A permission set is a named group of read, insert, modify, delete and execute rights on Business Central objects, assigned to users to control what they can do.
A permission set is a named collection of permissions on Business Central objects: table data, tables, pages, reports, codeunits and queries. Each line grants read, insert, modify, delete or execute rights. A user can hold several sets at once, and the access they end up with is the sum of those sets.
Search for Permission Sets with Alt+Q to see every set in the environment: the built in ones, those delivered by installed extensions and the ones you created yourself. Assignment happens from the Users page, by opening a user and adding sets. The Effective Permissions page shows what a given user actually has on a specific object.
Anna in accounts payable needs to register purchase invoices but must not change the chart of accounts. You copy a standard purchasing set into a user defined set called PURCH-CLERK, remove insert, modify and delete rights on the G/L account table data, then assign her the basic set plus PURCH-CLERK. On 04.08.2026 she posts a CHF 4,820.00 invoice from vendor V10000, but the list of general ledger accounts opens read only.
The classic trap is testing with a SUPER user: SUPER covers everything, so a missing right only shows up once a real user works in the system. Next comes the confusion between role and rights, since changing the Role Center grants no access at all. Finally, extensions ship their own permission sets that Business Central never assigns automatically, so a freshly installed app looks broken until an administrator assigns its set.
When you connect an external tool to Business Central, the account it uses needs the right sets too: an integration cannot read what its user cannot read. Zentriq Agent follows the same rule, it runs with the rights of the signed in Business Central user, ships a permission set an administrator assigns once, and every write it proposes arrives as a draft that a person approves inside Business Central.
The role, or profile, only decides which Role Center and pages are shown. Access comes from the permission sets assigned on the user, so that is where the missing set has to be added.
No. System sets and sets delivered by an extension are read only. Copy the set into a user defined one and edit the copy.
Zentriq's AI tools automate many of the manual processes around permission set in Business Central. Learn about the Zentriq Agent or try Zentriq PunchOut to see how AI simplifies procurement in BC.