A Comprehensive Guide to Adding Users in Microsoft Dynamics 365 Business Central
- Abhisar Sharma
- Sep 11, 2025
- 10 min read
Updated: Oct 16, 2025
Adding users to Microsoft Dynamics 365 Business Central is a critical administrative task. It requires coordination between the Microsoft 365 Admin Center and the Business Central application itself. This guide provides an in-depth, step-by-step process to ensure a secure and efficient user setup. We’ll cover everything from license assignment to profile personalization, extending into post-setup lifecycle management.
Part 1: Managing the User in Microsoft 365
Before a user can access Business Central, they must have a valid user account and license in your Microsoft 365 (M365) tenant.
Step 1.1: Accessing the Microsoft 365 Admin Center
Open your web browser and navigate to the Microsoft 365 Admin Center at https://admin.microsoft.com.
Log in with a user account that has the Global administrator, User administrator, or License administrator role. These roles are essential as they grant the necessary permissions to create and manage user accounts and licenses.
Step 1.2: Creating a New User (if they don't already exist)
This step is for onboarding a brand-new employee who needs an M365 account for all services, not just Business Central.
In the left-hand navigation pane, go to Users > Active users.
At the top of the page, click the + Add a user button.
A wizard will appear. Fill in the required fields:
First name and Last name: The user’s legal name.
Display name: This is how the user's name will appear in email lists and directories (e.g., "John Smith (Finance)").
Username: This will be the user's login ID and email address (e.g., john.smith@yourcompany.com).
Under Password settings, we recommend selecting Let me create the password and Require this user to change their password when they first sign in. This ensures a secure, personalized password for the user.
Step 1.3: Assigning the Business Central License
Whether you've just created a new user or are adding a license to an existing one, the process is the same.
For a new user: After filling in the user's details, click Next in the wizard.
For an existing user: Go to Users > Active users, find the user, and click on their name. In the user detail pane that appears on the right, select the Licenses and apps tab.
Select the user's location, then scroll down to the list of licenses.
Choose the appropriate license:
Dynamics 365 Business Central Essentials: For users in core roles like finance, sales, purchasing, and project management.
Dynamics 365 Business Central Premium: For users who require access to the Service Management or Manufacturing modules.
Dynamics 365 Business Central Team Member: For users who need light access to Business Central. This allows reading data, approving workflows, updating existing records, and limited write access. It’s ideal for employees outside core finance or operations roles.
Click Next to review, then Finish adding (for new users) or Save changes (for existing users).
💡 Tip: The synchronization between the M365 Admin Center and Business Central is not instantaneous. After assigning a license, you may need to wait a few minutes before the user is available to be synced.
Part 2: Configuring the User in Business Central
Once the license is assigned, you need to configure the user's permissions and workspace within the Business Central application.
Step 2.1: Updating Users from Microsoft 365
This action "fetches" the newly licensed user from your M365 tenant and adds them to your Business Central environment's user list.
Sign in to Business Central with a user account that has the SUPER permission set. This is a critical prerequisite, as only super users can perform this administrative task.
In the top-right search bar (the magnifying glass icon), type Users and select the Users page from the search results.
In the ribbon at the top of the Users page, navigate to the Home tab.
Click the Update users from Microsoft 365 action.
A confirmation dialog will appear. Review the information and click Ok.
The new user will now be populated in the list of users in Business Central.
Step 2.2: Assigning Permission Sets
This is the most crucial step for security. Permission sets define exactly what a user can see, read, create, modify, and delete within Business Central.
On the Users page, select the new user's line and click on their Full Name to open their user card.
Scroll down to the User Permission Sets section. This is a FastTab where you will assign permission sets.
When a Business Central license is assigned in Microsoft 365, Business Central applies the corresponding built-in entitlement and grants the associated system permission sets. You may need to run Update users from Microsoft 365 in Business Central to sync new or changed licenses. Typical mappings include:
D365 BUS PREMIUM - Assigned for users with a Business Central Premium license; includes premium entitlement pieces (manufacturing, service management) in addition to core capabilities.
