MTC Skopos analyzes segregation of duties in Microsoft Dynamics 365 Business Central on its own permission model: permission sets, TableData and execute rights, security groups, security filters and license limits. A read-only connector extension extracts the security setup through the API or as a ZIP file, and the analysis runs on your own machine. The tool comes from SAP authorization specialists and brings the same depth to Business Central, at a flat €5,736/year base license with no per-company or per-user fee.
| MTC Skopos for Business Central | |
|---|---|
| Access model analyzed | Permission sets (System, Extension, User-defined) with include and exclude, security groups, per-company assignments |
| Rights evaluated | TableData Read, Insert, Modify, Delete (direct and indirect); Execute on pages, reports, codeunits, queries, XMLports |
| License awareness | Actions the user's license may block are flagged; rights granted above the license are listed |
| Security filters | Shown as a note on the risk they limit |
| Extraction | MTC Skopos Connector extension, read-only: API (Entra app you own) or one-click ZIP export |
| Business data read | None. Optional activity counts per user and table, never record content |
| Deployment | Business Central online and on-premises servers; analysis runs locally, no MTC cloud |
| Mixed landscapes | Analyzed next to SAP ECC, S/4HANA, Business One and other systems |
| Price | €5,736/year base license, unlimited environments, companies and users |
Why is SoD in Business Central harder than it looks?
Because the permission a user sees on screen is rarely the permission that applies. A user gets permission sets per company, directly or through security groups. A user-defined set can include other sets and exclude permissions or whole sets. A right can be direct or indirect. A line on object 0 grants every object of its type, which is how SUPER and broad read sets work. Then the license caps the result: a Team Member holding an insert right through a set can still only use what the Team Member license allows.
A conflict such as "maintain vendors" against "post purchase invoices" is real only after all of that is resolved. Spreadsheet reviews of permission set names miss it in both directions: they flag users whose license blocks the right, and they miss users who reach the table through an included set.
How does MTC Skopos read a Business Central environment?
- Install the MTC Skopos Connector extension in the environment. It adds read-only API pages, an export page and one permission set, MTC SKOPOS READ. It changes no standard object and its source can be reviewed from Extension Management. This is the Business Central equivalent of the transport MTC provides for SAP systems.
- Choose how data reaches MTC Skopos. Either let MTC Skopos read the API directly, recommended for repeated analyses (an Entra application you register and own for Business Central online, a web service access key for an on-premises server), or let the administrator export a ZIP file with one click. The ZIP carries checksums, so any alteration is detected at import.
- Run the analysis. Each company becomes its own data source. Findings trace to the user, the permission set, the security group if any, and the table or object right behind each conflicting function.
| Extracted | Used for |
|---|---|
| Users and license plans | Who is in scope, and what each license permits |
| Permission sets, expanded, with include and exclude relations | The effective rights each set grants |
| Security groups and members | Access inherited through Entra groups |
| Assignments per company | Which sets apply in which company |
| Security filters | Record limits noted on the risks they narrow |
| Activity counts (optional extension) | Records each user created or modified per table, so remediation keeps the access people use |
The full setup, including the Entra permissions and the activity window, is described in the Business Central import guide.
What does a Business Central ruleset look like?
The same Excel ruleset format as for SAP, with Business Central rights as permission values. A function is written as the table rights and objects that perform it: insert or modify on table 23 (Vendor) for vendor maintenance, execute on codeunit 90 (Purch.-Post) and insert on table 38 (Purchase Header) for posting purchase documents. A risk pairs functions, exactly as in an SAP ruleset.
Because each company is analyzed on its own, one ruleset applies to every company of an environment. As with any ruleset, it must reflect how your organization works: treat any starting point as a template to review, then own and tune it. The ruleset page explains how customers maintain theirs.
How are licenses and security filters handled?
They are reported, not silently applied. When a right in a risk sits above what the user's license allows, or every grant of it carries a security filter, the risk keeps its place in the report with a note naming the limit: for example vendor insert allowed only indirectly under a Team Member license, or the filter itself (Customer: Country/Region Code=US). A reviewer then decides whether the conflict is real for that user. The data source also gets a "Granted but not licensed" list: every user, set and right above the licensed level, which is a useful clean-up list on its own.
Can Business Central be analyzed alongside SAP?
Yes, and that is a common reason to choose MTC Skopos. Groups running S/4HANA or ECC at headquarters often run Business Central in subsidiaries, with shared service staff holding accounts in both. Load both as data sources, map each person's accounts to one identity, and the Cross-System add-on lets a single rule pair a function in Business Central with one in SAP. The same application also covers SAP Business One and S/4HANA Public Cloud tenants.
Simulation works on user-defined permission sets, so a proposed change can be tested before it is made in Business Central. System and Extension sets are read-only, as they are in Business Central itself. The remediation recommendations add-on proposes changes in Business Central terms: which permission set assignment to remove, and which new set to create in its place, including the original set without the rights at risk.
What does it cost?
The base license is €5,736/year and covers unlimited environments, companies and users. Simulation (€1,199/year), remediation recommendations (€2,398/year) and cross-system rules (€1,199/year) are optional add-ons. The full list is on the pricing page. Cloud governance suites for Dynamics, such as Delinea Fastpath, add access reviews and provisioning workflows. MTC Skopos stays an analysis tool: it never writes to Business Central. The 15 SoD tools guide compares the options.
Frequently asked questions
How do you run a segregation of duties analysis in Business Central?
Business Central has no built-in SoD check. Each user's effective access comes from permission sets assigned per company, directly or through security groups, minus what excluded sets take away, capped by the user's license. An SoD analysis has to resolve all of that into rights on tables and objects, then test those rights against a ruleset. MTC Skopos does this from a read-only extract of the environment and reports each conflict with the permission set and the object right that create it.
How does MTC Skopos connect to Business Central?
Your administrator installs the MTC Skopos Connector extension, which only reads the security setup and writes nothing. MTC Skopos then reads the data through the Business Central API with an Entra application registered and owned by your tenant (or a web service access key on an on-premises server), or the administrator exports a ZIP file with one button and sends it. Setup takes about 30 minutes, once.
Does MTC Skopos read business data from Business Central?
No. The connector reads users, license plans, permission sets and their content, security groups, assignments and security filters. It reads no customer, vendor, ledger or document records. The optional MTC Skopos Activity extension adds counts of records each user created or modified per table, without reading their content.
Does MTC Skopos take Business Central licenses into account?
Yes. A permission set can grant more than the user's license allows. MTC Skopos computes what each license plan permits and flags the actions that may be blocked by the license, so a Team Member who holds an insert right through a permission set is reported with that note instead of as a clean conflict. A separate list shows every right granted above the licensed level.
Can Business Central and SAP be analyzed together?
Yes. Many groups run S/4HANA or ECC at headquarters and Business Central in subsidiaries. Both load as data sources in the same MTC Skopos application, and with the Cross-System add-on (€1,199/year) a rule can pair a function in Business Central with a conflicting function in SAP for the same person.
How much does Business Central SoD analysis cost with MTC Skopos?
The base license is €5,736/year and covers unlimited environments, companies and users analyzed. Simulation, remediation recommendations and cross-system rules are optional add-ons. There is no per-company or per-user fee.
Related reading: Multi-ERP SoD analysis · SAP Business One SoD · S/4HANA Public Cloud SoD · Access risk analysis · SoD tool pricing