web
You’re offline. This is a read only version of the page.
close
Skip to main content

Announcements

No record found.

News and Announcements icon
Community site session details

Community site session details

Session Id :
Dynamics 365 Community / Forums / Small and medium business | Business Central, N... / Security Groups and De...
Small and medium business | Business Central, N...
Answered

Security Groups and Default Permission Sets Questions

(3) ShareShare
ReportReport
Posted on by Krisi Manolova 16

We are trying to better understand how Security Groups interact with the default permission sets assigned through Business Central license types:
 

      1. If we create a Security Group and assign permission sets to that group, will the permission sets from the Security Group overwrite the default permission sets of the user's license type, or will they will be added on top of the existing permissions?

      2. Is it possible to configure your own default set of permissions for a user license type within a tenant?
 

We would appreciate any guidance on the expected behavior and best practices for managing permissions in this scenario.

Categories:
Dynamics 365 Business Central
  • Verified answer
    Daniel Zafon Profile Picture
    Daniel Zafon 49 on at

    Hi,

    1. 

     

    The documentation states that, if you want to use group-based security, you must remove the default permission assignments associated with user licenses.

     https://learn.microsoft.com/en-us/dynamics365/business-central/ui-legacy-user-groups?wt.mc_id=d365bc_inproduct_helppane

     You can configure permissions in Business Central based on licenses. Those permissions are directly assigned to new users. These configurations still apply, even if you start using security groups.

    To use security groups exclusively, we recommend that you remove the license configurations. To learn more about license configurations, go to Create Users According to Licenses.

    You can remove license configurations on the License Configuration page. Choose a license, and then delete all permission sets assigned to it.

     

    2.

     

    You can configure the permissions that are assigned by default based on the user's license type. Search for "Licence Configuration" to view the list of available license types.

    Select the license type you want to customize and click "Configure".

     

    I hope this information has been helpful

  • Verified answer
    AndrewThomas81 Profile Picture
    AndrewThomas81 3,039 Super User 2026 Season 2 on at

    When users are added they inherit the permissions from the license assigned.  To prevent this you can customise the license configuration.

     

    There is no functionality to assign security groups to the license configuration.

     

    Best practice is to customise the license configuration and remove all permissions, and assign through security groups only.

     

    Kind Regards

     

    Andrew Thomas FCCA MCP

    YouTube - Use Business Central

    LinkedIn

  • Verified answer
    OussamaSabbouh Profile Picture
    OussamaSabbouh 20,172 Super User 2026 Season 2 on at

    Hello Krisi,

    Yes permissions assigned through Security Groups are added to the user's other assigned permission sets; they don't overwrite them. Business Central calculates the user's effective permissions from the combination/union of permission sets assigned directly, through Security Groups, and from the starting permissions associated with the license, while the license entitlement remains the upper limit—for example, giving a Team Member user a broader permission set can't grant functionality outside the Team Member entitlement. For your second question, yes, administrators can customize the default starting permission sets for each license type from License Configuration → select the license → Configure → Customize permissions. One important point is that this customization applies only to new users assigned that license; existing users aren't automatically updated. If your organization wants Security Groups to be the single source for role-based permissions, Microsoft recommends removing the permission sets from the relevant License Configuration and then managing permissions through Security Groups; otherwise, both sources remain effective. You can always confirm the final result from Users → Effective Permissions, which shows exactly which permission set/group is granting each permission.

    Regards,
    Oussama Sabbouh

  • Verified answer
    YUN ZHU Profile Picture
    YUN ZHU 103,702 Super User 2026 Season 2 on at

    Hi, hope the following can give you some hints as well.

    Dynamics 365 Business Central: How to list all permissions (all users with permission sets or all permission sets with permissions…)

    https://yzhums.com/8417/

    Dynamics 365 Business Central: Restore User’s Default Permissions

    https://yzhums.com/52431/

     

    Thanks.

    ZHU

  • Verified answer
    Yi Yong Profile Picture
    Yi Yong 2,805 Super User 2026 Season 1 on at

    Hello,

        1. If we create a Security Group and assign permission sets to that group, will the permission sets from the Security Group overwrite the default permission sets of the user's license type, or will they will be added on top of the existing permissions?
    No, it will not overwrite. It will be added on top, however, a point to note is that these are separate permissions.

    The default permission sets from user's licence type is assigned to the user directly.

    Whereas the security group permissions is assigned when the user is in the group. It allows easier control and change.


          2. Is it possible to configure your own default set of permissions for a user license type within a tenant?

    I will suggest you to remove all default permissions from licence configuration and control them via security group.
  • Suggested answer
    Grigorios Mavrogeorgis Profile Picture
    Grigorios Mavrogeorgis 3,666 Super User 2026 Season 2 on at

    Hi, they add on top, they don't replace. Permission sets from a security group, from direct assignment, and the defaults from the license all come together as a union, and then the license entitlement sits over the whole thing as the outer limit. That is why a Team Member user with SUPER is still a Team Member, the entitlement cuts it back and no permission set can push past it.

    Second one, yes. Search License Configuration in Tell Me, pick the plan and set which permission sets are assigned when the user is created. You can also empty it completely, which is what I would do if everything should come from security groups, otherwise users end up with the license defaults plus the group sets and nobody can tell where an access came from.

    The Effective Permissions page shows which set gave what, that saves a lot of guessing.

    Glad to help - follow up if anything is unclear.   

    ►  If this solved it, marking it verified helps others too.       

    Regards,
    Grigorios Mavrogeorgis
    Business Central Consultant & AL Developer

    Work: Gmsoft Limited
    Blog:  insidebusinesscentral
    LinkedIn: linkedin.com/in/gregorymavrogeorgis

     

Under review

Thank you for your reply! To ensure a great experience for everyone, your content is awaiting approval by our Community Managers. Please check back later.

Helpful resources

Quick Links

Season of Sharing Community Challenge Winners!

Congratulations to our community stars!

Women in Power Builds Momentum

Expanding mentorship, skilling, and AI innovation

Congratulations to the August Top 10 Community Leaders

These are the community rock stars!

Leaderboard > Small and medium business | Business Central, NAV, RMS

#1
OussamaSabbouh Profile Picture

OussamaSabbouh 765 Super User 2026 Season 2

#2
YUN ZHU Profile Picture

YUN ZHU 571 Super User 2026 Season 2

#3
Grigorios Mavrogeorgis Profile Picture

Grigorios Mavrogeorgis 299 Super User 2026 Season 2

Last 30 days Overall leaderboard

Featured topics

Microsoft Training Manuals

Product updates

Dynamics 365 release plans