Business Central users are tied to Microsoft Entra ID (formerly Azure Active Directory) accounts. This means you manage the underlying identity in Microsoft 365 or Entra ID, and then pull those accounts into Business Central to assign licenses, roles, and permissions.
This guide covers the full process: adding users, assigning licenses, setting a default profile, and disabling or removing access.
How BC Users Work
Every user in Business Central must have a corresponding Microsoft 365 account. Business Central does not maintain its own authentication, it relies entirely on Entra ID for sign-in. A user who exists in BC but has no active Microsoft 365 license cannot log in.
In a cloud (SaaS) environment, you manage licenses through the Microsoft 365 admin center and import those users into BC. On-premises deployments use Windows authentication or NavUserPassword authentication and do not require Microsoft 365 accounts.
Add Users from Microsoft 365 (Cloud)
- Search for Users using
Alt + Qand open the page. - Select Get New Users from Microsoft 365 in the action bar.
- Business Central will retrieve accounts from your Entra ID tenant that do not yet exist in BC.
- Review the list and select which users to import.
- Choose Import Selected Users (or import all).
Imported users will appear on the Users list. They will not have any permission sets assigned yet.
Assign a License Type
Each user needs a license assigned in BC to determine which features they can access.
- Open the User Card for the user.
- In the License Type field, select one of the following:
- Essential, covers most finance, sales, and purchasing functionality
- Premium, adds manufacturing and service management
- Team Member, read access and limited write access
- Device, for shared devices such as warehouse terminals
- Internal Admin, for delegated admin access (partners/IT)
The license you assign in Business Central must match the license assigned in the Microsoft 365 admin center. If there is a mismatch, the user may receive an error when logging in.
Set a Default Profile
A profile controls which Role Center the user sees when they log in.
- On the User Card, go to the User Personalization section.
- Set the Profile (Role) field to the appropriate profile, such as Business Manager, Accountant, or Sales Order Processor.
- Optionally, set a Language and Time Zone for the user.
If no profile is assigned, the user sees the default profile configured on the Profiles (Roles) page.
Create a User Manually (On-Premises)
On an on-premises installation, you can create users directly without syncing from Microsoft 365.
- Search for Users and open the page.
- Select New.
- Enter a User Name and Full Name.
- Set the Authentication Type, typically Windows for domain accounts, or NavUserPassword for local credentials.
- For Windows authentication, enter the Windows Security Identifier or use the lookup to find the domain account.
- Assign permission sets as needed.
View the User Card
The User Card is the central place to review and edit a single user’s configuration.
| Field | What It Controls |
|---|---|
| User Name | The login identifier |
| License Type | Which BC feature set the user can access |
| Profile (Role) | The default Role Center |
| Permission Sets | What the user is allowed to do |
| State | Enabled or Disabled |
Disable a User
Disabling a user prevents them from logging in without deleting their record or removing their license.
- Open the User Card for the user.
- Change the State field from Enabled to Disabled.
- Close the card. The user will not be able to sign in immediately.
This is the recommended approach when an employee leaves temporarily or is on leave. It preserves all their settings and audit history.
Delete a User
Deleting a user removes them from Business Central. Their posted transactions and audit records remain intact, the name will still appear on historical entries.
- Open the Users list.
- Select the user.
- Choose Delete from the action bar.
- Confirm the deletion.
Note that the Microsoft 365 account and license are not affected. You still need to remove or reassign the license in the Microsoft 365 admin center separately.
Cloud vs. On-Premises User Management
| Area | Cloud (SaaS) | On-Premises |
|---|---|---|
| Identity provider | Microsoft Entra ID | Windows AD or NavUserPassword |
| License management | Microsoft 365 admin center | BC license file (*.flf or .bclicense) |
| User import | Get New Users from Microsoft 365 | Manual or Windows AD sync |
| Password reset | Microsoft 365 / Entra ID | IT admin or BC admin |
On-premises environments do not have automatic sync with Microsoft 365. User management is handled entirely within the BC Administration Shell or the BC client.
To control what each user can do once they are added, see How to Assign Permission Sets in Business Central.