Name: Congruent Software Inc
Address: 4205 148th Ave NE Suite 200, Bellevue, WA, 98007, US
Telephone: +1-844-567-5232

Are your ERP security controls protecting your business, or are they simply assumed to be “secure by default”? In an era where financial data, customer records, and operational processes live inside ERP systems, security gaps are no longer minor IT issues. They are business risks. Microsoft Dynamics 365 Business Central is built on Microsoft’s enterprise-grade cloud platform, but true security depends on how its features are understood, configured, and governed. From identity management and permissions to data protection and compliance, Business Central security is a layered model that must be implemented deliberately to protect both systems and trust.

Explore Business Central security features in detail and learn how to design a secure, compliant, and scalable ERP environment that protects your data as your business grows.

Business Central security combines Microsoft Entra ID identity, role-based permissions, record-level filters, platform encryption, and audit logging under a Microsoft–customer shared responsibility model. Organizations that lack in-house expertise often rely on our Business Central consulting services to design permission models, conditional access policies, and audit frameworks aligned with compliance and operational risk.

1. Understanding Business Central’s Security Model

What is the Business Central Security Model?

The Business Central security model is a layered, defense-in-depth architecture that separates identity, access control, data protection, and monitoring.

Business Central is fundamentally based on Azure Active Directory as the identity management system, and role-based access control based on permission sets and permission set groups. Security is considered on several levels, such as environment, company, table, page, report, record level, and record level, where the user is only allowed to access the data and functions that are needed according to his or her role.

In the cloud offering, Microsoft handles infrastructure security, platform patching, encryption, as well as service availability, and customers handle user provisioning, permission design, data governance, and compliance enforcement. This model of shared responsibility guarantees a high level of protection of the base. It allows organizations to customize security controls to their needs in terms of operation, regulation, and risk.

2. Identity & Authentication in Business Central Security

What is Identity & Authentication in Business Central?

Identity and authentication form the primary security boundary in Microsoft Dynamics 365 Business Central. They ensure that only verified users can access the system and that every sign-in is continuously evaluated against organizational risk and security policy through Microsoft Entra ID.

Business Central does not store local credentials. All identities, sign-in methods, and access policies are managed centrally in Entra ID, enabling single sign-on across Microsoft 365, Azure, and Business Central while enforcing modern controls such as multi-factor authentication, conditional access, and password less sign-in. Here are the core identity and authentication capabilities that form the foundation of Business Central security:

Azure Active Directory (Entra ID) Integration

What is Entra ID Integration?

Entra ID acts as the centralized identity provider for Business Central, managing the full user lifecycle, authentication methods, and security policies without storing credentials inside the ERP.

This allows centralized user lifecycle management, secure authentication, and enforcement of identity across the workloads of Microsoft 365, Azure, and Business Central.
Single Sign-On and Identity Federation

What is Single Sign-On in Business Central?

Single sign-on allows users to access Business Central and other Microsoft services after one authentication event, reducing credential sprawl and strengthening centralized control.

Identity federation allows integration with external identity providers using Entra ID, which is essential for organizations that employ a hybrid identity model, cross-tenant collaboration, or external user access. This minimizes the credential sprawl, and centralized authentication control is ensured.
Multi-Factor Authentication Support

Multi-factor authentication is implemented at the identity layer by Entra ID. It is automatically applied to Business Central users.

How does MFA protect Business Central?

Multi-factor authentication adds a second verification factor to every sign-in, dramatically reducing the risk of credential theft and unauthorized access.

The policies of MFA may be selectively implemented depending on the user roles, locations, devices, or risk levels, which allows them to comply with the enterprise security needs.
Conditional Access Policies

What are Conditional Access Policies?

Conditional access applies to rule-based controls to Business Central sign-ins based on user identity, device compliance, location, and risk signals.

Conditional access offers policy-based and fine-grained control of who and how users are allowed to sign in to Business Central. Typical examples are restricting access to untrusted places, mandating devices that are compliant with users of finance, or MFA to privileged positions. These policies enable the dynamism of security controls to respond to risk without altering Business Central configuration.
Password less and Modern Authentication Methods

What is Password less Authentication?

