Permissions
Advanced Cloud Security includes a permission set that controls access to the app's configuration features. This guide explains what permissions are needed and how to assign them.
Included Permission Set
ACS includes one permission set:
| Permission Set | Purpose |
|---|---|
| ACS EFQ | Complete access to configure and manage all ACS features |
ACS EFQ Permission Set
This permission set provides full administrative access to ACS.
Who Needs This Permission Set
- System administrators
- Security administrators
- Users who define security features
- Users who configure compliance
- Users who assign security to users/groups
Capabilities Granted
| Capability | Access Level |
|---|---|
| ACS Setup | Read/Write |
| Security Features | Create/Modify/Delete |
| Compliance Configuration | Full Access |
| User Security Assignment | Full Access |
| Extension Generation | Execute |
| View Effective Security | Full Access |
Assigning to Users
- Go to Users page
- Select the user who will administer ACS
- Click User Permission Sets
- Add ACS EFQ
End User Permissions
Regular end users do not need a separate ACS permission set. The generated extension uses inherent permissions to evaluate security rules at runtime. As long as the extension is installed, security features are automatically applied to all users who have security feature assignments.
What End Users Need
- Standard Business Central permissions for their role
- Security features assigned to them (directly, via security groups, or via permission sets)
- The generated ACS extension must be installed
Permission Interaction
ACS permissions work alongside standard Business Central permissions:
| User Type | Standard Permissions | ACS Permission |
|---|---|---|
| Regular User | Business permissions | None required |
| ACS Administrator | Business + Admin permissions | ACS EFQ |
Security Feature Permission Requirements
When defining security features that affect certain tables, users viewing those pages need appropriate base permissions. ACS cannot grant access to data — it can only restrict or filter.
Example
If you create a security feature that filters the Customer table:
| User Has | Result |
|---|---|
| No Customer read permission | User cannot see Customer pages at all |
| Customer read permission + ACS filter | User sees only filtered customers |
| Customer read permission, no ACS filter | User sees all customers |
Compliance Permissions
If using the Compliance module, additional considerations apply:
Approvers
Users designated as compliance approvers need:
- Read access to the tables they approve changes for
- Their user must be configured as an approver in the Compliance Approvers page
Requesters
Users making changes to compliance-tracked fields need:
- Normal permissions to modify the data
Troubleshooting Permission Issues
Security Not Being Applied
If security features aren't being applied to a user:
- Check that security features are assigned to the user
- Verify the extension has been generated and installed
- Review Effective Security page for the user
- Refresh the browser (F5 or Ctrl+R)
Cannot Access ACS Setup
If a user cannot configure ACS:
- Verify user has ACS EFQ permission set
- Check license registration status
- Verify user has access to the administration area
Permission Error Messages
| Error | Cause | Solution |
|---|---|---|
| "You do not have permission to read..." | Missing permissions | Verify the user has appropriate BC permissions |
| "You cannot modify setup..." | Missing ACS EFQ | Add ACS EFQ permission set |
| "License not registered..." | No valid license | Register your license |
Best Practices
Permission Assignment Strategy
- Only give ACS EFQ to designated administrators
- Use security groups or permission sets to manage security feature assignments efficiently
- Review permission assignments periodically
Principle of Least Privilege
- Don't give ACS EFQ to users who don't need to configure security
- Regular users don't need any ACS permission set
- Security administrators should have separate accounts if possible