Required Permissions
Symbol download requires specific permissions to access Business Central's development API. This page explains what permissions are needed and how to obtain them.
Permission Requirements by Environment
Sandbox Environments
Sandbox environments have relaxed security for development purposes.
Minimum Required:
- SUPER permission set, OR
- D365 EXTENSION MGT permission set
Recommended:
- SUPER for full functionality
Production Environments
Production environments require additional permissions for security.
Required:
- SUPER permission set
- PLUS: Snapshot Debugging permission
Why additional permissions? Symbol download uses the same API endpoint as snapshot debugging. Microsoft requires elevated permissions to access this endpoint in production.
SOD's own permission sets are not a substitute. AL_COMPILER_PERM_HGD, OBJECT DESIGNER HGD and REMOTEAL_HGD grant SOD functionality, but none of them grants access to the production development endpoint. Production symbol download needs SUPER + Snapshot Debugging regardless of which SOD permission sets are assigned.
Sandbox and production use different symbol sources. Because production depends on the Microsoft snapshot-debugger endpoint, a production environment is also dependent on that specific service being available. Sandboxes download symbols from a different source — which is why a sandbox can keep working during a Microsoft outage of the production endpoint, and why developing in a sandbox is the standard workaround. See Symbol Troubleshooting.
Understanding the Permissions
SUPER Permission Set
The SUPER permission set provides:
- Full access to all Business Central functionality
- Ability to manage extensions
- Access to development endpoints (in sandbox)
D365 EXTENSION MGT
The D365 EXTENSION MGT permission set provides:
- Ability to install and uninstall extensions
- Access to extension management features
- May be sufficient for sandbox symbol download
Snapshot Debugging Permission
This is an Azure AD / Entra ID role that must be assigned in the Business Central admin center.
What it enables:
- Access to the development endpoint API
- Ability to attach debuggers to production
- Symbol download in production environments
Checking Your Permissions
In Business Central
- Click the Settings gear icon
- Select "My Settings"
- Click "Permissions" in the FactBox
- Review your assigned permission sets
Common Permission Sets
| Permission Set | Symbol Download Access |
|---|---|
| SUPER | Yes (sandbox), Partial (production) |
| D365 EXTENSION MGT | Possibly (sandbox only) |
| D365 BASIC | No |
| D365 BUS FULL ACCESS | No |
Granting Snapshot Debugging Permission
This must be done by a tenant administrator.
Using Business Central Admin Center
- Go to Business Central Admin Center
- Select your environment
- Go to "Users" section
- Find the user who needs access
- Assign the "D365 SNAPSHOT DEBUG" permission
Assign it for all companies
This is the single most common reason the permission "looks assigned but doesn't work". Symbol download can still fail with:
Could not contact dynamics.com, error ({"Message":"You do not have the following permission: Snapshot debugging"})even though the user visibly has the D365 SNAPSHOT DEBUG permission set — because the permission set line has a specific company in the Company field.
Fix: open the user's permission set assignment, find the Snapshot Debugging line, and clear the Company field so the permission applies to all companies (tenant-wide). Then retry.
A step-by-step guide is available at https://hougaard.com/downloading-symbols/.
Using Azure AD / Entra ID
- Go to Azure Portal > Azure Active Directory
- Navigate to Enterprise Applications
- Find "Dynamics 365 Business Central"
- Go to Users and Groups
- Add the user with appropriate role
Who Can Grant This Permission
- Tenant administrators
- Users with Azure AD admin rights
- Delegated admin partners
Permission Verification
Test Symbol Download
The easiest way to verify permissions:
- Open SOD Setup
- Click "Refresh Symbols"
- Complete OAuth2 device-code authentication (open the displayed URL, paste the code)
- If download succeeds, permissions are correct
- If you get an error, check the specific error message
Common Permission Errors
| Error Message | Missing Permission |
|---|---|
| "Access denied" | SUPER or Extension Management |
| "Unauthorized" | OAuth2 authentication issue |
| "Development endpoint not available" | Snapshot Debugging (production) |
| "User does not have permission" | Specific BC permission set |
| "You do not have the following permission: Snapshot debugging" | Snapshot Debugging assigned to a specific company instead of all |
Not every access error is a permission problem. A "You don't have access to this" screen that appears after sign-in completes is usually a Microsoft Entra Conditional Access policy blocking the OAuth2 device-code flow, not a missing permission set. The fix is to allow Device Code login for the Simple Object Designer application in Azure Portal > Enterprise Applications — see Symbol Troubleshooting.
Company-Scoped Permissions
Business Central permissions can be company-scoped or tenant-wide. Symbol download requires tenant-wide scope.
Potential Issue
If SUPER (or Snapshot Debugging) is assigned to your user scoped to a specific company, symbol download fails. A typical symptom is a permission error naming an operation and table, for example a missing IndirectInsert permission on TableData 2000000206 Published Application for one company.
Solution
Change the permission set assignment so the Company field is blank, meaning it applies to all companies. Do this for both SUPER and Snapshot Debugging.
To operate SOD generally, the user should be SUPER with a blank company specified.
Checking Scope
- Go to Users in Business Central
- Select your user
- Verify the assignment shows "(All Companies)" rather than a specific company name
Service Account Considerations
If using a service account for automated processes:
Requirements
- Service account needs same permissions as interactive users
- OAuth2 authentication still required
- Consider dedicated service account for SOD operations
Best Practices
- Document which accounts have SOD permissions
- Review permissions periodically
- Remove permissions when no longer needed
Delegated Admin Permissions
If you're a partner accessing customer environments:
Requirements
- Delegated admin relationship with customer
- Appropriate permissions in the customer tenant
- May need customer to grant additional permissions
Limitations
- Some operations may be restricted
- Customer may need to perform certain actions
- Check with customer's IT for specific requirements
Troubleshooting Permission Issues
Step 1: Verify Basic Access
- Can you log into Business Central normally?
- Can you access Extension Management?
Step 2: Check Permission Sets
- Review your assigned permission sets
- Verify SUPER or equivalent is assigned
Step 3: Check Environment Type
- Sandbox: Usually works with SUPER
- Production: Needs Snapshot Debugging
Step 4: Contact Administrator
If you lack permissions:
- Request SUPER permission set
- Request Snapshot Debugging permission (production)
- Provide justification for the access