Password less sign-in replaces static passwords with Windows Hello, FIDO2 keys, or authenticator approvals to eliminate phishing and credential reuse risks.

Organizations eliminate the risk of phishing and credential theft by eliminating the use of static passwords in the authentication process. These new authentication means comply with the concept of zero-trust security and identity standards of the future with Business Central.

3. Environment-Level Security in Business Central

What is Environment-Level Security?

Environment-level security isolates production, sandbox, and development workloads so configuration changes and test activities cannot expose or corrupt live business data.

Here are the key environment-level security controls that govern isolation, access, and lifecycle management across Business Central environments:

Tenant and Environment Isolation

Business Central has strict tenant isolation to maintain the logical separation of customer data, configurations, and environments. In a tenant, there may be several environments, which are separated in terms of data, users, and operational influence. This isolation also helps to avoid cross-environment data leakage and makes sure that testing or development activities will not impact production activities.

Production vs Sandbox Environments

Business Central environments are categorized into production or sandbox. Business data in production environments is live and has greater operational controls, and sandbox environments are used to test, develop, upgrade, and train. Sandbox environments enable unhindered experimentation without endangering financial or operational information, which encourages safer change management procedures.

Production vs Sandbox Environments in Business Central

Factor	Production Environment	Sandbox Environment
Purpose	Runs live business operations and financial transactions	Used for testing, development, training, and upgrades
Data	Contains real, transactional business data	Uses copied, masked, or test data
User Access	Restricted to authorized business users	Limited to developers, testers, and admins
Change Control	Strict management and approvals	Flexible changes with minimal restrictions
Customization	Controlled deployments via extensions	Free experimentation with extensions and configurations
Performance	Optimized for stability and uptime	No performance guaranteed
Upgrades	Automatically scheduled and managed	Can be triggered and tested in advance
Integrations	Connected to live external systems	Connected to test or mock systems
Security Controls	Highest security and compliance enforcement	Reduced controls for non-production use
Risk Impact	High impact if misconfigured	No direct business impact

Environmental Access Control and Restrictions

Environment-level permissions are explicitly used to control access to environments. Only the environments can be accessed by users, and they will not be able to see the production or sensitive datasets. This is particularly necessary for the consultants, developers, and external partners who might need restricted or temporary access to non-production environments.
Admin Roles and Environment Governance

Environment governance is under administrative roles that control environment creation, deletion, upgrades, and access policy. Only IT administrators or the owners of the ERP are usually allowed to perform these roles to minimize the risks of governance. Separating global administrators, environment admins, and functional admins is useful in avoiding unintentional or unauthorized configuration changes.
Lifecycle Controls for Test, Development, and Production

Business Central facilitates the use of structured lifecycle management in test, development, and production. Extensions and controlled deployment processes allow developing and testing changes in sandbox environments and promoting them to production. This type of security methodology, based on lifecycle, is used to ensure that untested code, configuration modifications, or integrations do not impact the stability or security of systems in live environments.

4. User Access and Permissions in Business Central

What is User Access & Permissions in Business Central?

User access and permissions define what a person can see, create, modify, or post inside Business Central. Authorization is enforced through role-based access control where users receive permission sets instead of direct object rights, ensuring consistent security across pages, reports, APIs, and background processes. This model directly impacts financial control, auditability, and operational risk by preventing unauthorized changes to master data, transactions, and configurations.

Here are the core access control mechanisms that define what users can see and do within Business Central:

Role-Based Access Control Fundamentals

Business Central uses role-based access control, which means that users are mapped to permission sets instead of being assigned permissions directly to objects. Authentication is checked at runtime against a combination of effective permission sets of the user, which include tables, pages, reports, code units, queries, and system objects. This model guarantees uniform enforcement throughout the interactions of the UI, background processes, and integrations.
Permission Sets and Permission Set Groups

The granular permissions include Read, Insert, Modify, Delete, and Execute, which are defined at the object level. Permission set groups are logical containers that group related permission sets and can be assigned and managed with ease. This hierarchy minimizes bureaucracy and decreases the chances of unequal authorizations within similar positions.
Standard vs Custom Permission Sets

