
In Business Central, a user has multiple Security Group permission sets assigned. Two of these groups both include the same underlying system permission set, which grants permissions on Table Data, Object ID 21 (Customer Ledger Entry).
One security group is intended for read-only access and the other for read/write access including Modify permission.
The Problem:
The read/write security group has Modify permission defined for Table Data, Object ID 21, but when checking the user's Effective Permissions, Modify shows as blank — meaning it is not being applied.
However, when Modify = Yes is added to the read-only security group's direct line for Table Data, Object ID 21, it immediately shows up correctly in Effective Permissions.
This is unexpected behavior — the Modify permission should be coming from the read/write security group, not the read-only one.
Additional Observation:
In the read/write security group, Table Data, Object ID 21 does not appear as a direct line in the permission set. However, it does appear in the Expanded Permissions view of that set — meaning the permission is inherited from one of the included system permission sets within the read/write group.
This means:
Background: