This module contains shared objects and functionality with other modules we are currently developing. For use (and on premise compilation) of Compliance Field Security is required for compiling and use of , both as objects and in the license. The module comes with no additional costs and is by default attached to any Compliance Field Security installation on Microsoft Dynamics 365 Business Central.This module contains shared objects and functionality with other modules we are currently developing. For use (and on premise compilation) of Compliance Field Security is required for compiling and use of , both as objects and in the license. The module comes with no additional costs and is by default attached to any Compliance Field Security installation on Dynamics 365 Business Central.
Default Business Central (both on-premise and hosted versions) offers no functionality to secure or validate fields within tables. Often, the default permission sets do not provide the desired level of security. Furthermore, you cannot easily apply security based on a filter in. Finally, in default Business Central it is not possible to secure actions on pages.
The extension Compliance Field Security offers the possibility to secure fields, actions on pages and datasets in tables. With the module Field and Dataset Security the data owners are able to manage their own field security and dataset security.
To be able to use the Field Security extension, it is required to register the module.
Here you will find how to do this.
Field Security revokes fields from particular users.
Creating a Field Security to authorize users to edit specific fields of a table with the wizard :
Search for Field Security Setup Wizard and click on “Next”.
Toggle the switch for Field Security to on.
Click “Next”.
Choose a table in which you want to secure the fields. You can type the object id or the table name in the field Table ID
After selecting the table, you can choose individual fields on the lines.
Depending on the number of fields you want to secure, you can enable Default Editable. As shipped the software disables editing of defined fields, but when Default Editable is enabled you only have to define fields which are editable. For now, we assume Default Editable is disabled.
Add the fields you do not want users to be able to edit by clicking AssistEdit button of the Field No. on the first line.
A list with all fields in the table opens. Choose the field(s) you want to secure and confirm with “OK”.
The field Description allows you to document the purpose of securing the field (e.g. posting groups only for manager)
The field Error Message allows you to have a specific error message pop up when the validation kicks in and a warning appears.
In the field of Not Assigned Perm. Sets, the (number of) Permission Sets are shown who are allowed to edit the field. When you click on the button Assign Permission Sets, you can add the permission sets which will not be allowed to edit the field. You can do this by clicking on Edit List (after you clicked on the button Assign Permission Sets) and filling in the permission set. Should you want one of the permission sets mentioned in the Not Assigned column to move to the Assigned column, you have to click on the number in that field. This opens the overview of the Not Assigned permission sets. Click on the permission set you want to move to the Assigned column and then click on Link Permission Sets.
When you are done choosing the fields and/or arranging the permission sets, click on “Next” and then “Finish”. The system automatically has assigned the date of today being the Starting date for that Field Security.
The Field Security is inactive until the Starting date contains a date in the past or today or if the field End Date contains a date in the past. (!)
The user who set up this Field Security should log out and then in again of Business Central to activate this Field Security.
This applies also to the user(s) for which this Field Security was set up.
Search for Field Security List.
Click on “New”
The page will open with a new Field Security to be made :
No. : If you have an automatic no. series setup, generally this number will be created automatically when you choose a table to set a security for. Otherwise, fill in a number manually.
Description : Add a Description for this record e.g. Secure posting groups items.
Table ID : Select a table to secure
Table Caption : Will be filled in automatically after selecting the Table ID.
Default Editable (toggle) : Depending on the number of fields you want to secure, you can enable Default Editable. As shipped, the software disables editing of defined fields, but when Default Editable is enabled you have to define fields which are editable. For now we assume Default Editable is disabled.
Starting Date : To activate the Field Security, you will have to fill in the date of today, or a date in the past
Error Message : Fill in a specific error message you want to pop up when the security kicks in and a warning appears.
Show more : clicking on “Show more” will show more fields in the header :
Filter Field No. : Use the AssistEdit button to choose a field you want the Field Security to be filtered on to be active
Note that you can only filter on fields in the same table you wish to set up the field security for.
Filter Field Caption : Description of the chosen Filter Field No. (filled automatically)
Filter Value : Enter the value of the Filter Field No. which will be the filter for the table for which the Field Security is setup
The field security is now only active on lines in the table that adhere to the filter setup in the “Filter Field No.” and “Filter Value”.
