Permissions Setup
This guide explains how to configure user permissions for Advanced Spreadsheets and Reporting.
Permission Set Overview
Advanced Spreadsheets and Reporting includes two permission sets:
- AFR_Hgd, captioned Advanced Spreadsheets and Reporting — the full set. Users can build and use every feature, including regions that write back to the database.
- AFR_READONLY_Hgd, captioned Adv. Spreadsheets - Read Only — the same object access, but the app never writes business data for these users. See Read-Only Users below.
Both sets grant access to:
- All of the app's tables (spreadsheet documents and their parts, indicators, print jobs, library, agent skills, AI report setup, instructions, reports and their permission lists)
- All of the app's pages, codeunits, reports and queries
- The API pages
Individual spreadsheets carry a second, per-document permission layer on top of this set — see Sheet-Level Permissions below.
Assigning the Permission Set
Step 1: Open User Management
- Search for Users in Business Central
- Select the user who needs access to AFR
Step 2: Assign Permission Sets
- On the User Card, go to User Permission Sets
- Click New to add a permission set
- In the Permission Set field, search for and select AFR_Hgd (Advanced Spreadsheets and Reporting)
- Set the Company field if you want to restrict to specific companies
Step 3: Save Changes
The permission set is immediately effective after assignment.
Required Base Permissions
In addition to the AFR_Hgd permission set, users need standard Business Central permissions for:
Financial Reports Access
Users must have permissions to access:
- Row Definitions (Acc. Schedule Names and Lines)
- Column Definitions (Column Layouts)
- Financial Reports
These are covered by the standard Business Central permission sets that include Financial Reports, for example D365 BASIC or D365 BUS FULL ACCESS, as appropriate for the user's role.
Table-Specific Permissions
AFR's permission sets grant access to the app's objects and stored documents. They do not grant all the business-table permissions a sheet or indicator may need. Assign those through the user's Business Central role or a suitable custom permission set, in each company the user needs to access.
| Operation | Business-data permissions needed |
|---|---|
| Read an indicator, region or formula | Read on its source tables and on tables used to calculate FlowFields. For example, an indicator over Sales Line requires Sales Line read access. |
| Edit a table-region field | Read and Modify on the source table, plus permissions required by that field's validation and the table's modification triggers. For example, editing Item Unit Price requires access to modify Item. |
| Edit a budget-matrix amount | Read, Insert and Modify on G/L Budget Entry: the matrix may update one existing entry or insert a delta entry. It also reads G/L Account, G/L Budget Name and the relevant dimension setup and values. |
| Run write operations in formulas or init code | Permissions for the records and operations the code uses, including related-table work performed by validation and triggers. |
| Drill down | Access to the target page and its source/related tables in the selected company. |
Region editing must also be enabled, the sheet's access level must permit the operation, and the AFR read-only restriction below must not block it. Regions reading another company are read-only even if the user has modification rights there.
As a setup check, use a sandbox and a user with the intended role to open the sheet, drill down, modify an allowed table field, and enter a budget amount in a period with no existing entry. That checks both the Modify and Insert paths. Resolve any related-table permission errors according to the validation logic used by your environment and its extensions.
Permission Set Details
The AFR_Hgd permission set grants:
- RIMD (Read, Insert, Modify, Delete) on all 25 of the app's tables — spreadsheet documents, cells, regions, region fields, virtual cells, conditional formats, scenarios, templates, sheet permissions, agent skills, the role-center choice, the indicator tables, print jobs, the indicator library, and the AI report setup, instructions, reports and their permission lists.
- Execute on every object in the app — pages, codeunits, reports and queries, including the API pages.
Read-Only Users
Assign AFR_READONLY_Hgd instead of AFR_Hgd to users who may work with spreadsheets but must never change Business Central data through them. For these users:
- Table regions with Allow Editing switched on render their cells read-only. Edits are ignored and nothing is written to the underlying record.
- Budget matrix regions never write G/L budget entries, whatever the region's editing setting says. The amounts still drill down.
- Formulas and init code run with read-only access in the AL interpreter, so no procedure can insert, modify or delete records.
Everything else works as before: building sheets, saving them, slicers, drill-down, printing, the Spreadsheet Agent and AI reports (which never write business data). The restriction is tied to the permission set, not to the sheet, so it also applies to sheets the user owns.
Business Central permission sets are additive. A user assigned both AFR_Hgd and AFR_READONLY_Hgd has the full rights of AFR_Hgd. The SUPER permission set does not lift the restriction on its own; a SUPER user assigned AFR_READONLY_Hgd (and not AFR_Hgd) is read-only too.
Sheet-Level Permissions
The permission set decides who can use the spreadsheet feature at all; who may open a particular sheet is decided per document. A sheet with no permission rows is open to everyone; once its owner adds rows, only the listed users, security groups or "Everyone" can open it, at one of four levels: Owner, Read Only, Read Only (No Print) or Edit Budget Entries. The model, the resolution rules and a worked example are in Documents & Sharing.
Administrators with SUPER get no implicit content access to restricted sheets, but they do see every sheet in the Spreadsheets list, so an orphaned sheet — one whose owners have left the company — can be deleted or given a new owner: SUPER may edit the permission list of a sheet that has no remaining live owner.
AI Report Permissions
AI report instructions and generated reports carry their own permission lists, like sheets: Owner or Read Only for users, security groups or Everyone. A list is copied from the instruction onto each report when it is generated, and the report's owners can change it afterwards. The AI agent reads data with the Business Central permissions of the user who runs the report. See AI Report Permissions.
Role-Based Permissions
Finance Users
Users who need to:
- View financial reports with indicators
- No configuration access needed
Required Permission Sets:
- Standard financial reports permissions
- Read access to tables used in indicators
Financial Report Designers
Users who need to:
- Create and modify indicators
- Configure print jobs
- Set up the indicator library
Required Permission Sets:
- AFR_Hgd permission set
- Standard financial reports permissions
- Read access to all relevant business tables
System Administrators
Users who need to:
- Manage licensing
- Configure all AFR features
- Manage API access
Required Permission Sets:
- AFR_Hgd permission set
- SUPER or equivalent administrative permissions
API Access Permissions
For users or service accounts accessing AFR through web services:
- The user needs the AFR_Hgd permission set
- Web service access must be enabled for the user
- API endpoints must be published (done automatically by the app)
- The environment must be licensed — the API pages are license-gated
Troubleshooting Permissions
"You do not have permission to..." Error
This indicates missing permissions:
- Check if the user has the AFR_Hgd permission set
- Verify they have access to required base tables
- Check company-level permission restrictions
Indicators Return Zero When They Shouldn't
If indicators return zero unexpectedly:
- Verify the user can access the source table directly
- Check for company-level permission restrictions
- Ensure the user has Read permission on all filtered fields
Cannot Access Print Jobs
If the Print Jobs page is inaccessible:
- Ensure the AFR_Hgd permission set is assigned
- Verify the user has Execute permission on the page
- Check for any conflicting permission sets
Best Practices
- Least Privilege: Only grant permissions users actually need
- Use Groups: Assign permissions through user groups for easier management
- Document Custom Sets: If you create custom permission sets for the app, document what they include
- Regular Review: Periodically review who has access to the app and their permission levels, including sheet-level permissions on shared spreadsheets
- Test After Changes: After modifying permissions, test that users can still perform their required tasks