Manage Access to Environments
Note
Azure Active Directory is now Microsoft Entra ID. Learn more
This article describes admin center features that you use for controlling user access to environments. In addition to what you do in the admin center, these features typically require configuration and set up in either Business Central or another product or service.
Manage access using Microsoft Entra groups
To manage access at the environment level, you can assign a Microsoft Entra group to the environment. By assigning a Microsoft Entra group to an environment, only direct and indirect members of the group are granted access to the environment. Indirect members are users in another group, which itself is a member of the group assigned to the environment. Although all licensed users in Microsoft Entra ID will be added to the environment when it's synchronized with Microsoft 365, only group members can sign in.
From the Environments page, you'll see the currently assigned group in the Security Group column. Not set indicates that no group has been assigned. Not available indicates that the group that was assigned is no longer available in the Microsoft Entra ID.
Note
The restrictions imposed by a security group don't apply to administrators. Local and delegated admins can freely sign in to all environments, regardless of the assigned group.
Assign, change, or remove a group
Before you can assign a Microsoft Entra group to an environment, the group must be created in your Microsoft Entra tenant. For more information, see Create a basic group and add members using Microsoft Entra ID in the Azure documentation.
Select Environments, then select the environment on which you want to assign, change, or remove the group.
On the Environment Details page, the currently assigned group is shown under Security Group.
- To assign a group, select (Define).
- To change or remove the currently assigned group, select Modify.
The Edit Security Group pane shows the current security group, if any, followed by all the available groups in Microsoft Entra ID.
- To assign or change a group, search for and select the group from the list.
- To remove a group, select
under Current Security Group.
Note
If there are more than 10,000 groups in Microsoft Entra ID, they can't all be retrieved and displayed in the admin center. Instead, you'll see the message You have too many groups to display them all. In this case, you'll have to enter the object ID of the group that you want to assign. You get the object ID from the Azure portal.
Select Save when done.
Note
If you change or remove a group, it can take a while before the changes to take effect or access is revoked from users.
Manage access with Microsoft 365 licenses
To help Business Central users easily share and collaborate on business data with their coworkers, you can enable access with Microsoft 365 licenses. When enabled, users within the same organization who have an applicable Microsoft 365 license will be able to read (but not write) Business Central data that is shared with them in Microsoft Team—without needing a Business Central license.
Note
This setting is only available for environments of platform version 21.1 or later.
Enabling access to an environment is one of multiple steps required to configure this capability. We recommend that you complete all other setup steps before enabling access for an environment from the Business Central admin center. Learn more at Set Up Access with Microsoft 365 licenses.
To turn access on or off, complete the following steps:
- Select Environments, then select the environment on which you want to change license access.
- On the environment details page, select Modify for the Access with Microsoft 365 licenses setting.
- In the Microsoft 365 licenses pane, turn the switch on or off.
- Select Save and accept the confirmation dialog. The change takes effect immediately.