Before You Deploy AI, Tighten Up Your Business Central Permissions

AI adoption is accelerating quickly across Microsoft environments, from Microsoft Copilot to AI capabilities embedded directly into Dynamics 365 Business Central.

But before organizations focus on prompts, productivity gains, and new use cases, they should address who already has access to what. That question matters because AI generally works within the permissions already assigned to the user.

In Business Central, Microsoft states that Copilot retrieves data using the platform’s standard data-access mechanisms and can only access the same information as the user operating Copilot.

That sounds reassuring—and it is. But it also means that if a user has more access than they should, AI can potentially make that excessive access easier to use. So, the problem isn’t necessarily AI; it might be the underlying permission model.

AI can make existing access problems more consequential

Most companies accumulate permissions over time. An employee changes departments but retains old access. A manager receives elevated permissions temporarily and never loses them. Users might receive increased permissions because it is easier than troubleshooting exactly what access they need.

Those practices can remain unnoticed for years, but AI changes the equation because users can interact with information much more quickly and naturally. Instead of navigating multiple screens, reports, or applications, users only need to ask a question and get an answer based on information they shouldn’t be able to access.

That creates enormous productivity potential, but it also makes excessive permissions more consequential. Microsoft makes the same point in its broader Copilot guidance: Copilot honors existing user permissions, which is why Microsoft recommends identifying and remediating overshared information before broad deployment. In other words, AI might not expand a user’s permissions, but it can make existing access dramatically easier to exercise.

Start with least-privilege access in Business Central

The guiding principle should be least privilege: Users should have the access they need to do their jobs, but no more. That sounds straightforward. In practice, it takes maintenance. Experts note that excessive access can increase the risk of errors or fraud, while insufficient access can prevent employees from performing necessary job functions.

AI makes that balance even more important. Before expanding Copilot or other AI capabilities, organizations should review user permission assignments, users with elevated privileges, access left over from prior job responsibilities, and security groups that no longer reflect how the business operates.

The question should not be, “Should this person use AI?” It should be, “What information and actions should this person be able to reach when they use AI?”

Clean up security groups before scaling AI

Managing every user individually becomes difficult as an organization grows.

Business Central supports security groups, allowing administrators to organize access around job responsibilities rather than assigning permissions one person at a time. Microsoft also supports Microsoft Entra security groups for controlling access at the environment level.

For example, accounts payable employees might require one set of capabilities, while sales, warehouse, purchasing, and finance teams require others.

Define permission sets and security groups around job functions, then assign users to the appropriate security groups. (See our blog series on permission sets and security groups for an in-depth look at how they are configured and used.) That structure also makes audits easier and simplifies access changes when employees move into new roles.

That becomes particularly valuable as AI adoption expands. Well-designed security groups provide a cleaner foundation for deciding who should access which information, applications, and eventually AI-driven experiences.

AI makes identity governance more important, not less

Identity governance should be integrated into AI governance.

Permissions inside Business Central are only one part of the picture. Organizations also need to consider identity governance across the broader Microsoft environment.

Access should change when people change roles, join or leave the company, take on temporary responsibilities, or work with the organization as contractors or partners.

Microsoft Entra ID Governance extends access management beyond individual applications by helping organizations manage identity and access throughout the user lifecycle. Capabilities such as access reviews, entitlement management, lifecycle workflows, and privileged identity management can help organizations apply least-privilege principles and reduce the risk of users retaining access they no longer need.

Without that discipline, access tends to accumulate. AI does not eliminate that governance problem. Instead, it raises the stakes. A good AI-readiness exercise should therefore include questions such as:

• Are access reviews happening regularly?
• Are privileged roles limited?
• Are former employees and contractors removed promptly?
• Are temporary permissions actually temporary?

Don’t overlook data outside Business Central

Even if Business Central users begin with Copilot, their AI strategy will probably not end there. Microsoft Copilot can work across Microsoft 365 content, including documents, email, chats, meetings, and other organizational information, while respecting the user’s existing access rights.

That means companies should also look for overshared SharePoint sites, overly broad sharing links, stale content, and information without a clear owner. Microsoft’s own Copilot deployment guidance recommends remediating oversharing, cleaning up unused content, validating site ownership, and implementing durable access controls before scaling Copilot.

The same governance principle applies whether the information lives in Business Central, SharePoint, Teams, or another connected system.

AI readiness starts with access readiness

It is tempting to think of AI readiness primarily in terms of technology: Licenses, integrations, models, prompts, and use cases. But organizations should add another item to that checklist: Permission hygiene.

Before rolling out AI broadly, review who has access to Business Central, examine permission sets and security groups, reduce unnecessary privileges, strengthen identity governance, and clean up overshared information across the Microsoft environment.

The goal is to make sure AI accelerates the right work for the right people with the right information. For companies using Business Central, permission cleanup is more than an administrative task. It becomes part of the foundation for responsible AI adoption.

Get Your Business Central environment ready for AI

AI readiness starts long before the first prompt. It starts with making sure the right people have access to the right information—and that the permissions, security groups, and governance practices supporting your Business Central environment are ready for what comes next.

ArcherPoint by Cherry Bekaert can help you assess your Business Central security and permissions, identify potential access risks, and strengthen the foundation for secure, responsible AI adoption. Whether you’re just beginning to explore Copilot or preparing to expand AI across your Microsoft environment, we’ll help ensure your access strategy is ready to support it.

Trending Posts