Microsoft maintains standard permission sets, which are updated when the application is upgraded to ensure compatibility with new features. The extensions, custom workflows, or extreme segregation-of-duty cases are the common types of custom permission sets. Best practice is to layer custom permission sets on top of standard ones rather than replacing them, preserving upgrade safety and audit clarity.
Assigning Permissions by Job Function

Permissions must be issued in accordance with the job responsibilities, such as accounts payable, inventory handling, sales processing, or reporting. The proficiency to assign permissions based on the functions instead of the users makes the onboarding process easier. It enhances role clarity and decreases access creep in the long term. This approach also improves audit readiness by making access rationale transparent.
Least-Privilege Access Strategy

Business Central supports privilege enforcement by allowing fine-grained objects and action control. The users are given the least permissions that they need to perform their daily tasks and are not exposed to sensitive information and actions. Periodic access reviews and role validation are essential to maintain this posture as roles evolve.

Area	Minimum Control	Recommended Practice
Identity	MFA enabled	Conditional Access + password less
Finance access	Company filter	Segregation of duties
Integrations	OAuth authentication	App-specific permission sets
Admin roles	Limited global admins	PIM approval workflow
Auditing	Change log	Real-time alerts

5. Record-Level Security in Business Central

What is Record-Level Security?

Record-level security ensures users see only the subset of table data relevant to their role—even when multiple departments share the same database tables. Below are the record-level security controls used to restrict access to sensitive data based on role, context, and business rules:

Security Filters and Record Permissions

Security filters are conditions applied to the table that limit the records that are returned to the user. Such filters work automatically and transparently and are imposed on the platform, such that restricted records are never shown on pages, reports, or APIs, no matter how the UI is customized.
Restricting Access by Dimension, Company, or Role

Business Central facilitates record segregation on companies, global dimensions, responsibility centers, and role-specific filters. This allows separation of multi-entity, multi-region, and departments without the need to duplicate environments and databases, which makes operations complex.
Use Cases for Finance, HR, and Payroll Data

Finance users can be limited to legal entities or cost centers, HR to employee master data, and access to payroll can be limited to a very small, controlled group. Record-level security provides confidentiality and permits such functions to be used in one ERP instance.
Performance and Maintenance Considerations

Security filters are checked at the time of query execution and may impact performance if they are not designed well. The filters must be straightforward, documented, and, where feasible, they must be in line with indexed fields. Reviews are necessary on a regular basis because the organizational structure and dimensions evolve.

6. Data Protection in Business Central

Data protection mechanisms safeguard confidentiality, integrity, and availability across the entire data lifecycle. Here are the primary data protection mechanisms that safeguard Business Central data at rest, in transit, and during recovery:

Data Encryption at Rest and in Transit

Business Central has strong encryption standards that encrypt stored data and TLS that protects data in transit. This makes sure that there is no chance of sensitive financial and operational information being read in case storage media or network traffic is compromised.
Secure Storage Within Microsoft Datacenters

The deployments of clouds are stored in datacenters that are managed by Microsoft and have layered physical and logical security controls. The access to the underlying infrastructure is strictly controlled, tracked, and monitored, and it exposes insider and external threats to a minimum.
Backup, Restore, and Disaster Recovery

Backups are done automatically on a regular basis, and point-in-time restoration is supported. These features safeguard against unintentional loss, corruption, or ransomware and are an important part of business continuity planning.
Data Residency and Regional Hostingt

Hosting regions allow organizations to select hosting regions to comply with legal and regulatory data residency requirements. This is especially critical for multinational companies that are covered by regional data sovereignty legislations.
Protecting Sensitive Business and Personal Data

Encryption, permissions, record-level security, and auditing can be used together to secure sensitive customer, employee, and financial data. These checks are essential to the achievement of both internal and external governance expectations.

