Permission Sets
This page provides reference information about the permission sets included with the SharePoint Connector.
AL Permission Set
SP Conn. User EFQ
| Property | Value |
|---|---|
| ID | 70319475 |
| Name | SP Conn. User EFQ |
| Caption | SharePoint Connector User |
| Assignable | true |
This is the single comprehensive permission set that provides access to all SharePoint Connector functionality, including setup, signing, file operations, incoming documents, printing, templates, and more.
Legacy XML Permission Set
SHAREPOINT CONNECTOR
| Property | Value |
|---|---|
| RoleID | SHAREPOINT CONNECTOR |
| RoleName | SharePoint Connector |
This is a legacy permission set defined in extensionsPermissionSet.xml. It is broader than the AL permission set above: it grants full read/insert/modify/delete access to all connector tables, including the setup and configuration tables that the AL set restricts to Read. The AL permission set "SP Conn. User EFQ" is the maintained, more restrictive set -- use it for new installations.
Included Permissions
Tables
The permission set gives users Read access to setup/configuration tables and full access (RMID) to operational tables.
Setup/Configuration Tables (Read Only)
| Table | Access | Purpose |
|---|---|---|
| SharePoint Setup EFQ | Read | Main configuration |
| Table Mapping EFQ | Read | Table to folder mapping |
| Alternative Mapping EFQ | Read | Conditional mapping |
| SharePoint Map. Metadata EFQ | Read | Metadata column mapping (legacy; obsolete-pending) |
| SharePoint Map. Metadata2 EFQ | Read | Metadata column mapping (active) |
| Adobe Setup EFQ | Read | Adobe Sign configuration |
| DocuSign Setup EFQ | Read | DocuSign configuration |
| Incoming Source EFQ | Read | Incoming document sources |
| Incoming Match Criteria EFQ | Read | Matching rules |
| SharePoint Print. Settings EFQ | Read | Print to SharePoint |
| Document Template EFQ | Read | Report templates -- Custom Report Layout flavor |
| Document Template RL EFQ | Read | Report templates -- Report Layout flavor |
Operational Tables (Full Access - RMID)
| Table | Access | Purpose |
|---|---|---|
| SharePoint File EFQ | RMID | File listing display |
| WildCard Match EFQ | RIMD | Wildcard matching for alternative mappings |
| Related Document EFQ | RIMD | Related documents tracking |
| SharePoint Folder Mapping EFQ | RMID | Active mappings |
| SharePoint Category EFQ | RMID | File categories |
| Auto-Create subfolder EFQ | RIMD | Subfolder configuration |
| Auto-Create subfolder 2 EFQ | RIMD | Subfolder configuration (v2) |
| SharePoint File Details EFQ | RMID | E-signing tracking |
| SharePoint Doc Signers EFQ | RMID | Signer information |
| Incoming Document EFQ | RMID | Incoming document queue |
| Incoming API EFQ | RMID | Incoming API data |
| Background Report EFQ | RMID | Background processing |
| Sharepoint Subsite EFQ | RMID | Subsite data |
| Json Render EFQ | RMID | JSON rendering |
| Runtime Upload EFQ | RIMD | Runtime upload data |
| StartSession Parameters EFQ | RIMD | Session parameters |
Pages
Execute permission on connector pages:
| Page | Purpose |
|---|---|
| SharePoint Setup | Main configuration |
| Table Mapping Card EFQ | Edit a single table mapping |
| SharePoint Table Mapping | Map tables to folders |
| Active SharePoint Mapping | View active mappings |
| Alternative Mapping | Conditional mappings |
| SharePoint Document Templates (Custom Report Layouts) | Report templates, legacy flavor |
| SharePoint Document Templates (Report Layout) | Report templates, modern flavor |
| Select Document Template (Custom Report Layouts) | Picker for the legacy template flavor |
| Select Document Template (Report Layout) | Picker for the modern template flavor |
| File Categories | Category management |
| Select Category EFQ | Category picker dialog |
| SharePoint Factbox EFQ | FactBox part |
| SharePoint Copy Dest. EFQ | Destination-folder picker used by the Copy File action |
| SharePoint File Picker EFQ | File picker dialog |
| Filename Dialog EFQ | Rename / new-name dialog |
| SharePoint Change Mapping EFQ | Reassign a record to a different folder |
| e-Signature Overview | E-signing management |
| Adobe Sign Setup, Adobe Login, Adobe Redirect | Adobe configuration and OAuth flow |
| DocuSign Setup, DocuSign Login, DocuSign Redirect | DocuSign configuration and OAuth flow |
| OAuth2 Login / Redirect | App Registration OAuth flow |
| DeviceCode OAuth2 Login | Device Code authentication flow |
| PKCE OAuth2 Login | PKCE authentication flow |
| SharePoint Incoming Documents | Incoming document processing |
| Incoming Source List | Source configuration |
| Select Incoming Source | Source picker |
| Criteria List | Matching criteria |
| Incoming API | Incoming API endpoint |
