Permissions
This page describes the access users need to configure and operate Certify for Business Central.
What Users Do
The app's day-to-day operations involve:
- Reading and editing the Certify Setup card and related mapping tables.
- Downloading expense reports and lines from Certify.
- Creating lines in a general journal and posting them.
Because the final step writes to a general journal and ultimately the general ledger, the operating user needs the same level of access they would need to enter and post a manual general journal in Business Central.
Recommended Access
| Task | Access needed |
|---|---|
| Configure the app | Read/write on the Certify Setup and mapping tables (provided by the app's objects) |
| Maintain G/L, dimensions, cards | Standard Business Central setup access for G/L accounts, dimensions, and bank accounts |
| Load expense reports | Permission to run the app and make outbound API calls |
| Generate and post journals | Edit and post access to general journals (e.g., the standard journal/posting permission sets) |
Setting Up Users
- Ensure the user has a Business Central license that allows general journal posting.
- Assign the standard permission sets your organization uses for general journal entry and posting.
- Grant access to the app's pages (Certify Setup, Expense Reports, mapping pages). The app's objects are included with the extension.
- Restrict the Certify Setup card (which holds the API key and secret) to administrators, since it contains connection credentials.
Securing the API Credentials
The API key and API secret are stored on the Certify Setup card. Limit who can open and edit this card to protect the credentials. Treat the API secret like a password — it is shown as a masked field on the setup page.