7. Auditing and Monitoring in Business Central

Auditing and monitoring provide traceability, accountability, and early detection of anomalies or misuse. The following are the auditing and monitoring capabilities that enable visibility, traceability, and compliance across Business Central activities:

Change Log Functionality

The change log documents the changes that were made to the chosen tables and fields and captures the before and after values, time stamp, and user identity. This favors audit needs, internal controls, and root-cause analysis.
Tracking User Activity and Data Changes

User actions such as creating, modifying, and deleting records can be tracked to establish accountability. Tracking activities is necessary in detecting unauthorized changes and in facilitating operational reviews.
Audit Trails for Compliance and Investigations

Audit trails help organizations to show that they are in accordance with financial, operational, and privacy laws. They also assist in forensic investigations after suspected security incidents or data integrity problems.
Integration with Microsoft Security and Monitoring Tools

Business Central is part of the wider security ecosystem at Microsoft, and ERP activity can be correlated with identity, sign-in, and infrastructure indicators. This central visibility enhances incident detection and response.
Proactive Monitoring and Alerting Strategies

Organizations can implement alerts for high-risk events such as permission changes, unusual data access patterns, or integration failures. Proactive surveillance lowers the response time and minimizes the possible impact.

8. Integration and API Security in Business Central

Integration security governs how external systems interact with Business Central data and functionality. Here are the security measures that protect data exchange between Business Central and external applications:

Secure APIs and Web Services

Platform-level authentication and authorization controls secure Business Central APIs. Access is compared with permission sets assigned, and the integrations cannot be made beyond their intended scope.
OAuth-Based Authentication for Integrations

OAuth allows the use of token-based authentication of third-party applications. This does not require shared credentials and gives the ability to control access to integration and lifetime in a fine-grained way.
Managing Permissions for External Apps

Each external application is granted specific permission sets that specify precisely what tables, APIs, and actions they may access. This imposes least privilege on integration and eases access to reviews.
Protecting Data Flows Between Systems

Encryption, authentication, and authorization secure the data that is passed between Business Central and third-party systems. Secure integration patterns minimize exposure to interception, tampering, or leaking data.
Best Practices for ISV and Custom Integrations

ISVs and custom developers should isolate permissions, secure secrets externally, and use environment-specific configurations. Regular testing and reviews help ensure integration remains secure as systems evolve.
Security for Extensions and AL Code

Extensions must declare explicit table and entitlement permissions in app. Json. Best practice is to:
- Avoid SUPER permissions in apps
- Use indirect table permissions only when required
- Store secrets in Azure Key Vault
- Separate integration permission sets from user roles

9. Compliance and Privacy in Business Central

Compliance and privacy controls assist organizations in complying with regulation requirements and ensure trust. Enlisted below are the compliance and privacy controls that help organizations meet regulatory and data protection requirements:

Alignment with GDPR, SOC, ISO, and Other Standards

Business Central also complies with the key compliance frameworks such as GDPR, SOC, and ISO using Microsoft cloud compliance programs. These controls assist in industry and regional regulatory needs.
Data Subject Rights and Access Controls

Controlled access and administrative processes support data subject rights such as access, correction, and deletion. Permissions ensure that only authorized personnel can perform sensitive privacy actions.
Privacy by Design Principles in Business Central

Privacy is incorporated in the form of default access control, encryption, and auditing. This reduces the chances of unintended disclosure of data when there is normal operation.
Compliance Reporting and Documentation Support

Inbuilt logs, reports, and compliance documentation provided by Microsoft assist organizations in proving the effectiveness of control in case of audit and regulatory reviews.

10. Online vs On-Premises: Key Differences in Business Central Security

Understanding the security differences between cloud and on-premises deployments is critical for designing appropriate controls in Microsoft Dynamics 365 Business Central.

Cloud Security Benefits vs On-Premises Responsibility

Microsoft offers inbuilt infrastructure security, such as physical datacenter protection, network isolation, platform hardening, and ongoing security updates in the online version. This greatly decreases the security load of operations on the customers. With on-premises deployments, the organization has the full responsibility of securing servers, networks, operating systems, databases, and backup infrastructure, which makes it more complex and riskier.
Authentication and Identity Differences

Business Central online is a service based on the Microsoft Entra ID as a modern identity management system, which allows conditional access, MFA, and password less authentication. On-premises deployments usually work with Active Directory and can need some extra configurations to be integrated with Entra ID. More complex identity controls, like conditional access and risk-based authentication, will in many cases need on-premises custom or hybrid configurations.
Infrastructure and Patching Responsibilities