Ending Date : Set an end date if you would like the Field Security to become inactive after a specific date
Setup Field Security rules in Tab “Lines” :
In the field security lines you can set up your rules for that table (and field filter, if set)
Field No. : use the AssistEdit button to add the field you do not want users to be able to edit. A list with all fields in the table opens. Choose the field you want to secure and confirm with “OK”.
Field Caption : will be filled in automatically after a field no. has been chosen.
Editable : this box will be checked by default when the toggle “Default Editable” is set to “No”. If the toggle is set to “Yes”, this box will be unchecked by default.
No. of Assigned Permission Sets : shows the number of Permissions Sets to which that security line is active. When you want to remove an assigned permission set from this column, click on the number in that column. You can choose several sets by clicking on the 3 vertical dots and choose “select more”. With the 3 dots in the top you can choose to :
If you would like to remove only 1 set from that column, you can click on the 3 vertical dots and choose “Delete”
For these permission sets, you can also set if a permission set should be valid for a specific company only, if that permission set is allowed Initial Field Entry and a Starting and Ending Date.
You can edit these options when using the “Edit List” on top.
No. of Not Assigned Perm. Sets : shows the number of Permission Sets not assigned to that security line. Click the number in that field to move a set to the Assigned column. This opens the overview of the Not Assigned permission sets. Click on the permission set you want to move to the Assigned column and then click on Link Permission Sets.
Description : option for additional information (does not show up in the message)
Error Message : when the toggle “Default Editable” is set to “No”, you can not set a specific message per line. If the toggle is set to “Yes”, you can set a specific message per field line.
Options in the top bar of the lines :
Manage : when lines are already setup, the 2 options will become available :
Line : shows the option of “Assigned Permission Sets” to show the sets assigned to the line which was selected
Functions : shows the option “Copy linked permiss…all Security Lines” which will copy the linked permission set of the selected line to the other lines (you will be opted if this is what you want)
Options in the top bar :
Calculate Summary : allows you to calculate the sources (Users or Permission Sets) associated with the secured table. (more details)
Calculate unlinked User/Permission Sets : to calculate the unlinked Users/Permission Sets concerning that particular security. (more details)
Comments : usually you use this option to fill in who and when the Field Security was set up and to keep track of the changes made in the Field Security. (version history)
! Note :
The Field Security is inactive until the Starting date contains a date in the past or today or if the field End Date contains a date in the past. (!)
The user who set up this Field Security should log out and then in again of Business Central to activate this Field Security.
This applies also to the user(s) for which this Field Security was set up.
Field Security accepts plain text filters and numbers. Furthermore, any filter used on a list in Microsoft Dynamics 365 Business Central is accepted. The only limitation is that filter values must be plain text, i.e. use of variables (like T for today's date), SQL queries and calling methods is not supported.
You can test any filter before configuring the field security on the list itself; e.g. if you want to filter items on the field Type, you manually filter on the value and test whether it works with the values as expect. Any line in the results is authorized to the user.
Syntax | Character Description | Description | Example |
---|---|---|---|
Value | Equal to the value that is entered. | Type the value to find. | Smith finds “Smith”. |
Value* (asterisk) | Starting from the value that is entered. | Type the starting value and then an asterisk (). | S finds any string that starts with “S”, Such as “San Francisco”. |
*Value* (asterisk) | Containing the value that is entered. | Type an asterisk, then a value, and then another asterisk. | *th* finds any string that contains “th”, such as “Northeast”. |
? (question mark) | Having one or more unkown characters. | Type a question mark at the postion of the unkown character in the value. | Sm?th finds “Smith” and “Smyth”. |
Value | Value (pipe character) | Select multiple values from e.g. an option field, separated by | selecting Multiple values. | Works like Or. The only option when filtering on an option field. | Invoice, Credit Memo finds Invoice or Credit Memo |
In addition to a complete block modification of fields, field security also has the ability to allow an initial entry and block any modification afterwards.
A scenario for this is creation of customers and vendors based upon templates: a user can create a new customer based upon a template by which the fields for posting groups are filled automatically. After creation the fields cannot be modified by users not authorized to do so.
Follow these steps to enable initial field entry for the posting groups in the customer table in an existing field security.
