What are Permission Set Extensions in Business Central?

Permission Set Extensions in Dynamics 365 Business Central allow developers to extend existing permission sets by adding additional permissions without directly modifying the original permission set.

This is particularly useful in AL development and Business Central extensions.

Suppose an existing application provides a permission set, but your extension introduces a new table or another object that users need to access.

Instead of modifying the original permission set—which may belong to Microsoft or another extension—you can use a Permission Set Extension to add the required permissions.

Conceptually:

Base Permission Set

Your Extension's Permission Set Extension

=

Effective Permissions Available to the User

This approach is important because extensions should remain modular and upgrade-friendly.

Imagine a partner solution adds:

My Custom Sales Table

and the appropriate users already have a standard sales-related permission set.

Rather than changing the original permission set, the extension can contribute the permissions required for the new object.

This fits well with Business Central's extension-based architecture.

For developers, it is important to understand the difference between:

Permission Set → Defines permissions

Permission Set Extension → Extends permissions

User/Permission Assignment → Determines which users or groups receive permissions

A common mistake is assuming that adding a Permission Set Extension automatically grants permissions to every user. It doesn't replace the need to assign appropriate permission sets to users or groups.

Career takeaway

For students entering Business Central development, don't learn permissions only as an AL syntax topic.

Understand the security model:

Users → Permission Sets → Object Permissions → Permission Set Extensions → Effective Access

For working professionals, this becomes particularly important when designing ISV extensions, partner solutions, upgrades, role-based access, least-privilege security, and enterprise implementations.

The best Business Central developers understand not only how to write AL code, but also how that code fits into the platform's security and extension architecture.