5 Business Central Security Settings Every Company Should Review

Microsoft Dynamics 365 Business Central includes multiple layers of security designed to control who can access the system, what they can see, and what they can do.

But security settings are not something companies should configure once and forget. Employees change roles, partners come and go, new applications are added, permissions accumulate. It’s a moving target; administrative access that made sense during implementation might no longer be appropriate a year later.

That is why Business Central security should be reviewed periodically as part of normal system governance. As we point out in our series on Business Central permissions and security groups, too much access can increase the risk of errors or fraud, while too little access can keep employees from performing essential tasks. The objective is to give people the access they need—and only the access they need.

The most important Business Central security settings to review regularly include environment access, permission sets and SUPER users, security groups, multifactor authentication and Conditional Access, and partner or delegated administrator access.

1. Review who can access each Business Central environment

Start with the most basic question: who can access the environment at all?

Business Central online allows administrators to use Microsoft Entra security groups to control access at the environment level. When you assign a security group to an environment, only members of that group can sign in, even if other users have Business Central licenses.

That creates an important security boundary. Organizations should review whether they appropriately restrict production, sandbox, and other environments. A user who needs access to a test environment does not necessarily need access to production. Likewise, someone who still holds a license but has moved into another role may no longer need access to Business Central at all.

Security groups can also simplify ongoing administration by allowing you to manage access centrally through Microsoft Entra rather than individually in each environment.

2. Audit Business Central permission sets—especially SUPER Access

Getting into Business Central is only the first layer. The next question is what users can do after they sign in.

Business Central uses permission sets to control access to tables, pages, reports, and other application objects. Permissions can determine whether users can read, insert, modify, or delete information.

This is one of the most important areas to audit. Pay particular attention to the SUPER permission set. Microsoft defines SUPER as allowing users to read, use, update, and delete all data and application objects within the scope of their license. Business Central requires at least one SUPER user, but that does not mean many users need that level of access.

Sometimes a user or developer is given SUPER user privileges during a production emergency. The intent is to remove that access once the emergency is over, but does your organization actually verify that it happened?

Regularly review who has SUPER privileges and whether each assignment is still justified. For everyone else, follow the principle of least privilege: Users should have only the access needed to perform their jobs, without broad permissions outside their area of responsibility.

3. Use Business Central security groups instead of managing everyone individually

Permissions become difficult to manage when you configure them for each user separately.

That is one reason Microsoft and ArcherPoint recommend using security groups and permission sets together. Organizations can create groups around job responsibilities (for example, sales, purchasing, accounts payable, or warehouse operations) and assign the appropriate permission sets to those groups. Users inherit permissions based on group membership.

This approach makes it easier to manage and audit user access. When an employee changes responsibilities, administrators can add or remove that person from the appropriate security group rather than trying to remember every individual permission that needs to change.

This is a good opportunity to ask whether your current permission structure reflects how the business actually operates today. If your security model still mirrors the organization chart from implementation, it may be overdue for a review.

4. Review MFA and conditional access

Business Central online uses Microsoft Entra ID for authentication, so identity security is an essential part of its overall security. Microsoft recommends using multifactor authentication (MFA) with Business Central. MFA adds another verification factor beyond a password, making it much more difficult for an attacker to gain access with stolen credentials. For example, a company might require MFA when someone accesses Business Central or applies additional controls to higher-risk sign-ins.

Organizations with the appropriate Microsoft Entra licensing can go further by using Conditional Access. Conditional Access policies can consider factors such as the user, application, sign-in risk, and other conditions before granting access. For example, Conditional Access controls can be used to monitor and alert your security team when a user logs in after hours. (Is there a reason someone is accessing the General Ledger late on a Saturday night?)

This matters because compromised credentials remain one of the easiest ways attackers gain access to business systems. At a minimum, your company should verify that MFA is being enforced appropriately and review whether Conditional Access policies still match your security requirements.

5. Review partner and delegated administrator access

Many Business Central customers rely on Microsoft partners for implementation, support, upgrades, or administration. That access should be reviewed just as carefully as internal access.

Business Central allows organizations to control partner access at the environment level. Internal administrators can allow or block delegated administrator access and can restrict access to specific partner Microsoft Entra tenants. Microsoft notes that environments can otherwise be configured to allow all partner access associated with existing tenant-level relationships.

That makes periodic review important. Ask which partners currently have delegated administrative access, whether those relationships are still active, and whether each partner needs access to every environment.

Old implementation partners, former consultants, or third-party applications should not retain access indefinitely simply because no one remembered to remove it.

Is your Business Central security still right for your business?

Business Central provides a strong security framework, but its effectiveness depends on how you configure and maintain it. A useful security review doesn’t have to start with a massive audit. Start with five questions:

• Who can access each environment?
• Who has elevated permissions?
• Are permissions managed through well-defined security groups?
• Is identity protection, such as MFA, properly configured?
• And who outside the organization still has administrative access?

Business Central security is not a one-time implementation task. It should evolve as employees, partners, business processes, and risks change.

Periodic reviews of these settings can reduce unnecessary access, simplify administration, and strengthen internal controls.

Contact ArcherPoint by Cherry Bekaert with any questions or concerns about your Business Central security. ArcherPoint provides managed IT services, including remote monitoring, security audits, data security, data backup and disaster recovery, and more.

Trending Posts