Default Business Central offers no functionality to secure subsets of data within tables. With the extension Field Security you can define filters with which you can limit the permissions of users. Note that filtering is supported on any field type except flow fields and only fields in the same table as the records you want to filter on.
The principle of the extension is to permit editing with authorized permission sets. An active security filter has today's date or a date in the past in the field Start Date.
Search for Field Security Setup Wizard and click on “Next”.
Toggle the switch for Filter Security to on.
Click “Next”.
Choose a table in which you want to secure the fields by clicking the AssistEdit button. Alternatively, you can enter the object Id or the table name in the TableID field.
After selecting the table, you can add filters on the lines.
- Choose a field you want to use for splitting the table in field Filter Field 1. You can also enter the field Id.
- Enter the value on which you want to filter in the field Filter 1 by text. For “option” fields (e.g. Document Type in table Purchase Header) the options might be retrieved by entering 0|1|2|3|4|5|6|7|8|9 (Quote|Order|Invoice|Credit Memo|Blanket Order|Return Order|6|7|8|9) . The software retrieves the textual value, after which you can remove any filter you do not need.
In Filter Security, we made it possible to use calculated filters.
For instance, with a calculated filter security you can make only Sales orders visible for the logged in user (by using the calculated filtering on the Sales person code) of a certain period of time (e.g. only orders of this month).
Search for Filter Security List.
Click on “New”
Select the ID of the table that you want to secure on field level. You can use the list of tables or enter the object id directly. A Filter Security record number will be made automatically.
Add a Description for this record. In this example we will filter on table 38, so we use this as the description: Filter Security table 38
Filter Security splits a table using filters on fields in the same table. Through permission sets, a part of a table is assigned. Any permission set might be used, but for ease of administration and documentational purposes, the use of clear names and descriptions is strongly recommended.
As an example : in the case of document types, six permission sets are required, for each document type one. You could, for instance, use the following permission set names for Purchasing :
Purchase documents consist mainly of two parts: the header and the lines.
On the header information about the vendor, invoice and payment is stored.
The contents of the document are defined in the lines, such as the number of items and the price. For a correct authorization of purchase documents you need two filter securities: one for each table.
First we configure splitting up table Purchase Header.
Set up a filter :
The field Document Type is an option field. This means it only accepts predefined input. Enter 0 in the field “Filter 1”. If you leave the field, the page retrieves the document type: Quote. The options in default Business Central are:
Filter security only works when assigned to permission sets.
Assign permission set(s) to the filter line :
Now that the purchase header is split up, we can do the same for the lines. Business Central supports creating several types of lines, by default ' ', which is used for text and empty lines, G/L Account, fixed assets and Charge (item). For company Rents we authorize on both the document type and line type, for which we need a second filter as follows.
Create a new filter security and choose the table Purchase Line (for this example) which is object id 39.
Just like for the table Purchase header, we need to filter on the field Document Type.
For quotes, enter option id 0 in the field “Filter 1”. The textual values are retrieved.
The second filter is on the line type. Open the Field List by choosing the AssistEdit button of the field “Filter Field 2” and choose Type. Alternatively, enter the field id 5.
For quotes, enter option id 0|2|5 in the field “Filter 2”. The textual values are retrieved.
This is the filter on the lines of purchase quotes. Now, in this example, we need to assign the permission set “PUR-QUOTE” to these filters.
Select the line and choose “Assigned Permission Sets”. The page Permission Sets opens.
Click “New” if the permission set isn’t visible and click on the AssistEdit button.
You can filter on the name of the permission set, choose it and click “OK”.
Do this for every document type as described in the overview above and choose the appropriate Assigned permission set.
For unique assignation, every document type needs a separate line.
! Note : the filter security is only active if assigned to permission sets. It is inactive if assigned permission set(s) assigned to the filter security AND a permission set with both insert, modify – and optionally delete- permissions NOT assigned to the filter security.
The Filter Security is inactive until the Starting date contains a date in the past or today or if the field End Date contains a date in the past. (!)
The user who set up this Field Security should log out and then in again of Business Central to activate this Field Security.
This applies also to the user(s) for which this Field Security was set up.
In addition to the functionality presented by default, filter security offers some more advanced options.
Filter Security accepts plain text filters and numbers. Furthermore, any filter used on a list in Microsoft Dynamics 365 Business Central is accepted.
