Welcome back to our Dynamics GP vs. Dynamics Business Central Functionality Face-Off. This is Round 47. Today’s topic never makes the demo highlight reel, but every auditor asks about it first: user security. Who can see what? Who can post what? And how much work is it to keep those answers current?
Both systems use role-based security. The difference is how much you build yourself — and how deep the control goes.
How you do it in Dynamics GP
GP’s security model has three layers: operations, tasks, and roles.
- Understand the building blocks. Security tasks grant access to windows, reports, and files needed for a specific job — say, entering a batch. Tasks are grouped into security roles, and every user must be assigned a role before they can access any forms or data (Microsoft Learn). GP ships with default tasks and roles to start from.
- Assign roles per user, per company. In the User Security Setup window, you pick a user, pick a company, and assign roles. Multiple companies means repeating the assignment in each one (Microsoft Learn).
- Grow the model by hand. Add a custom report or a third-party window, and access doesn’t exist yet. The documented fix: create a new security task, add it to a new or existing role, and grant the role — usually while signed in as the all-powerful ‘sa’ account (Microsoft Learn). It works, but the model only grows when an admin grows it.
- Live with window-level limits. GP security controls which windows and reports a user can open. Limiting which records a user sees inside a window — only their warehouse, only their region — isn’t what the core model does.
How you do it in Business Central
BC’s security is built from permission sets, and it starts working before you touch anything.
- Start from the license. Users get permission sets automatically based on their Microsoft 365 plan when they’re created (Microsoft Learn). Day one, nobody has nothing — and nobody has everything.
- Assign permission sets. A permission set is a named group of permissions on objects: read, insert, modify, and delete on table data. You assign sets to users directly or through security groups, and you can scope an assignment to a specific company (Microsoft Learn). Need something custom? Start recording, click through the task, and BC builds the permission list from what you touched.
- Filter down to the record. This is the layer GP doesn’t have: security filters. A security filter limits a user’s access to a set of records in a table — sales staff who see only their own region’s orders, a warehouse clerk who sees only Location BLUE (Microsoft Learn). Combined with database, company, and object levels, BC secures data at four levels, down to the row (Microsoft Learn).
- Sign in with Microsoft Entra. BC online rides on your Microsoft 365 identity — the same account, MFA, and conditional access policies your IT team already manages. No separate ERP password to reset, no ‘sa’ account to guard.
Side by side
| Task | Dynamics GP | Business Central |
|---|---|---|
| Security model | Operations → tasks → roles, built and maintained by admins | Permission sets assigned directly or via security groups |
| New user starting point | No access until a role is assigned, per company | License assigns baseline permission sets automatically |
| Custom object access | Create task, add to role, grant — by hand | Record a task and BC drafts the permissions |
| Record-level security | Not in the core model | Security filters down to the row |
| Sign-in | GP login / SQL accounts, ‘sa’ for admin work | Microsoft Entra ID with MFA and conditional access |
| Multi-company | Re-assign roles in each company | Scope assignments per company from one place |
Why BC comes out ahead
GP deserves credit here: its role-based model was a big leap when it arrived, and a well-maintained GP security setup passes audits every day. The framework is sound.
But it is a framework you maintain by hand, window by window, company by company — and it stops at the window. Business Central starts users with license-appropriate access, lets you record permissions instead of cataloging them, scopes assignments across companies from one screen, and goes a full level deeper with security filters on records. Add Entra sign-in with MFA, and the whole thing plugs into the security stack your organization already runs. For the person who owns the audit response, that’s less building — and better answers.
Want a security model your auditor will like?
Aisling Dynamics designs role and permission structures as part of every implementation — including business process design that maps who should approve what. See what we offer, then contact us or call (251) 293-0555.
Next up in Round 48: audit trails — GP’s audit trail codes vs. Business Central’s change log and posted-document history.