Small and medium business | Business Central, N...

What permission sets can add permissions in BC

(2) Share

Report

Posted on by October Sky

713

Is it only the Super and Security permission sets that can administer (add/remove, alter) permission sets of other users in BC? Are there any other permission sets that can do this?

Thanks

Categories:

Dynamics 365 Business Central

I have the same question (0)

All responses (3)

Answers (0)

Sort by

Suggested answer

YUN ZHU 102,843 Super User 2026 Season 2 on at

Like (1)

Report
Copy link

Link copied!

Yes, you are right.

https://learn.microsoft.com/ja-jp/dynamics365/business-central/dev-itpro/administration/administration-special-permission-sets?wt.mc_id=DX-MVP-5004336

Was this reply helpful? Yes No
Suggested answer

OussamaSabbouh 18,896 Super User 2026 Season 2 on at

Like (2)

Report
Copy link

Link copied!

Hello,

Yes, SUPER and SECURITY are the standard permission sets intended for managing other users' permissions. SUPER has unrestricted access within the license scope, while SECURITY can create users and assign, remove, or modify permission sets only when those same permission sets are also assigned to the administrator's own account. So, out of the box, there isn't another special permission set with broader permission-administration behavior; however, you can create a custom permission set with access to the required security tables/pages, but you should test this carefully because it won't automatically have the special delegation logic built into the SECURITY permission set.

Regards,
Oussama Sabbouh

Was this reply helpful? Yes No
Suggested answer

Grigorios Mavrogeorgis 3,120 Super User 2026 Season 2 on at

Like (1)

Report
Copy link

Link copied!

Yes, SUPER and SECURITY are the two sets built specifically for this. SECURITY lets an admin create new users and assign, or remove, any permission set that is also assigned to the admin's own account — capped, can't grant more than he holds himself.
SUPER has no restriction at all, full access to every object including user and permission tables.
D365 FULL ACCESS and D365 BUS FULL ACCESS are different in purpose (broad data/application access, not built as security-admin tools), but since they grant read/insert/modify on nearly all tables including system tables, they do carry table-level access to User, Access Control and Permission Set records too — so technically a user with one of these could still alter permission assignments, just not through the same "delegated, capped" logic SECURITY uses.
So safest answer: SUPER and SECURITY are the intended ones, but FULL ACCESS sets can touch it too because of their broad system-table reach.

Glad to help - follow up if anything is unclear.
► If this solved it, marking it verified helps others too.
Regards,
Grigorios Mavrogeorgis
Business Central Consultant & AL Developer
Work: Gmsoft Limited
Blog: insidebusinesscentral
LinkedIn: linkedin.com/in/gregorymavrogeorgis

Was this reply helpful? Yes No

Join the conversation

Community site session details

What permission sets can add permissions in BC

Helpful resources

News and Announcements

Quick Links

Season of Sharing Community Challenge Winners!

Women in Power Builds Momentum

Congratulations to the July Top 10 Community Leaders

Leaderboard > Small and medium business | Business Central, NAV, RMS

Featured topics

Product updates

Community site session details

What permission sets can add permissions in BC

Helpful resources

News and Announcements

Quick Links

Season of Sharing Community Challenge Winners!

Women in Power Builds Momentum

Congratulations to the July Top 10 Community Leaders

Subscribe to this forum!

Select categories

Leaderboard > Small and medium business | Business Central, NAV, RMS

Featured topics

Product updates