Dynamics F/SCM Customer Experience (CRM) Dynamics GP Dynamics Business Central (NAV) Dynamics SL Power Platform Fabric Copilot

[Traci Albosta]

We are using NAV 2017.  I have been told that it is “bad” to give all of your users SUPER permissions.  I am attempting to set up my production department with the permissions necessary to do their job.  I have started by giving them every permission associated with INVT, MFG, P&P, WM as well as BASIC and FOUNDATION.  Now my Production Manager cannot make an Item Journal entry because of the following error : You do not have the following permissions on Table Data G/L – Item Ledger Relations: Insert.  I have added the ability to read G/L account schedules, Read G/L accounts and entries and read G/L registers.  I have also tried adding the ability to edit all of these.  Nothing allows him to post the Item Journal.  Any suggestions?  I still need to set up the other departments, but am trying to get Production to work first.  Thanks for any help you can offer.

——————————
Traci Albosta
Comitt Well Solutions LLC
Katy TX
——————————

[Kim Dallefeld]

My recommendation is to setup a permission set for your Company, maybe something like CWS-MFG. Then add ‘indirect’ permission for the G/L Item Ledger Relations table. You might need other company specific permission, so create your own permission sets as needed and add to them to get your permissions as desired.

——————————
Kim Dallefeld
NAV Consultant
Past NAVUG Chair
NAVUG Programming Committee
Ft Worth, TX
Kim@Dallefeld.com
——————————
——————————————-

[Aaron Brown]

Have you tried using the permissions recorder feature available in 2017?   Using this tool, you can then a super user perform a transaction.  You can then review all of the permissions they needed to perform that transaction and use those to set up a specific job function permission set. 

Here are some links for using the permissions recorder:

Record Permissions: How to create user permissions by recording permissions automatically in Microsoft Dynamics NAV 2016: Microsoft Dynamics Nav 2016 tutorial – Microsoft Dynamics NAV Community

How to Use the Permissions Recorder in Dynamics NAV 2017
 

——————————
Aaron Brown
Director of Finance
Oregon Ice Cream
Camas WA
——————————
——————————————-

[Ashley Russell]

Hi Traci,

First – it is definitely a good practice to limit permissions in NAV.  This can be a difficult and time consuming process.  What you are doing is good though – add the minimum and then add a few permissions at a time as needed. 

We are on NAV 2016.  We created a copy of BASIC where we added any additional permissions needed and custom object permissions.

We added Indirect permissions to the G/L – Item Ledger Relation under our custom BASIC permission set. (For anyone posting transactions, this seemed to be necessary – thus we added to BASIC).  Since it is indirect, no one will be able to do anything directly to that table.

In other cases you may want to make a custom permission set if the permission error is more narrow or specific to a certain area.  In this case though – G/L – Item Ledger Relation will be needed in many areas.

(I accidentally also sent this to you in a message).

——————————
Ashley Russell
Business Project Manager
LBX Company LLC
Lexington KY
——————————
——————————————-

[Liz Piteo]

Hi Traci! 

Yes, generally it is a bad idea to give every user SUPER permissions.  You would want to limit users to have access to permissions that are in line with their job functionality in order to limit any potential risks to your system whether intentional or unintentional.  Also, auditors don’t like SUPER users very much – they get very persnickety about that.

The permissions recorder is a great tool and this is a good blog post that gives some detailed info about it.  There are also a link in there to Best Practices for Setting Up Security in NAV which has some useful information.  

How to Use the Permissions Recorder in Dynamics NAV 2017

Gofastpath		remove preview
How to Use the Permissions Recorder in Dynamics NAV 2017 Also Recommended: Best Practices for Setting Up Security in NAV The release of NAV 2017 includes many new things and improvements. If you want to read about what’s new you can check out this blog: New in NAV 2017. The improvement we are most excited about can be found in the permissions recorder that makes setting up permissions even easier. View this on Gofastpath >

——————————
Liz Piteo
Director of Sales
Fastpath
Coral Springs FL
——————————
——————————————-

[Holly Kutil]

We set up permissions for every department including Executives.  Those permissions are copied into a user profile based on their jobs.

We have the following permission sets:
OWNERS
ACCOUNTING
PURCHASING
QUALITY
SALES
WAREHOUSE

As director of business intelligence, I have an admin account with super user permissions.  This is not the account I use for my daily routine, but one I log into when necessary.

Our partner created a spreadsheet of all the permissions we have set up, so when someone gets an error regarding not having permission, I can easily go to the spreadsheet filter on the area they are getting blocked and make necessary adjustments quickly.

It was quite the job getting them all set up, but they are great to have in place now!  The set up has made it very easy to role out and make any necessary adjustments.

——————————
Holly Kutil ~ NAVUG All-Star
American Ring/Business Intelligence Dir.
Solon, OH 44139
**Great Lakes Chapter**
?? Women In Dynamics ??
——————————
——————————————-

[Mark Rhodes]

Traci, be sure to check out the on-demand learning in our webinar recordings.  We’ve done many webinars over the years on security since this can be a tricky area.  Best practices and several others are out there – go to Learn & Engage on the left menu, then Webinar Recordings, then Browse by Topic.  You’ll see the Security filter right there.  Good luck!

——————————
Mark Rhodes
General Manager, NAVUG
Dynamic Communities
Windsor CO
——————————
——————————————-

[Anthony Darden]

Hi Traci!

As most have commented on and I agree with 100%, SUPER user permissions should be avoided for all users.  It’s a great starting point to help chip away at what someone does until the permissions are properly set, but auditors will chew you up and there will be mistakes made by wandering users within the system.  

The permissions recorder is a great tool and certainly worth exploring, but if you have users that wear many different hats within your organization and/or you require extra granularity with permissions, I recommend taking a look at Mergetool’s Easy Security – we have been using them for a few years now and have all the flexibility we need.

Thanks,

Tony

——————————
Anthony Darden
Director of IT
Protective Industries, Inc.
Buffalo NY
——————————
——————————————-

[Mathew Ealy]

We used an add on called Easy Security that helped us build profiles, we then built profiles by job function and applied them to the users performing those job functions. It made life much easier in that you could “record” the job function and it would use sql profiler to capture the permissions needed. 
With permissions like all computer security least needed is the current best practice.

——————————
Mathew Ealy
Nav Support Specialist
Rentokil N. America
Reading PA
——————————
——————————————-