Advanced Cloud Security Documentation
Index

Action Security

Action security allows you to control the visibility and availability of page actions (buttons, menu items). This extends your security model beyond data fields to include the operations users can perform.

What are Actions?

In Business Central, actions include:

  • Buttons on the action bar
  • Menu items in action menus
  • Promoted actions in the ribbon
  • Navigate actions that open other pages
  • Process actions that perform operations
  • Report actions that run reports

Why Control Actions?

Even if users have permission to access data, you may want to:

  • Prevent posting documents
  • Hide navigation to sensitive pages
  • Remove report options
  • Disable certain operations

Action Control Options

Action controls have a single Setting field with two options:

Setting Effect
Show Action appears and works normally (default)
Disable Action is hidden from the user

Configuring Action Controls

Accessing Action Controls

  1. Open Define Security Features
  2. Select a security feature
  3. In the Action Access part (embedded on the Security Features page), add a new line

Adding Action Controls

  1. Use the assist edit (...) in the Page Name column to select a page
  2. Use the assist edit (...) in the Action Name column to select an action from that page
  3. Set the Setting to Disable to hide the action

Action Control Examples

Example 1: Hide Posting Actions

Prevent posting for certain users:

Page Action Setting
Sales Order Post Disable
Sales Order Post and Print Disable
Sales Order Post Batch Disable
Purchase Order Post Disable

Example 2: Hide Delete Actions

Prevent deletion:

Page Action Setting
Customer List Delete Disable
Vendor List Delete Disable
Item List Delete Disable

Example 3: Hide Navigation

Prevent access to sensitive areas:

Page Action Setting
Customer Card Ledger Entries Disable
Vendor Card Bank Accounts Disable
Role Center Financial Reports Disable

Types of Actions

Standard Actions

Built-in Business Central actions:

  • Post, Post and Print
  • Release, Reopen
  • Delete
  • Navigate, Statistics

Report Actions

Actions that run reports:

  • Print
  • Preview
  • Send to...

Actions that open related pages:

  • Ledger Entries
  • Statistics
  • Dimensions

Process Actions

Actions that perform operations:

  • Calculate
  • Suggest Lines
  • Copy Document

Action Control Precedence

When multiple features control the same action:

User has Feature A: Action visible
User has Feature B: Action hidden
Result: Action is HIDDEN

Most restrictive wins, same as field controls.

Common Action Security Scenarios

Scenario 1: No Posting Permission

Business rule: Only authorized users can post

Implementation:

  1. Create "NO-POSTING" feature
  2. Add all Post actions with Setting = Disable
  3. Assign to users who shouldn't post

Scenario 2: View-Only Role

Business rule: Certain users can only view, not modify

Implementation:

  1. Create "VIEW-ONLY" feature
  2. Add Delete, Post actions with Setting = Disable
  3. Assign to view-only users

Scenario 3: Limited Navigation

Business rule: Restrict access to financial pages

Implementation:

  1. Create "HIDE-FINANCIAL-NAV" feature
  2. Add navigation actions to financial pages with Setting = Disable
  3. Assign to non-financial users

Testing Action Controls

Test Procedure

  1. Assign feature to test user
  2. Log in as test user
  3. Navigate to page with controlled action
  4. Verify action is hidden or disabled

Test Cases

  • Hidden actions don't appear
  • Disabled actions are grayed
  • Keyboard shortcuts don't work for hidden actions
  • Search (Tell Me) doesn't show hidden actions
  • No errors when opening the page

Actions in Different Contexts

Actions promoted to the action bar:

  • Control the base action
  • Promoted version follows base

Action Groups

When hiding an action group:

  • All actions in the group are hidden
  • Or control individual actions

Context-Sensitive Actions

Some actions appear based on context:

  • May already have conditions
  • See conflict fields if applicable

Combining Field and Action Security

Create comprehensive security features:

Feature: JUNIOR-SALES
├── Field Controls
│   ├── Cost fields: Hidden
│   └── Margin fields: Hidden
└── Action Controls
    ├── Post: Hidden
    ├── Delete: Disabled
    └── Approve: Hidden

One feature controls both fields and actions.

User Experience Considerations

User Expectations

When an action has Setting = Disable:

  • The action is hidden from the user
  • No "permission denied" message
  • The user has no indication the action exists
  • This creates a cleaner interface for that user's role

Best Practices

Comprehensive Coverage

Check all pages where action appears:

  • List pages
  • Card pages
  • Role Center
  • Other relevant pages

Example: Posting-related feature

Feature: DISABLE-POSTING
├── Post
├── Post and Print
├── Post and Send
├── Post Batch
└── Preview Posting

Documentation

Record:

  • Which actions are controlled
  • On which pages
  • Rationale for control
  • Who is affected

Testing

  • Test all controlled pages
  • Test keyboard shortcuts
  • Test search functionality
  • Test related actions

Troubleshooting

Action Still Visible

  1. Verify feature is assigned
  2. Check action control settings
  3. Confirm extension was regenerated
  4. Verify correct page is configured

Action Missing for Everyone

  1. Check if this is ACS or base BC behavior
  2. Review feature assignments
  3. Check for overly broad assignments

Keyboard Shortcut Still Works

  1. Hidden actions should also hide shortcuts
  2. If shortcut works, check feature configuration
  3. May need extension regeneration