Advanced Cloud Security Documentation
Index

Assign Security to Permission Sets

Permission Set assignment allows you to link security features to Business Central permission sets. Users with those permission sets automatically receive the associated security features.

What is Permission Set Assignment?

Permission Set assignment connects:

  • ACS Security Features (field/action/data security)
  • BC Permission Sets (table/object access rights)

When a user has a permission set, they also get its linked security features.

Accessing Permission Set Assignment

  1. Open Advanced Cloud Security from the Tell Me search
  2. Click Assign Security to Permission Sets in the Assign Security column
  3. The Permission Set and Permissions page opens

Understanding the Page

The page shows:

  • Left side: List of Business Central permission sets
  • Right side: Security features assigned to the selected permission set

How It Works

User Has Permission Set "SALES"
           ↓
ACS checks: What features are linked to "SALES"?
           ↓
Finds: SALES-FILTER, HIDE-COST
           ↓
Features are applied to user

Assigning Features to Permission Sets

Basic Assignment

  1. Select a permission set from the list
  2. In the security features panel, click New
  3. Select a security feature from the lookup
  4. The feature is linked to the permission set

Assigning Multiple Features

  1. Click Add Features action
  2. Check multiple features to assign
  3. Click OK
  4. All features are linked to the permission set

Why Use Permission Set Assignment?

Logical Grouping

Permission sets already define what a user can do. ACS features can define what they can see/edit:

Permission Set BC Permissions ACS Features
SALES Read Customer, Sales Order SALES-FILTER, HIDE-COST
PURCHASING Read/Write Purchase Order PURCHASE-FILTER
FINANCE-VIEW Read G/L entries READ-ONLY-GL

Automatic Application

  • User gets permission set → gets ACS features
  • Permission set removed → ACS features removed
  • No separate assignment needed

Alignment with BC Model

  • Works with your existing permission strategy
  • Extends permissions with field-level control
  • Familiar management approach

Managing Permission Set Assignments

Removing an Assignment

  1. Select the linked feature
  2. Click Delete
  3. Confirm the removal

Users with this permission set lose the feature.

Temporarily Disabling

  1. Select the linked feature
  2. Uncheck Active
  3. Feature is disabled for permission set holders

Permission Set Assignment Examples

Example 1: Sales Permission Sets

Permission Set Security Feature Purpose
SALES-BASE HIDE-COST No cost visibility
SALES-BASE SALES-DATA-FILTER See own customers
SALES-MANAGER SALES-ALL-CUSTOMERS See all customers

Example 2: Financial Permission Sets

Permission Set Security Feature Purpose
GL-VIEW READ-ONLY-GL Can't modify GL
GL-POST GL-FULL-ACCESS Can post to GL
AR-CLERK AR-ONLY-FILTER See only AR data

Example 3: Warehouse Permission Sets

Permission Set Security Feature Purpose
WHSE-BASIC LOCATION-FILTER See assigned location
WHSE-SUPER ALL-LOCATIONS See all locations

Multiple Permission Sets

Users often have multiple permission sets:

User Permission Sets ACS Features (from PS)
JOHN SALES-BASE, ITEM-VIEW HIDE-COST, SALES-FILTER, ITEM-FILTER

All features from all permission sets are applied.

Combining Assignment Methods

Permission set assignment combines with other methods:

Source Features
Permission Set HIDE-COST
Security Group REGION-FILTER
Direct User SPECIAL-ACCESS

User gets all: HIDE-COST + REGION-FILTER + SPECIAL-ACCESS

System vs. User Permission Sets

Both types can have ACS features linked:

Type Example Can Link ACS?
System D365 BASIC Yes
User-created COMPANY-SALES Yes

However, consider:

  • System permission sets may change with BC updates
  • User-created sets are under your control
  • Document your assignments carefully

Permission Set Versions

Be aware of permission set versioning:

Scenario Impact
BC updates system permission set Assignments remain
You copy/modify a permission set Need to reassign features
Permission set renamed Assignments may break

Best Practices

Align Logically

Link features that make sense together:

  • ✓ SALES permission set → SALES-FILTER feature
  • ✓ FINANCE-VIEW → READ-ONLY-GL feature
  • ✗ SALES permission set → WAREHOUSE-FILTER feature

Document Assignments

Keep records of:

  • Which features link to which permission sets
  • Rationale for each link
  • Impact if permission set is modified

Consider User Permission Sets

Prefer linking to user-created permission sets:

  • More stable than system permission sets
  • Under your control
  • Can be designed with ACS in mind

Review After BC Updates

After Business Central updates:

  1. Check if system permission sets changed
  2. Verify ACS links still appropriate
  3. Update assignments if needed

Troubleshooting

Features Not Applied

  1. Verify user has the permission set
  2. Check the link is Active
  3. Verify the generated extension is installed
  4. Check effective security for sources

Too Many Features

  1. User may have many permission sets
  2. Check all linked features
  3. Consider consolidation

Permission Set Not Listed

  1. Verify permission set exists
  2. Check your permissions to view
  3. Refresh the page

Special Considerations

SUPER Users

Users with SUPER permission set:

  • Still have ACS features evaluated
  • ACS can restrict even SUPER users
  • Field-level security applies regardless

Permission Set Groups

If using permission set groups:

  • Link features to individual permission sets
  • Not to the group itself
  • Features apply when any set in group is assigned