D365 BUS FULL ACCESS - Assigned for users with a Business Central Essentials license; provides full access to core business functionality (finance, sales, purchasing, projects).
D365 TEAM MEMBER - Assigned for Team Member licenses (light-use); provides limited read/approve/update rights and restricted write access appropriate for casual users.
Common supporting system permission sets you will also see are: D365 READ (read-only access), LOGIN (minimal sign-in rights), SECURITY (user/permission administration capabilities), and TROUBLESHOOT TOOLS (diagnostics/maintenance utilities). Some localization/system sets (for country/region features) such as LOCAL / LOCAL READ exist as system-defined sets.
Note: Administrators often create custom permission sets or map permission assignments via Azure/Entra security groups to scale and control access. Permission-set names and exact entitlement compositions can vary slightly between releases, so verify the mapping in your tenant if you see differences.
To add any additional, more specific, role-based permissions, click on an empty line in the Permission Set column. A drop-down list will appear. D365 SALES, D365 ACCOUNTS PAYABLE, D365 ACCOUNTS RECEIVABLE: These are role-specific permission sets.
To grant access to data in a specific company, you must also specify the Company in the permission set line. For full access across all companies, leave the Company field blank.
🔑 Best Practice: A common mistake is assigning too many permissions. Follow the "principle of least privilege." Assign the most basic permission sets first and only add more as the user discovers they need access to specific pages or reports.
Step 2.3: Configuring User Settings and Personalization
This step customizes the user's experience, providing them with the most relevant Role Center and default company upon login.
On the Users page, select the user's line.
In the ribbon at the top, navigate to the Navigate tab.
Click User Settings.
On the User Settings page, you can set the following:
Profile ID: This determines the user's Role Center (their homepage and primary navigation). Select a profile that aligns with their job, such as Accountant, Sales Order Processor, or Business Manager.
Company: If your Business Central environment has multiple companies, this field sets the default company that will load when the user signs in.
💡 Tip: Choosing the right Profile ID reduces clutter and simplifies the user's navigation. A salesperson doesn't need to see the purchasing or manufacturing menus, and an accountant doesn't need a sales dashboard. This personalization makes the system more user-friendly.
Part 3: Special Case: External Accountant Access
Business Central offers a unique and valuable feature: up to three free External Accountant licenses per tenant. These licenses are specifically designed to be assigned to your professional accountants, enabling them to work directly in your system. There are two primary methods for granting this access, depending on your administrative preference.
Why Use an External Accountant License?
Cost-Effective: You can assign up to three free licenses to your external accountants, saving you the cost of a full, paid Business Central license.
Secure & Controlled Access: The license provides the accountant with the specific permissions they need to manage your finances without giving them access to sensitive operational areas like managing users or altering system configurations.
Streamlined Collaboration: By working directly in your Business Central environment, your accountant can collaborate in real-time, performing tasks like reconciliations and month-end closes more efficiently.
Specialized Expertise: This license allows you to leverage the expertise of a financial professional to ensure your records are accurate and your business remains compliant.
Method 1: Using the "Invite External Accountant" Action (Recommended)
This method simplifies the process by initiating the invitation directly from within Business Central.
In Business Central, open the Users page.
In the ribbon, select Invite External Accountant.
An email template will appear. Enter the external accountant's work email address and send the invitation.
The accountant will receive an email with a link to create a guest user account in your tenant.
Once the accountant accepts the invitation, they will be automatically assigned an External Accountant license in your M365 tenant and a user record will be created in Business Central.
Open their user card and assign the ACCOUNTANT permission set. This will give them full access to financial data, reports, and reconciliations.
Method 2: Manually Adding the Accountant via the M365 Admin Center
This method gives you more granular control over the user creation process.
Log in to the Microsoft 365 Admin Center at https://admin.microsoft.com with a Global Administrator or User Administrator account.
Navigate to Users > Active users and select Add guest user.
Fill in the accountant's work email address and other details.
Once the guest user account is created, assign them the Dynamics 365 Business Central External Accountant license.
Finally, return to Business Central, navigate to the Users page, and run the Update users from Microsoft 365 action. The accountant will now appear in your user list. Open their user card and assign the ACCOUNTANT permission set.