The only limitation is that filter values must be plain text.
Use of variables (like T for today's date), SQL queries and calling methods is not supported.
You can test any filter before configuring the field security on the list itself;
e.g. if you want to filter items on the field Type, you manually filter on the value and test whether it works with the values as expected. Any line in the results is authorized to the user.
A Calculated Filter allows you to filter by System Variable (User ID, User Security ID and Current Company, by type Date Formula and by the logged in user where the system can use the table 91 (User Setup) and table 156 (Resource).
In the User Setup the User ID is available. The filter on the Resource is based on the field Time Sheet Owner User ID.
These filters are dynamic filters (based on the logged in user):
1. Date Formula: e.g. only orders in the current month will be visible or available to edit. (Entering dates and times in Business Central - Business Central | Microsoft Learn) The formulas are placed between angle brackets <> to make them universal.
2. System Variabels: you use data which will be available in the current sessions regarding :
3. Related Field: You use values from tables related to the currently logged in user, where there are 3 starting points:
With these starting points, you will be able to establish a relationship with other tables, which allows you to use those values for dynamic filtering. E.g.: filter on the purchaser code related to the logged in user, or filter on employee number of the user, or filter on the cost center of the employee of the user, etc.
The field Filter Value Type must be set to Calculated. After that, a Calculated filter can be selected in the Calculated Filter Field. Examples of Calculated Filters can be imported from the Calculated Filters setup page with the button Load Demo Data.
Permission to edit a part of the table is granted through assigning of a permission set to a line in the filter security. Assign permission set(s) to the field you entered in the previous step.
To assign permission set(s) to a filter:
! Note : the filter security is only active if assigned to permission sets. It is inactive if assigned permission set(s) assigned to the filter security AND a permission set with both insert, modify - and optionally delete - permissions NOT assigned to the filter security.
The Filter Security is inactive until the Starting date contains a date in the past or today or if the field End Date contains a date in the past. (!)
The user who set up this Field Security should log out and then in again of Business Central to activate this Field Security.
This applies also to the user(s) for which this Field Security was set up.
It is possible to use multiple filters for a much more detailed authorization, e.g. in table Sales Header
In this example it is filtered that a Sales Order is editable only by the Salesperson that is logged in and only with an Order date in the current month.
If you need more than two filters, you can also add the same permission set to more lines in the filter security.
Compliance Field Security has the option to hide parts of a table based upon filters, e.g. posting groups or G/L account numbers. If used, the extension hides any lines users are not authorized to see. No custom code is necessary.
At the moment only default pages in Dynamics 365 Business Central are supported.
Filtering is only possible in the same table.
Assign permission (set(s) to the filter line :
! Note : the filter security is only active if assigned to permission sets. It is inactive if assigned permission set(s) assigned to the filter security AND a permission set with both insert, modify – and optionally delete- permissions NOT assigned to the filter security.
Search for Action Security List and choose the related link.
A list of Action Securities will show.
In order to assign an Action security to a user, you have to assign Permission sets to the Action security.
If a user is linked to a Permission set that is linked to the Action security, this means that the user can NOT execute the action.
Select the correct line and click on Permission Sets.
With “New” you can add Permission Sets to this Action security.
With the AssistEdit button you can select one or more Permission sets.
When you are finished, click “Close” to return to the Action security list window.
The user for which you have set up an Action security should log out of Business Central and log in again to activate the Action security.
You cannot delete, rename or change the description of Action Securities as they are delivered with Compliance Field Security. If you have suggestions for new Action Securities please let us know.
With Compliance Field Security it is possible to setup visibility filters on records and to secure actions on pages. By default, this is possible for various default Dynamics 365 Business Central pages and actions (see Action Security List and Pages with Visibility Security). This is done by using event subscribers on those pages / actions.
If you want to apply this to non-standard pages and actions included in add-ons or customizations, you have to add your own events for these pages.
The events that should be added are shown below for the Filter Security and Action Security.
For the Field Security you can use a page extension customization for the visibility and/or editability of fields or even columns.
If you wish to add events for Dynamics 365 Business Central standard pages and actions that are not yet available in our app, please send an event request to support@2-controlware.com in which you specify what kind of event and on which page or action you would like to add.
