Prevent access to default API Pages (via Postman or PowerBi) for specific users or security groups

(5) Share

Report

Posted on by Frank Janssen

184

Hi all,

i was wondering how to prevent users from using default and customer made API calls and datasets eg. via Postman or PowerBi.

As i understand access rights are the same as in in client, but is there an easier way to prevent API access completely?

Thks Frank

Categories:

Dynamics 365 Business Central

I have the same question (0)

All responses (5)

Answers (4)

Verified answer

Khushbu Rajvi. 22,128 Super User 2026 Season 1 on at

Like (6)

Report
Copy link

Link copied!

Yes, there is a way to block API access for specific users or security groups in Business Central. To prevent specific users from accessing Web Services in Business Central (e.g., via Power BI or Postman), remove their API-related permission sets (like API Read or D365 POWER BI), avoid assigning Web Service Access Keys, and optionally create a custom permission set that blocks access to API and OData objects—this way, they can still use the web client but won’t consume external connections or hit the 100-connection limit.

Please check this: https://community.dynamics.com/forums/thread/details/?threadid=f33b7934-ee2f-ef11-840a-000d3a56a6aa

https://learn.microsoft.com/en-us/dynamics365/business-central/ui-security-groups

Was this reply helpful? Yes No
Verified answer

Ramesh Kumar 7,547 Super User 2026 Season 1 on at

Like (4)

Report
Copy link

Link copied!

There is no master switch — but you can use Permission Sets or disable Web Services for Specific Users or Azure AD authentication.

Thanks!

Ramesh

If this was helpful, please check the "Does this answer your question?" box and mark it as verified.

Was this reply helpful? Yes No
Verified answer

YUN ZHU 99,074 Super User 2026 Season 1 on at

Like (4)

Report
Copy link

Link copied!

If you want to set global read-only permissions, you can use the following method.

More details:

Dynamics 365 Business Central: Managing Database Access Intent (Managing write access to APIs from the client)

https://yzhums.com/19105/

If you want to restrict a user's API permissions, which are either pages or queries, you can create a permission set to exclude those permissions individually.

Dynamics 365 Business Central: A simple way to view the list of all APIs

https://yzhums.com/22845/

Hope this helps.

Thanks.

ZHU

Was this reply helpful? Yes No
Verified answer

Jainam M. Kothari 15,732 Super User 2026 Season 1 on at

Like (4)

Report
Copy link

Link copied!

Hello,

To prevent users from accessing APIs in Business Central, you can use a combination of permission sets, security filters, and API management. By creating or modifying permission sets to exclude access to specific API objects, configuring security filters to limit data access, and disabling or restricting unwanted API endpoints, you can effectively control and prevent unauthorized API access. Additionally, assigning users to specific groups with restricted permissions ensures only authorized users have API access.

May this can help : https://learn.microsoft.com/en-us/dynamics365/business-central/dev-itpro/security/security-filters

Was this reply helpful? Yes No
Frank Janssen 184 on at

Like (5)

Report
Copy link

Link copied!

Hi all,

first of all, thanks for your fast and helpfull tips.

By now i figured out, that there is some kind of misunterstanding the exlusion permission.

I had to add the permission set witch grants permission for being able to exlude special objects, like the api page objects.

Right now i have to firgure out how to add this recently learned to my existing security groups and permission set combination.

But the path is way clearer now for me. Thanks to you all.

Was this reply helpful? Yes No