| SharePoint Doc. Library | Browse SharePoint |
| Mapping Metadata EFQ | Metadata column configuration |
| Auto-Create Folders List, Auto-Create Folders 2 List | Subfolder configuration (primary and alternative) |
| About SharePoint EFQ, Register SPC EFQ, Expired SPC EFQ, HttpClient Warning EFQ | About, registration, and warning pages |
| Select Table EFQ, Select Field EFQ, Select Table Mapping EFQ, SharePoint Select Folder EFQ | Reusable picker dialogs |
| SharePoint Related Docs EFQ | Related documents FactBox |
| SharePoint Connect EFQ | OAuth connect/landing page |
| Sharepoint Signers EFQ | Signer list for e-signing |
| SharePoint File Details EFQ | E-signing file details |
Codeunits
Execute permission on connector codeunits:
| Codeunit | Purpose |
|---|---|
| SharePoint EFQ | Core SharePoint API and communication |
| DeviceCode OAuth2 Mgt EFQ | Device Code authentication flow |
| Modern OAuth2 Mgt EFQ | Modern App Registration authentication flow |
| PKCE OAuth2 Mgt EFQ | PKCE authentication flow |
| Send to Adobe EFQ | Adobe Sign API |
| Send to DocuSign EFQ | DocuSign API |
| Incoming Doc. Management EFQ | Incoming document logic |
| SharePoint Printer EFQ | Print to SharePoint |
| Background Report Handling EFQ | Background report processing |
| Factbox Background Task EFQ | FactBox background loading |
| License Management EFQ | Licensing and registration |
| Document Emailing EFQ | Emailing documents from SharePoint |
Batch upload is not a separate codeunit -- it is implemented by the four batch upload reports listed below.
Reports
Execute permission on connector reports:
| Report | Purpose |
|---|---|
| Transfer Attachments | Migrate attachments |
| e-Signature Checker | Check signing status |
| Batch Upload Invoices | Batch upload sales |
| Batch Upload Credit Memos | Batch upload credits |
| Batch Upload Purchase Invoices | Batch upload purchases |
| Batch Upload Purchase Credit Memos | Batch upload purchase credits |
| Create Empty Folders | Bulk folder creation |
| SharePoint Print PDF EFQ (70319479) | Print PDF via the virtual printer |
| Generic Customer Template | Customer document generation |
| Generic Vendor Template | Vendor document generation |
| Generic Job Template | Job document generation |
Assigning the Permission Set
To Individual Users
- Go to Users in Business Central
- Open the user record
- Navigate to User Permission Sets
- Add new entry
- Select "SP Conn. User EFQ"
- Save
To User Groups
- Go to User Groups
- Open or create appropriate group
- Add "SP Conn. User EFQ" to group permissions
- Assign users to the group
Via Permission Set Assignments
- Go to Permission Sets
- Find "SP Conn. User EFQ"
- Use Permission Set by User to assign
Custom Permission Sets
Creating Restricted Access
For users who need limited access:
- Copy "SP Conn. User EFQ"
- Rename to your custom name
- Remove permissions not needed
- Assign to users
Example: View-Only Users
Create a custom set with:
- Read permission on all tables
- Execute on pages
- No Insert/Modify/Delete on operational tables
Additional Permissions Required
Base Business Central Permissions
Users also need standard BC permissions for tables they access:
| Object | Permission Needed |
|---|---|
| Customer | Read (for FactBox) |
| Vendor | Read (for FactBox) |
| Item | Read (for FactBox) |
| Job | Read (for FactBox) |
| Sales Header | Read (for FactBox) |
| Purchase Header | Read (for FactBox) |
SharePoint Permissions
The permission set doesn't control SharePoint access. Users need appropriate SharePoint permissions:
| SharePoint Permission | For |
|---|---|
| Read | View files |
| Contribute | Upload files |
| Edit | Modify properties |
| Full Control | Create/delete folders |
Security Considerations
Principle of Least Privilege
- Assign only needed permissions
- Review permission assignments regularly
- Remove access when no longer needed
Sensitive Operations
Consider restricting access to:
| Operation | Who Should Have |
|---|---|
| SharePoint Setup | Administrators |
| E-signing Configuration | Authorized users |
| Batch Operations | Power users |
Audit Recommendations
Periodically review:
- Who has the permission set assigned
- Whether assignments are still appropriate
- Any custom permission sets in use
Troubleshooting Permissions
User Can't See FactBox
| Check | Resolution |
|---|---|
| Permission set assigned? | Add permission set |
| Table mapping exists? | Create table mapping |
| BC base permissions? | Add table permissions |
User Can't Upload
| Check | Resolution |
|---|---|
| Permission set assigned? | Verify assignment |
| SharePoint permissions? | Grant write access |
User Can't Configure
| Check | Resolution |
|---|---|
| Has setup page access? | Check page permissions |
| Is administrator? | May need higher privileges |