What a user access review is
A user access review is a periodic check that each user's access still matches their job. A reviewer looks at every user, decides to keep or remove access, and the decision is recorded.
Over time, access drifts: people change roles and keep their old permission sets, and temporary access is not always revoked. A periodic review is the moment to find it and take it away.
Auditors look at it because it shows that access stays under control after it has been granted.
What Business Central gives you for a review
The data for a review is already in Business Central, on these pages:
| What you need | Where in Business Central |
|---|---|
| All users, by status and license type | Users page in analysis mode |
| What one user can actually do | Effective Permissions |
| Which users hold a permission set | Permission Set by User |
| Which security groups hold a permission set | Permission Set by Security Group |
| Who is in a security group | Security Groups page, Members FactBox |
The Effective Permissions page shows the source of each permission, for example whether it comes through a security group. You can view other users' effective permissions only if you hold SECURITY or SUPER.
For the permission APIs that came with Update 28.2, see our article on what native visibility still can't do.
Where it stops
- There is no place to record that access was reviewed, by whom, and what they concluded.
- Effective Permissions shows a user's access but does not compare it with conflict rules.
- Security group members show in Business Central only if they're added as users there. The group itself is created in Microsoft Entra or Windows Active Directory, not in Business Central.
How to run a user access review in Business Central
1. Set the scope and the rhythm
Review every enabled user, plus the security groups that carry permission sets. The SOX compliance page recommends an analysis every quarter, and after major changes to roles.
Include accounts that are not people. Business Central agents, such as the Sales Order Agent, have a user account with their own permission sets.
2. Pull the population
Open the Users page and turn on analysis mode. Group by status and license type, as Microsoft's own example does, so you see enabled and disabled users side by side.
Then list the permission sets per user on the Permission Set by User page, and the sets per group on the Permission Set by Security Group page.
3. Show reviewers what access means
A list of permission set names tells a reviewer little about what a user can actually do. Give reviewers the effective permissions, or at least the critical ones, instead of a list of set names.
4. Start with critical permissions
Begin with the access an auditor asks about first, such as who can approve payments or change vendors.
Then check for combinations that break segregation of duties. Our guide to segregation of duties in Business Central shows how to build the conflict matrix.
5. Record each decision
For every user or finding, record the reviewer, the date, the decision and the reason. Accepted risks need a reason too.
Business Central has no field for this, so the record lives elsewhere. Keep it in one place you can show the auditor.
6. Remove access and check it
To take away all access in Business Central online, set the Status field on the User Card to Disabled. The user can't sign in and active sessions stop, while references to the user stay. You can also remove the license in the Microsoft 365 admin center.
For a partial change, remove the permission set from the user or from the security group. Then open Effective Permissions again to confirm the change took effect.
Not sure whether to disable or delete? Our article on deactivating or deleting users explains the difference.
User access review checklist for Business Central
- Scope agreed: enabled users, security groups and agent accounts
- Users page exported or analyzed by status and license type
- Permission sets per user and per security group listed
- Reviewers see effective permissions, not only set names
- Critical permissions and SoD conflicts reviewed first
- Each decision recorded with reviewer, date and reason
- Removed access checked again in Effective Permissions
- Evidence stored for the auditor
The SOX compliance page lists the evidence auditors ask for, question by question.
How 2-Controlware supports the review
Authorization Box
Authorization Box analyzes critical permissions per user, role and permission set, and finds SoD conflicts. You mark each result Agreed or Disagreed, with comments, review history and an Excel export.
Permissions are managed through organization roles, with an optional approval step on each request. Each request then shows who approved it.
The Continuous Monitoring module sends alerts when someone gains access to a critical permission, straight away or on a schedule, so you hear about such a change before the next review.
Advanced Permissions Management
Advanced Permissions Management logs every change to permission sets, including changes from app updates. You review those changes per period and mark each one Reviewed or Flagged.
