⛔Restrict Access to Available roles

and prevent users from changing their intended role

In Business Central, users can easily change the role assigned to them. This can happen by accident, because they just want to see what's happening, or deliberately, because they want to “browse” … let's say.

Depending on the type of role, users can gain access to a wide variety of data in this way, such as payroll, business data (outside the user's scope), etc. You can learn how to prevent users from changing the role assigned to them in this blog post. You can also use the procedure in this blog entry to protect another page or data from being accessed by users or user groups.

Let's start:

First, indentify the page you are looking for. In our example we want to restrict the access to the Available Roles list in the settings.

1. From the rolecenter, we press ALT+T to access the settings (or we click on ther gear icon in the upper right corner of the screen and select “My Settings”).

2. Click on the Role menu.

3. Press CTRL+ALT+F1 to open the page inspection. Note the ID of the page (here Roles - 9212).

4. Navigate to the Permission Sets page.

5. For our example we will copy the D365 BASIC permission set. We check if this permission set has a permission for the page Roles (#9212). Select the permission set in the list and click Copy Permission Set… from the menu.

6. Give the copy a new name. We used Restricted Access.

7. Once the copied permission set is created, click on Permissions from the menu.

8. On the permission set card, select Exclude in the Type column.

9. Specify Page in the Object Type column.

10. Enter the ID of the page (here 9212) in the Object ID column.

11. Leave the permission set card and go back to the permission set list.

12. Select Related > Permissions > Permissions by User from the menu.

13. Assign the permission set to the user who shouldn't be able to change the role. Also make sure that the user is not assigned the D365 Basic permission set anymore. Always keep at least one super user ;).

You are done now. By the way it is sufficient to restrict the access to the page 9212 Roles. Even from the user settings card ther user wont be able to change the assigned role.

Here is a summary of all the steps detailed above: