Overview
Advanced Cloud Security +Compliance (ACS) is a powerful security and compliance solution for Microsoft Dynamics 365 Business Central that provides field-level and data-level security beyond what is available with standard permission sets.
What is Advanced Cloud Security?
Business Central's built-in security model allows you to control which tables and objects users can access. However, it does not provide granular control over individual fields or data filtering within tables. Advanced Cloud Security fills this gap by enabling you to:
- Hide sensitive fields from users who should not see them
- Make fields read-only for users who should see but not modify data
- Filter data so users only see records relevant to their role
- Control actions by hiding or disabling buttons and menu items
- Track changes to sensitive fields with approval workflows
Why Use Advanced Cloud Security?
Many organizations need more granular security than Business Central provides out of the box:
| Business Need | ACS Solution |
|---|---|
| Hide salary information from non-HR users | Field visibility control |
| Restrict cost prices to purchasing staff | Field-level security |
| Show salespeople only their own customers | Data-level filters |
| Require approval for vendor bank changes | Compliance module |
| Audit trail for sensitive field changes | Change tracking and logging |
How It Works
ACS operates in three phases:
- Build Phase - Define what you want to secure (fields, actions, data filters) and generate an extension
- Configure Compliance - Set up approval workflows and compliance rules
- Assign Security - Apply security features to users, groups, or permission sets
The security is enforced at runtime through a dynamically generated extension that modifies page behavior based on the assigned security features.
Key Concepts
Security Features
A Security Feature is a named collection of security settings that can be assigned to users. For example, you might create:
- "Hide Cost Prices" - Hides cost-related fields
- "Sales Team Europe" - Filters customers to European region
- "Read-Only Posting" - Makes posting fields non-editable
Compliance
The Compliance module tracks changes to designated fields and can require approval before changes take effect. This is ideal for:
- Vendor bank account changes
- Customer credit limits
- Employee sensitive data
Extension Generation
Because Business Central runs in the cloud, ACS must generate an extension at design time that implements your security rules. Whenever you add new fields or change security definitions, you must regenerate this extension.