You can change the visible and/or editable properties of a field on a page by implementing a Page Extension, which uses the Field Security app logic, to determine whether a field is visible and/or editable or not.
! Note : Keep in mind, that other extensions, which might also change the same properties, may affect the functioning of this Page Extension.
Example of a visible/editable security on the Employee Card:
Start by creating a custom codeunit in which you can define all the needed event subscribers. Do not forget to assign permissions to this codeunit for the relevant users. Furthermore, we strongly advice to first implement the new events in a test environment.
To setup an event subscriber for visibility security, use the code below:
Example of a visibility security on customer list:
In Filter Security, records can be hidden based on a filter, as long as a certain event has been added to the page where the security is applied that calls our code. We did that for standard Business Central pages, out of the box for a lot of pages. If you choose a table in a Filter Security, you can see a field in the header (under “Show more”) that shows the number of pages related to the chosen table.
When a page you would expect is not visible there, it probably is a custom / add-on page and a piece of customization will have to be added to be able to use the visibility filter on it. Simple customization concerns one event per page with almost the same code.
Start by creating a custom Codeunit in which you can define all the needed event subscribers. Do not forget to assign permissions to this Codeunit for the relevant users. Furthermore, we strongly advice to first implement the new events in a test environment.
To setup an event subscriber for action security, use the code below:
Example of action security for Release on Sales Order:
Finally, for action security you have to add a record to table 70078130 that includes a new Action Security record so you can assign permission sets to it. You can use RapidStart to create this record. Example of a record:
Type | Page ID | Action Name | Page Name | Page Caption | Table ID | Table Name | Table Caption | Description |
Action | 39 | Post | General Journal | General Journals | 5406 | Prod. Order Line | Prod. Order Line | Post |
In this overview you can find the effective situation of Field and Filter Security.
With the settings you can determine what exactly you would like to see; all fields with permission per source or only the fields in the Field or Filter security.
You can setup how you want the overview to be shown when you go to / search for Field Security Setup.
You can choose between :
When you search for “Summary of Field Security per Source” or “Summary of Filter Security per Source” and have opened that screen, you can click on the exclamation mark button on the top right corner which expands the Factbox pane on the right side of your screen.
You can do this on the main screen when opening the Summary
Or when you have opened the screen of the Field Security itself (by clicking on “Field Security” on the top left of the screen)
Where you can also click on the exclamation mark button in the top right of the screen.
Click on “Calculate Summary” to get the current active Field Securities which have been set up.
When you click on a line, the factbox will show what applies to that security only.
E.g. when you click on a line of a user, the factbox will only show the permission sets of that user that play a role in that security.
The same for the line of a permission set, in that case the factbox will show only the objects that play a role in that security.
The permission sets shown in the summary are the sets that are applicable for that security, regardless of the users summarized.
! If you have expanded the Factbox pane and want to add a filter, it is recommended to expand the view of the screen, to maintain a readable overview of the summary.
To filter the summary you can click on “All” on the left top side of the screen and choose for “Show filter pane”.
In this pane you can filter the list on e.g. the Source Type. When you have chosen the filter Source type, the listbox will show the available types to filter on.
If you want to cancel this filter, simply click on the cross in front of what you choose as a filter.
If you have set a filter which you intend to use more often, it is possible to save that setting by clicking on the “save as” button and to fill in the name you want that filter to be saved as.
Once you have saved that setting, this setting will appear when you open the Summary a next time.
And
If you want view according to another filter which you have not saved, you can click on the “Filter” icon in the top right corner.
The summary with the available views is shown, together with the option “Filter list by:” to apply a (new) filter on the view.
Since our release 5.1.202404NN.0 from April 2024, some functionality has been added to make it easier to check Field- or Filter security settings :
- A Calculate Summary button has been added to the Field Security page, which allows you to calculate the sources (Users or Permission Sets) associated with the secured table. On the Field Security Summary by Source page, you can set filters on a source and create a new calculation using the Calculate Summary function. When the calculation is complete, you will only see the results for the filter used.
- A second button is added to calculate the unlinked Users/Permission Sets concerning that particular security. In this summary you can see in the column Cause Permission Set ID why the user is not linked to the secured table. On this basis, you can find an error in the setup and correct this easily.