2.1 Users, User Setup & Role Center Profiles

Users, User Setup & Role Center Profiles

Dynamics 365 Business Central provides a layered administrative model for onboarding users, governing operational posting boundaries, and delivering tailored user experiences. Functional consultants preparing for the MB-800 certification must master the boundary between cloud identity management in Microsoft Entra ID and internal application security, as well as the exact mechanics of user setup records and Role Center profile configuration.

---

User Identity Lifecycle & Cloud Provisioning

Business Central Online operates as a native cloud enterprise resource planning (ERP) solution that relies entirely on Microsoft Entra ID (formerly Azure Active Directory) and the Microsoft 365 Admin Center for authentication, directory identity, and license management. User accounts cannot be created from scratch solely within the Business Central database.

Microsoft 365 Admin Center / Entra ID  -->  Assign License  -->  Sync to Business Central  -->  User Card & Permissions

Step 1: Upstream Identity Creation & Licensing

Before a user can access Business Central, an IT administrator must create the user account in the Microsoft 365 Admin Center (admin.microsoft.com) or Microsoft Entra admin center (entra.microsoft.com). During this step, the administrator assigns a valid Business Central license to the account:

• Dynamics 365 Business Central Essentials: Full operational access to Financials, Sales, Purchasing, Inventory, Project Management, and Basic Warehouse.
• Dynamics 365 Business Central Premium: All Essentials functionality plus Service Order Management and Manufacturing.
• Dynamics 365 Business Central Team Members: Read-only access across the application, plus lightweight task entry (e.g., entering timesheets, updating existing customer/vendor records, and preparing quotes).
• Internal / Delegated Administrator: Partner administrative rights that allow system configuration without consuming a paid customer license.

Step 2: Synchronization to Business Central

Assigning a license in Microsoft 365 does not instantaneously create an active user record inside the Business Central tenant database. Synchronization occurs through two distinct mechanisms:

1. Just-In-Time (JIT) Provisioning: When a newly licensed user navigates to the Business Central URL (businesscentral.dynamics.com) and completes their first Single Sign-On (SSO) authentication, Business Central validates their Entra ID token, creates the internal user record, and applies default license-based permissions.
2. Manual Directory Synchronization: An administrator can pull newly created or modified users into Business Central immediately without waiting for user login:
   • Navigate to Tell Me (Alt+Q) and search for Users (Page 98).
   • On the action bar, choose Process -> Update users from Microsoft 365.
   • This wizard queries the Microsoft Graph API, imports newly licensed accounts, updates altered profile attributes (e.g., job titles or email addresses), and assigns default user permission sets linked to the license plan.

The User Card Architecture

On the User Card (Page 89), administrators configure core user attributes:

• User Security ID: An immutable GUID assigned by Microsoft Entra ID that uniquely identifies the user across the tenant.
• User Name: The login identifier (typically matching their User Principal Name / UPN).
• Full Name & Contact Email: Descriptive metadata utilized in workflow notifications and report headers.
• Authentication Email: The Entra ID organizational email address used for Single Sign-On.
• State: Can be set to Enabled or Disabled. Setting the state to Disabled blocks the user from signing into that specific Business Central environment immediately. This provides a rapid offboarding mechanism: if a contractor finishes an assignment or an employee takes sudden leave, an administrator can disable the User Card to cut off ERP access instantly without revoking their broader Microsoft 365 email or Office apps license.

---

The User Setup Table: Posting Bounds & User Governance

While the User Card establishes authentication and permission set assignments, the User Setup table (Table 91, accessed via Page 119) controls individual operational constraints, posting date boundaries, and workflow approval authorities.

Posting Date Constraints & The Precedence Hierarchy

A core concept tested on the MB-800 exam is how Business Central validates transaction posting dates. Business Central maintains two separate tiers of posting date controls:

1. Global Posting Dates: Configured in General Ledger Setup (Page 118) in the Allow Posting From and Allow Posting To fields. These bounds govern the entire legal entity.
2. User-Specific Posting Dates: Configured in User Setup (Page 119) in the Allow Posting From and Allow Posting To fields for individual user lines.

When any user attempts to post a sales order, purchase invoice, or general journal batch, Business Central evaluates posting permission according to a strict precedence hierarchy:

User posts transaction
       │
       ▼
Does User have a line in User Setup with non-blank 'Allow Posting From/To'?
       │
       ├─────► YES: Business Central strictly enforces User Setup dates.
       │            (Global dates in General Ledger Setup are ignored!)
       │
       └─────► NO (blank dates or no User Setup record):
                    Business Central falls back to General Ledger Setup dates.

Real-World Implementation: The Month-End Closing Cycle

Consider an enterprise on February 3, 2026. The accounting controller must close January 2026 for general sales, warehouse, and purchasing staff to prevent backdated transactions, while allowing three senior finance team members to enter adjusting journal entries and reconciliations for January:

• General Ledger Setup: The controller sets Allow Posting From = 02/01/2026 and Allow Posting To = 02/28/2026. All general users are immediately locked out of posting into January.
• User Setup: For each of the three finance users, the controller creates or edits their line in User Setup, setting Allow Posting From = 01/01/2026 and Allow Posting To = 02/28/2026. Because User Setup overrides General Ledger Setup, these three finance users can post January adjustments without hindrance.

