Small and medium business | Business Central, N...

Permissions

(6) Share

Report

Posted on by peter fun

725

Hi Everyone,

Can someone guide me? I want to restrict one of my users in Business Central using permissions that they cannot create POs , cannot receive and invoice a Purchase Order. Please guide me on which object IDs I should restrict permissions on.

Additionally, I have created a General Journal Batch using my user’s name. The user should be able to create journal lines and send approval requests but should not be able to post. Please guide me on which object IDs I should restrict for the General Journal.

Categories:

Dynamics 365 Business Central

Microsoft Dynamics NAV

Microsoft Dynamics RMS

Dynamics 365 Business Central migration

I have the same question (0)

All responses (7)

Answers (0)

Suggested answer

Greg Kujawa 787 on at

Like (0)

Report
Copy link

Link copied!

As for your first part, here's a thread in this forum that pertains to it. If the user shouldn't even be able to create a new purchase order, you can remove permission for Insert for Table 38 as well. As for the second part, you can implement an approval workflow that should do the trick. See here.

Hope this helps!

Was this reply helpful? Yes No
peter fun 725 on at

Like (0)

Report
Copy link

Link copied!

For second part on general journal the workflow is already setup i just want to know how can i restrict user from posting general journal

Was this reply helpful? Yes No
Greg Kujawa 787 on at

Like (0)

Report
Copy link

Link copied!

If this is a properly-configured approval based workflow, any general journal batch that hasn't been approved by a designated approver cannot be posted. The Post action would be grayed out, meaning it's disabled. Most businesses have entry staff who create such entries. Then an approver has to approve them once submitted. Then once those specific elements have been approved then the entry staff can post them. That's the whole point of an approval workflow.

If you don't even want that entry staffer to post something that's approved, then the approver can approve it, and quickly post it themselves.

Was this reply helpful? Yes No
Suggested answer

OussamaSabbouh 11,495 Super User 2026 Season 1 on at

Like (1)

Report
Copy link

Link copied!

Hello,

You don’t need to block specific object IDs—this should be handled with standard permission sets. To stop a user from creating, receiving, or invoicing Purchase Orders, do not assign any purchasing POST permission sets (like D365 PURCH DOC, POST); optionally give VIEW-only if they need visibility. For General Journals, assign D365 GENERAL JOURNAL, EDIT so the user can create lines and send approval requests, but do not assign D365 GENERAL JOURNAL, POST or D365 POSTING, which cleanly prevents posting while approvals still work. This is the standard and supported way to control behavior in Business Central.

Regards,

Oussama

Was this reply helpful? Yes No
Suggested answer

YUN ZHU 98,306 Super User 2026 Season 1 on at

Like (0)

Report
Copy link

Link copied!

You can simply exclude permissions for these pages.

More details: Dynamics 365 Business Central: Permission Exclusion (Exclude in Permission Set)

https://yzhums.com/30562/

Hope this can give you some hints.

Thanks.

ZHU

Was this reply helpful? Yes No
Suggested answer

Dhiren Nagar 2,876 Super User 2026 Season 1 on at

Like (1)

Report
Copy link

Link copied!

Hi,

Here are specific object IDs that you need.

For stopping posting of Sales - 81, 80 Codeunits. For Purchase - 91, 90 Codeunits.

For stopping Posting of General Journal only and not Payment Journal etc. then use - You need to do this with customization as Microsoft uses same codeunit. However if you want to restrict all the journal posting you can use 233, 12 codeunits

If you want to allow access to only specific batch, you can use security filter on General Journal Batch and General Journal Line tables. Check the Microsoft learn for Security filter.

Regards,

Dhiren.

Was this reply helpful? Yes No
Suggested answer

Jeffrey Bulanadi 9,106 Super User 2026 Season 1 on at

Like (0)

Report
Copy link

Link copied!
Hi,

For Purchase Orders:
You restrict what the user can’t post by removing permission to the posting codeunit that actually does the posting. In BC, Purch.-Post is the application codeunit that handles posting PO receipts/invoices. So if the user cannot Execute that codeunit, they can create POs but they cannot receive or invoice them.

For General Journal:
The core object that actually posts general journal lines to ledger entries is Gen. Jnl.-Post Line (Codeunit 12). If a user doesn’t have Execute on that codeunit, they cannot post the journal, even if they have rights to create the lines.

So in plain terms, to meet your requirements:

For the PO restriction: don’t give the user Execute on the Purch.-Post posting codeunit (plus the related Post+Print if needed).

For the journal restriction: let them create/edit journal lines but do not give Execute on Gen. Jnl.-Post Line.

The official Microsoft pages above show that these codeunits are indeed the ones BC uses for posting purchase documents and general journal entries.

If you want exact object IDs (like 90, 91, 12, 13), those are the standard ones in BC (codeunit 90/91 for Purchase Posting variations, codeunit 12/13 for GL posting), and you can verify them in the Permissions page in BC or via the permission set designer. Those are standard documented objects in the BC object library and shown when you open the objects in the Permission Sets UI (which pulls from the BC metadata).

Helpful References
Define granular permissions - Business Central | Microsoft Learn
General Journal Post Line Overview - Business Central | Microsoft Learn
Codeunit "Purch.-Post" | Microsoft Learn

If you find this helpful, feel free to mark this as the suggested or verified answer.

Cheers
Jeffrey

1 people found this reply helpful.

Was this reply helpful? Yes No