Permissions in Business Central

The SharePoint Connector uses permission sets to control access to its features. This page explains the available permission sets and how to assign them to users.

Permission Set Overview

AL Permission Set

The SharePoint Connector includes a single AL permission set:

Permission Set	ID	Caption	Assignable
SP Conn. User EFQ	70319475	SharePoint Connector User	true

Legacy XML Permission Set

There is also a legacy XML permission set defined in extensionsPermissionSet.xml:

RoleID	RoleName
SHAREPOINT CONNECTOR	SharePoint Connector

There is not a separate admin or setup permission set. All users receive the same single permission set, which provides access to all connector functionality, including:

Setup and configuration pages
Table mapping management
Document operations (upload, download, browse)
Document templates
E-signing features
Metadata management
Incoming document processing
Print to SharePoint

What the Permission Set Includes

Table Permissions

The permission set gives users Read access to setup/configuration tables and full access (RMID) to operational tables:

Table Category	Access Level
Setup tables (SharePoint Setup, Table Mapping, etc.)	Read
E-signing configuration (Adobe Setup, DocuSign Setup)	Read
Incoming configuration (Sources, Criteria)	Read
Printer settings	Read
Document templates	Read
Alternative mapping, metadata	Read
File and folder data	RMID
E-signing tracking data	RMID
Incoming document queue	RMID
Category, subfolder, and runtime data	RMID

Page Permissions

Execute permission on all connector pages:

Page Type	Examples
Setup pages	SharePoint Setup, Table Mapping
List pages	Document Templates, File Categories
Card pages	Mapping details, Configuration cards
FactBoxes	SharePoint Factbox EFQ (caption "SharePoint")

Codeunit Permissions

Execute permission on connector codeunits:

Codeunit Type	Purpose
SharePoint API	Communication with SharePoint
Authentication	OAuth and token management
Document handling	Upload, download, generation
E-signing	Adobe Sign and DocuSign integration

Report Permissions

Execute permission on connector reports:

Report	Purpose
Transfer Attachments	Migrate attachments to SharePoint
E-Signature Checker	Check signing status
Batch upload reports	Upload multiple documents
Document templates	Generate documents from templates

Assigning Permissions

To a Single User

Search for "Users" in Business Central
Open the user record
Go to User Permission Sets
Click New
Select "SP Conn. User EFQ" from the list
Save the changes

To Multiple Users

Using Permission Set Assignments:

Search for "Permission Sets"
Find "SP Conn. User EFQ"
Use Related > Permissions > Permission Set by User
Assign to multiple users at once

Via User Groups

If using user groups:

Search for "User Groups"
Open or create a group
Add "SP Conn. User EFQ" to the group's permission sets
Assign users to the group

Permission Levels

Single Permission Set for All Users

The SP Conn. User EFQ permission set is designed as a single comprehensive permission set for all users. It gives Read access to configuration tables and full access to operational tables. This is appropriate for:

Administrators configuring the connector
Power users managing document templates
Regular users who need SharePoint file access

There is no separate admin or setup permission set. All users get the same permission set.

Custom Permission Sets

For more granular control, you can create custom permission sets by copying and modifying the existing one:

Creating Custom Permission Sets

Copy the existing permission set
Remove permissions for features not needed
Assign the custom set to users

Example for a "view only" user:

Remove Insert/Modify/Delete on tables
Keep Read and Execute permissions

Additional Permissions Required

Business Central Base Permissions

Users also need standard BC permissions for:

Object	Reason
Customer table	To see Customer FactBox
Vendor table	To see Vendor FactBox
Job table	To see Job FactBox
(Other mapped tables)	To see respective FactBoxes

SharePoint Permissions

Users need appropriate permissions in SharePoint:

SharePoint Permission	Connector Feature
Read	View files
Contribute	Upload files
Edit	Modify file properties
Full Control	Create/delete folders

The connector uses the authenticated user's SharePoint permissions. A user cannot access more in the connector than they can in SharePoint directly.

Authentication-Based Access

Proxy Authentication

With proxy authentication:

All users share the same SharePoint credentials
SharePoint permissions are based on the proxy account
BC permissions control what users can do in BC

Personal Authentication

With personal authentication:

Each user authenticates individually
SharePoint permissions are per-user
Users see only what they can access in SharePoint

Troubleshooting Permission Issues

FactBox Not Appearing

Symptom	Possible Cause	Solution
No FactBox	Missing permission set	Assign SP Conn. User EFQ
FactBox empty	No table mapping	Create mapping for the table
FactBox error	SharePoint permission	Verify SP access

Cannot Access Setup

If users cannot access SharePoint Setup:

Verify they have the permission set assigned
Check if a custom permission set is being used
Ensure the permission set includes the setup page

Upload/Download Fails

If file operations fail:

Check SharePoint permissions (not just BC)
Verify the folder exists in SharePoint
Check for any permission errors in the message

Best Practices

Permission Assignment

Use permission sets, not individual permissions - Easier to manage
Start with the full set - Add restrictions if needed
Document custom sets - Keep track of what's included
Review periodically - Ensure permissions match job roles

Security Considerations

Limit setup access - Not all users need to configure settings
Audit access - Review who has SharePoint Connector permissions
Match BC and SP permissions - Align permission levels
Use personal authentication - For audit trail per user