Permission Errors

When BCCL runs a task and Business Central replies Sorry, the current permissions prevented the action, the problem is a Business Central table-level permission, not BCCL configuration or authentication. This page explains how to read the error, where the permissions actually live when BCCL authenticates as a Microsoft Entra application, and the exact steps that resolve it.

Symptom

The command fails with an error of one of these forms:

An error has occurred: Sorry, the current permissions prevented the action. (TableData <object id> <table name> IndirectRead: BCCL)

An error has occurred: Sorry, the current permissions prevented the action. (TableData 10000700 LSC Retail Setup Retail Setup Read: LS Central)

Reading the Message

The text inside the parentheses tells you exactly what was blocked:

Part	Meaning
`TableData`	The permission type. The action was a table data access.
`<object id>`	The object ID of the table that could not be read (for example `10000700`).
`<table name>`	The name of that table (for example `LSC Retail Setup`).
`Read` / `IndirectRead`	The kind of access that was denied.
Trailing app name	The app involved. `BCCL` means BCCL Subscription attempted the read; a name such as `LS Central` identifies the app that owns the table.

Always read the table number and object name from the parentheses. It identifies the exact table permission that is missing, which is what you need to assign.

Cause

The error is a Business Central table-level permission problem.

When BCCL runs with --auth S2S, all data access happens under the Microsoft Entra application registration, not under a named user. The effective permissions are the permission sets assigned to that application on the Microsoft Entra Applications page inside Business Central (named Azure Active Directory Applications in older versions).

If the permission sets on that application do not cover the table named in the error, the read is refused even though authentication succeeded.

This is a permission configuration issue in the customer's Business Central environment. It is not a BCCL configuration problem and not an authentication problem. The same script and the same S2S credentials work once the permission set has been added.

When It Appears

A getdata run that has worked for a long time can start failing after the environment changes, for example when an extension such as LS Central is installed or updated. The Entra application then lacks permissions for tables introduced or touched by that extension.
The error can surface even when the command targets standard or system tables, for example table 17 G/L Entry or virtual tables such as 2000000120 Users, 2000000053 Access Control, and 2000000254 Expanded Permission. In the LS Central case, the read was blocked by a missing permission on an LS Central table (10000700 LSC Retail Setup), even though the command was not reading that table directly. The parentheses in the error tell you which table permission is actually missing.

Resolution

The permissions that must be changed are the permissions on the Entra application inside Business Central. They are not the permissions of the Azure/Entra App Registration, and not (in this scenario) the end user's own permission sets.

When the table named in the error belongs to another app (an ISV or third-party app), the permission set published by that app must be added to the Entra application in Business Central. This is exactly what resolved the reported cases.

Steps

Identify the owning app. Read the table name and object ID from the error message. The object name normally carries the owning app's naming affix (for example LSC for LS Central). You can also look the object ID up in All Objects with Caption.
Open the Microsoft Entra Applications page. In Business Central (version 28 naming), search for and open Microsoft Entra Applications. In older versions the page is called Azure Active Directory Applications.
Select the Entra application record used by BCCL Subscription.
Check the permission set lines on that Entra application for a permission set from the owning app. Filtering the permission sets for the object ID is a quick way to see whether it is covered. In the reported case, it was missing.
Add a new permission set line on the Entra application and select the permission set published by the app that owns the table. Do not edit or extend the existing permission sets; the guidance is to add the missing app's permission set as an additional line.
Re-run the action that failed.

Repeat this for every app whose tables BCCL needs to read. Each additional ISV app in the environment can require its own permission set to be added to the Entra application.

Known Permission Sets

Situation	Permission set to add
Tables owned by LS Central (for example `LSC Retail Setup`)	`LSCentralPermissions` (confirmed to resolve the error)
Any table, when a targeted permission set cannot be identified	`SUPER (Data)` as a last resort / worst case

Who Can Make the Change

The permission set change must be made by someone with rights to edit Microsoft Entra Applications in the target Business Central environment. This is typically the customer's Business Central administrator or their partner. If you configure BCCL on behalf of a customer without access to their Business Central, forward the steps above to them.

What This Error Is Not

The following actions are common misdiagnoses. They do not fix this error:

Changing API/Graph permissions or consent on the Entra App Registration in the Microsoft Entra admin center. The App Registration governs authentication, not Business Central table access.
Editing the end user's permission sets under Users → Permission Sets. When the failing call is made by the Entra application, the user's own permission sets are not consulted. The permission sets that matter are the ones assigned to the Entra application on the Microsoft Entra Applications page in Business Central.
Modifying an existing permission set. The correct fix is to add the missing app's permission set as an additional line on the Entra application, not to change the contents of a permission set that is already there.

Authentication Versus Authorization

Registering the Entra app and storing its credentials with --remember only establishes authentication: BCCL can prove who it is. Authorization is separate: the app must be granted permission sets on the Microsoft Entra Applications page in Business Central for every table BCCL will read or write.

If permission sets are missing or incomplete, BCCL commands fail at runtime with:

Sorry, the current permissions prevented the action. (TableData <table no.> <object name> Read: <extension/app name>)

even though authentication succeeded. Add-on and vertical solutions require their own permission sets; LS Central, for example, requires LSCentralPermissions.

Checklist

Read the table number and object name in the parentheses of the error.
Determine which app owns that table.
Open Microsoft Entra Applications in Business Central and select the BCCL application.
Add the owning app's permission set as a new line (or SUPER (Data) as a last resort).
Re-run the BCCL command with the same script and credentials.
If another table from a different app is now reported, repeat from step 1.