In the cloud, Microsoft takes care of OS, database, and application patches, providing timely security patches and minimizing exposure to previously identified vulnerabilities. Physical locations involve the use of internal teams to track the vulnerabilities, implement patches, test updates, and handle outages. On-premises ERP environments are characterized by a high risk of delay in patching.
Compliance and Audit Considerations

The Microsoft compliance certifications and audit reports are also beneficial to cloud deployments and can be used in regulatory and customer audits. On-premises deployments have organizations showing infrastructure, access, and operational controls. On-premises environments have a generally wider scope of audit and require more resources.

11. When On-Premises Security May Require Additional Controls?

Additional controls that may be needed in on-premises deployment include network segmentation, intrusion detection systems, database encryption management, secure backup storage, and advanced monitoring. Such controls are necessary to offset the lack of cloud security layers under Microsoft management.

Below is a table summarizing the key security differences between Business Central online and on-premises deployments:

Key Factor	Business Central Online	Business Central On-Premises
Security Ownership	Shared responsibility with Microsoft	Full responsibility lies with the organization
Identity Management	Microsoft Entra ID with native MFA and conditional access	Active Directory, optional hybrid Entra ID integration
Authentication Methods	Modern and passwordless by default	Traditional authentication, unless extended
Infrastructure Security	Microsoft-managed datacenters and network security	Customer-managed servers, networks, and firewalls
Patching and Updates	Automatic OS, platform, and application patching	Manual patching and upgrade management
Data Encryption	Built-in encryption at rest and in transit	Customer-managed encryption and key policies
Backup and Recovery	Automated backups and point-in-time restore	Customer-managed backup and disaster recovery
Compliance Support	Microsoft certifications and audit reports are available	Compliance evidence must be self-managed
Monitoring and Logging	Integrated with the Microsoft security ecosystem	Requires custom or third-party monitoring tools
Operational Risk	Lower due to the managed platform	Higher due to operational complexity

12. Practical Security Scenarios

External Auditor Access: Create time-bound Entra guest account with read-only permission sets and company filters.
Accounts Payable Clerk: Limit to vendor invoices and payments without vendor master edit rights.
ISV Integration: OAuth app registration with dedicated permission set instead of service account.
Consultant Access: Sandbox-only access with expiration and no production visibility.
Payroll Confidentiality: Record filters restricting employee and payroll tables to HR security group.

13. Common Pitfalls and How to Avoid them

Below are the most common Business Central security pitfalls and the practical steps to mitigate them.

Over-Privileged Users and Role Sprawl: Granting excessive permissions over time leads to unnecessary risk exposure. This can be avoided through role-based access, regular reviews of access, and the removal of unnecessary permissions.
Ignoring Environment Separation: Using production environments for testing or development increases the risk of data corruption and security incidents. Separate production, sandbox, and development environments and limit access respectively.
Weak Integration Security: Integrations with shared credentials or general permissions can reveal sensitive data. Reduce risk using OAuth-based authentication, special permission sets, and environment-specific integration configurations.
Lack of Auditing and Monitoring: Without auditing, the changes made by unauthorized individuals can be overlooked. Make change logs, track vital activities, and periodically review audit information to ensure accountability and compliance.
Best-Practice Governance Checklist: Assign explicit security administration ownership, model permission, least privilege, periodic review, integrations, and compliance. Long-term ERP security needs to be maintained by consistent governance.

14. Conclusion

Business Central security is not a one-time setup, but an ongoing discipline of identity, access, data protection, monitoring, and governance. These layered controls ensure the security of sensitive data, aid in compliance, and minimize operational risk when properly implemented. A structured, role-driven, and well-governed security model ensures Business Central remains secure as users, data, and integrations scale.

Need expert guidance to design, audit, or strengthen your Business Central security posture? Contact our experts to implement secure, compliant, and scalable Business Central architectures aligned with real-world business and regulatory requirements.

Business Central Security Features: Architecture, Permissions & Compliance Guide