Operational & Workflow Attributes on User Setup

In addition to posting dates, the User Setup page includes several operational parameters:

• Register Time: A boolean flag. When enabled, Business Central automatically logs the user's active session time in the User Time Register table, recording login and logout timestamps for productivity and audit tracking.
• Salespers./Purch. Code: Links the user to a code in the Salesperson/Purchaser table. Whenever this user creates a new sales or purchase document, this code is stamped onto the document header automatically.
• E-Mail: The destination address for internal notifications and workflow approval requests.
• Workflow Approval Limits:
  • Sales Amount Approval Limit: Maximum dollar value of a sales document the user can approve.
  • Purchase Amount Approval Limit: Maximum dollar value of a purchase document the user can approve.
  • Request Amount Approval Limit: Maximum value for general workflow requests.
  • Unlimited Sales / Purchase Approval: Bypasses monetary limits for C-level executives.
  • Approver ID: Identifies the user's direct supervisor in the approval hierarchy.

---

Role Center Profiles & Workspace Architecture

The Role Center is the homepage dashboard presented to a user upon logging into Business Central. It acts as an operational cockpit, surfacing the specific actions, cues, and reports relevant to their job function.

Role Center Components

Standard out-of-the-box profiles include Business Manager, Accountant, Sales Order Processor, Purchasing Agent, and Warehouse Worker. Every Role Center is built from standardized UI widgets:

1. Headline: Contextual, dynamic greetings located at the very top of the page. Surfaces high-level business insights (e.g., "Top sale this week was $14,500") and AI-powered Copilot summaries.
2. Activities & Cues: Square metric tiles that display aggregated numeric counts of operational tasks (e.g., Open Sales Orders (12), Purchase Invoices - Overdue (5), Ready to Ship (8)).
   • Visual Indicators (Thresholds): Cues can show a colored indicator bar along their top edge (Green, Yellow, Red) based on business rules configured in the Cue Setup page (e.g., 0-5 overdue invoices = Green/Favorable; 6-10 = Yellow/Ambiguous; >10 = Red/Unfavorable).
   • Interactive Drill-Down: Clicking any Cue immediately opens the underlying list page filtered to those exact records.
3. Action Tiles & Action Bar: Prominent buttons enabling single-click document creation (+ Sales Quote, + Purchase Order, + Customer Payment), bypassing multi-level navigation menus.
4. Charts & Business Analytics: Graphical representations of key performance indicators, such as Cash Flow Forecast, Top 5 Customers by Sales Volume, or embedded interactive Power BI Reports.
5. Navigation Menu & Pinned Bookmarks: The top horizontal navigation bar containing pinned list links (Customers, Vendors, Items, Bank Accounts, Chart of Accounts).

Profile Management & Default Assignment

Administrators manage profiles via the Profiles (Roles) page (Page 9170):

• Default Role Center: Marking a profile with the Default Role Center checkbox sets it as the landing page for any newly provisioned user who has not been explicitly assigned another profile.
• User Personalization Page (Page 9173): Administrators can explicitly assign a specific Profile ID and designate a default Company for individual users.
• My Settings (Page 9200): Users can change their own assigned profile, language, work date, and company, unless locked down by security permissions.

---

Personalization vs. Profile Customization

Business Central provides two distinct mechanisms for tailoring page layouts without writing AL code: Personalization and Profile Customization. Differentiating their scope and governance is a frequent exam requirement.

---

Step-by-Step UI Setup Paths

• Syncing Users from Microsoft 365: Open Tell Me (Alt+Q) -> enter Users -> select Users (Page 98) -> choose Process -> Update users from Microsoft 365 -> follow wizard prompts.
• Configuring User Posting Dates & Limits: Open Tell Me -> enter User Setup -> select User Setup (Page 119) -> select New -> choose User ID -> enter Allow Posting From and Allow Posting To -> specify Salespers./Purch. Code -> configure approval limits.
• Customizing a Role Center Profile: Open Tell Me -> enter Profiles (Roles) -> select Profiles (Roles) (Page 9170) -> highlight profile (e.g., SALES ORDER PROCESSOR) -> select Customize pages -> navigate through the opened browser tab -> make layout adjustments -> select Done.

---

Common Pitfalls & Exam Gotchas

• The "Ghost User" Trap: Creating an account in Microsoft 365 and assigning a license does not make the user immediately visible in the Business Central User Setup lookup. The user must either sign in once (JIT provisioning) or the administrator must execute Update users from Microsoft 365.
• Blank Dates in User Setup: Candidates often mistakenly assume that leaving Allow Posting From and Allow Posting To blank on a User Setup line allows unlimited posting dates. In reality, blank fields tell the engine to fall back to the global restrictions defined in General Ledger Setup.
• Personalizing Instead of Customizing: An administrator who opens the Sales Order page, clicks the gear icon, and selects Personalize has only modified their own screen. To standardize a layout for a whole department, they must use Profiles (Roles) -> Customize pages.
• Disabling User vs Releasing License: Setting a user's State to Disabled on the User Card revokes Business Central access immediately, but the customer tenant will continue to be billed for the Microsoft 365 subscription until the license is unassigned in the Microsoft 365 Admin Center.