizations change pages for everyone with a profile.
• Personalizations are changes a user makes to their own workspace, and they apply whichever role the user switches to.

None of these three stops a user from opening an object their permissions allow.

3 ways users bypass soft security

1. Tell Me search

The search bar (Alt+Q) is the most common bypass. Tell Me lists pages and reports that are made searchable in code, not only the ones on the user’s Role Center. The Explore pages and reports action even shows features for all roles. If the page is searchable and the permissions allow it, the user can open it.

2. URL manipulation

The Business Central web client opens pages, reports and tables straight from the URL. Adding page= with a page ID to the address opens that page, no menu needed. Anyone who knows or guesses an ID can navigate there directly.

3. Personalization and Designer

Users can personalize pages and bring back fields and actions that a profile customization hid. Administrators can set Disable personalization on a profile, and Designer is only available to users with the EXTEN. MGT. - ADMIN permission set. Both are good hygiene, but they still only change the screen. Microsoft even notes that the lock editing option on customized pages is meant for data accuracy and consistency, not to secure data integrity.

Why you need hard security

Permission sets work at the object level. Every time a user tries to read, insert, modify, delete or execute an object, Business Central checks the assigned permissions. That check happens regardless of what the screen shows, which is exactly why it is the real control.

Business Central adds record-level control through security filters. A security filter limits which records in a table a user can access, for example only one customer or one department’s data.

Below that, standard permission sets do not go down to a single field or a single action on a page. That is the gap 2-Controlware’s Compliance Apps fill:

• Field Security makes fields non-editable for users with linked permission sets, with a “Default Editable” allow-list mode.
• Filter Security applies record filters of type Editable or Visible. Visible actually hides the lines, rather than just removing a page from the menu.
• Action Security blocks actions such as Post or Release.

This is what people often want to achieve with profiles: “this user may see the vendor card but not change the bank account”, or “this user may prepare but not post”. A profile can hide the button. Action Security and Field Security stop the action itself.

Check what users can really do

Because profiles make things look safe, check the actual permissions. The Effective Permissions page shows where each permission comes from, including security groups and security filters. Since BC28, the Permissions Overview page (public preview since March 2026) gives an overview of permission sets, security groups and assignments across apps. Use these views, not the Role Center, to answer the question “who can do what”.

The best of both worlds

Profiles and permission sets are not competitors. They do different jobs:

1. Start with permissions. Define what each role must be able to do, and nothing more.
2. Add field, filter and action rules where object-level permissions are too coarse.
3. Then design the profile so the workspace is clean and intuitive for that role.

In that order, the profile makes the user fast and the permissions keep the user within bounds.

Conclusion

Think of a profile as a curtain and permission sets as a locked door. A curtain may hide what is behind it, but it will not stop anyone from walking through. If you want a real shield, lock the door first, then hang the curtain.