Business Central does not use roles and authorization objects. Access is granted by permission sets, assigned per company to users directly or through security groups, and capped by each user's license. This data source reads that model as it is, so a Business Central environment is analyzed on its own terms.
Before you start
The customer's Business Central administrator installs the MTC Skopos Connector extension in the environment to analyze. It adds read-only API pages, an export page and the permission set MTC SKOPOS READ. It writes nothing and reads no business data. MTC provides the extension and a setup guide; the whole setup takes about 30 minutes, once.
The optional MTC Skopos Activity extension adds, for each company, user and table, the number of records the user created or modified in an activity window (180 days by default). It reads no record content. Remediation uses these counts to keep the access people actually use. Counting activity per user needs your organisation's approval; the export can be run with the counts switched off.
Setup
- Click Add → Microsoft Dynamics 365 Business Central
- Choose the source:
- API, for repeated analyses. For Business Central online, enter the
Tenant ID, theEnvironment(case-sensitive, for exampleProduction), and theClient IDandClient secretof an Entra application registered in your tenant with the Business Central API permission and allowed in Business Central. For an On-premises server, enter theServer URLup to the server instance (for examplehttp://bc-server:7048/BC), an environment name, aUser nameand itsWeb service access key. - Import ZIP, when no application registration is allowed. The administrator opens the MTC Skopos Connector page in Business Central, chooses Export for MTC Skopos, and sends the
SkoposBC_<environment>_<date-time>.zipfile.
- API, for repeated analyses. For Business Central online, enter the
- Click Save
The Entra application is created and owned by your tenant. Disabling or deleting it stops all access immediately. The ZIP contains a manifest with row counts and checksums, so a file altered after export is refused at import.
What is extracted
| Data | Used for |
|---|---|
| Users, license type and license plans | Users in scope, and what each license allows |
| Permission sets (System, Extension, User-defined), expanded | The rights each set grants |
| Permission set relations (include, exclude) and tenant permissions | How user-defined sets combine; used by simulation and remediation |
| Security groups and members | Sets inherited through groups |
| Access control (assignments per company) | Which sets apply in which company |
| Security filters | Notes on risks a filter may limit |
| Object writes | Which tables each page, report or codeunit can change |
| Activity counts (optional) | Records each user created or modified per table |
How the data is modelled
Each company becomes its own data source, named BC <environment> - <company>. Each permission set is a role. Rights are actions in two forms:
| Right | Ruleset value |
|---|---|
| Table data, direct | Object TABLEDATA:<id>, field ACCESS, value R, I, M or D |
| Table data, direct or indirect | Object TABLEDATA:<id>, field ACCESS_IND, same values |
| Run a page, report, codeunit, query or XMLport | Object OBJECT, field EXECUTE, value such as PAGE:21 or CODEUNIT:90 |
A permission line on object 0, which grants every object of its type (as in SUPER), is expanded to every object and also kept as a marker value such as TABLEDATA:'*' or PAGE:'*', so a ruleset can test for the broad line itself.
System and Extension permission sets are read-only in simulation and remediation, as they are in Business Central.
Licenses and security filters
License limits and security filters are reported, not applied:
- A risk whose actions the user's license may block, or whose rights are all held under a security filter, carries a note in the Notes column of the summary, for example
BC_VENDOR_INSERT: Insert on Vendor (23) only indirectly (Dynamics 365 Business Central Team Member). - In the data source browser, a user's actions above the license carry the note "May be blocked by licence".
- The data source tab Granted but not licensed lists each user, permission set and right above the licensed level.
Rulesets for Business Central
The System column of a Business Central ruleset matches the data source names, so use BC <environment>* for every company of one environment, or BC * for every environment. An SAP ruleset will not fire against this data source; keep a separate ruleset. See Creating Custom Rulesets.
Analyzing alongside SAP
Business Central companies can be loaded with SAP ECC, S/4HANA or Business One systems and analyzed together. Conflicts spanning two systems need identity mapping; see Cross-System Analysis.