What is the difference between a Dataverse security role and a Business Central permission set?
By Emil Björk · Microsoft business apps consultant, Gothenburg
They're the same concept in different products with different mechanics. A Dataverse security role grants privileges (Create, Read, Write, Delete, and more) per table at a chosen access level (User, Business Unit, Organization). A Business Central permission set grants operations (Insert, Modify, Delete, Execute) per table, page, report, or codeunit, with no built-in ownership hierarchy.
Dataverse's model layers ownership and business-unit hierarchy on top of the role itself — the same role can grant different effective access depending on who owns a given record and where they sit in the org hierarchy. Business Central's permission model is flatter: a permission set grants or denies specific operations on specific objects, with company-level scoping available but no ownership hierarchy equivalent to Dataverse's.
Both models support the same design principle — build roles/permission sets around job function, not individual users — but the actual troubleshooting and design work differs enough that experience with one doesn't fully transfer to the other.
Go deeper
- The Dataverse security modelRoles, business units, teams, row sharing, and field-level security in Dataverse — the layers that protect data in Dynamics 365 CRM and Power Apps.
- Permissions and security in Business CentralHow Business Central security really works — permission sets, user groups, security filters, and the data residency boundaries you should know about.
- Business Central permission errorsThe Business Central permission-set errors that stop a user cold — cause, fix, and how to design permission sets that avoid them.