Actions an External Accountant Can Perform
An External Accountant license grants permissions that are specifically designed for professional accounting work. With this license and the ACCOUNTANT permission set, the accountant can:
Access real-time financial data, including sales, expenses, and inventory data.
Create and run financial reports, such as balance sheets, income statements, and cash flow reports.
Manage and reconcile bank accounts, process payments, and perform other accounting tasks.
Collaborate with clients on financial matters, such as creating budgets, forecasting future growth, and identifying cost-saving opportunities.
The license prevents them from performing operational tasks or making changes that could impact the daily business operations of your company. They cannot:
Use the license as a full Business Central user. The license does allow them to be assigned a Team Member role, giving them limited access to specific client data for closer collaboration.
Access or modify the settings or configuration of a client's Business Central system.
Create or modify users or roles within a client's Business Central system.
🔑 Best Practice: The External Accountant license is a powerful security feature. It ensures that an external party has all the access they need to do their job without being able to access or modify your core business operations.
Part 4: Post-Setup User Lifecycle Management
Once a user has been successfully created, licensed, and configured in Business Central, the work doesn’t end. Administrators should actively manage users throughout their lifecycle.
Step 1: Testing User Access
After permissions and settings are configured, it’s important to confirm that the user can log in and access what they need.
Ask the user to sign in at https://businesscentral.dynamics.com with their Microsoft 365 credentials.
Verify that they are taken to the correct Role Center (homepage) and default company.
Confirm that they can open the key pages/reports they need for their job (e.g., Sales Orders, General Journal).
If the user encounters errors like “You do not have permission to perform this action,” double-check their Permission Sets and Company access.
💡 Best Practice: Always test with the actual end user. As an admin with SUPER permissions, you may not see the same limitations they do.
Step 2: Monitoring and Auditing User Activity
Keeping track of who has access to what - and how they’re using it - is essential for compliance and security.
Change Log Setup:
Use the Change Log feature to track modifications made by users (e.g., posting transactions, editing master data).
Configure it under Change Log Setup to capture important table changes.
Audit Reports:
Run Permission Reports to check which roles/permissions are assigned to each user.
This helps identify if someone has broader access than they should.
User Sessions:
In the Business Central Admin Center, navigate to your environment and select Manage Sessions.
This shows which users are currently logged in and allows you to end sessions if needed.
🔑 Tip: Schedule a quarterly review of user access with department heads to ensure users still need the permissions they’ve been granted.
Step 3: Modifying or Removing Users
When employees change roles, go on leave, or leave the company, you need to adjust their access.
Modifying Access:
Go to the user card in Business Central.
Add/remove Permission Sets based on their new responsibilities.
Update their Profile ID (Role Center) if their day-to-day work has shifted.
Disabling Users:
If a user should no longer access Business Central (e.g., resigned), go to their User Card.
Toggle State to Disabled.
This prevents login but preserves their transaction history for audit purposes.
Removing Licenses:
In Microsoft 365 Admin Center, remove the Dynamics 365 Business Central license from the user.
If they have left the organization entirely, delete their Microsoft 365 account.
💡 Best Practice: Never delete a user directly from Business Central, as this can break data references. Always disable first, then manage licensing in M365.
Step 4: Best Practices for User Management
To wrap up, here are some ongoing best practices that keep your system secure and efficient:
Principle of Least Privilege: Always start with minimal permissions and expand only as needed.
Document Roles: Maintain an internal guide that maps job titles (e.g., Accounts Payable Clerk) to required Permission Sets. This speeds up onboarding.
Use Security Groups (Azure AD): Instead of assigning licenses/roles one by one, assign them to groups. This reduces human error.
Regular Access Reviews: At least once per quarter, validate that all users’ permissions are still appropriate.
Monitor External Users: Keep a special watch on external accountants or consultants - disable access immediately once they no longer need it.
Stay Updated: Microsoft releases updates to Business Central twice a year. Review release notes, as permissions or role centers may change.
By following these guidelines, you can ensure that your user management process in Microsoft Dynamics 365 Business Central is efficient, secure, and tailored to your organization’s needs.