Overview
This post explains how Business Central security works in 2026, from sign-in and encryption to permissions, backups and GDPR tools. It also shows what stays your responsibility, so you can plan properly.
Key Takeaways
- Business Central online signs users in through Microsoft Entra ID, so you can add multi-factor authentication and Conditional Access policies.
- Microsoft encrypts customer data at rest and in transit, and each environment uses a dedicated, isolated database.
- Permission sets control what each user can see and do, but you must set them up and review them.
- Admins can restore an environment to an earlier point in time from the admin center, within the retention period.
- GDPR tools, such as data classification and privacy blocking, help you handle personal data, but they do not make you compliant on their own.
- Security is a shared job, so Microsoft protects the platform while you manage users, permissions and policies.
Business Central Security: What Has Changed since 2025
The original post made bold claims, and several went beyond what the product does. Each one got a recheck against Microsoft’s documentation.
We removed the unsourced breach-cost figure, the Manchester ransomware story and the “£2 million fine avoided” story. The “over 200 businesses” claim also came out, because we could not support it. Features that standard Business Central does not provide, such as remote wipe, security alerts and compliance dashboards, also came out.
1. Built-In Security That Works
Business Central online runs on Microsoft’s cloud, so Microsoft manages the platform for you. Several protections come as standard.
- Sign-in runs through Microsoft Entra ID, which Microsoft sets up and manages for you.
- Microsoft encrypts data at rest with Transparent Data Encryption, and it encrypts backups too.
- Network communication uses industry-standard encryption in transit.
- Each environment stores data in a dedicated, isolated database.
Microsoft describes these controls in its Business Central security guide.
2. Multi-Factor Authentication and Conditional Access
A stolen password should not be enough to open your ERP, so Business Central supports multi-factor authentication through Microsoft Entra ID.
- Require a second verification step for every user.
- Use Conditional Access to allow or deny sign-ins based on conditions, such as location or device.
- Consider Privileged Identity Management for Business Central administrators, as Microsoft recommends.
You switch these on in Entra ID, so they are not automatic. Ask your partner to check that they are active.
3. Role-Based Permissions
A licence in Entra ID alone does not get a user into Business Central. The user must also exist in the environment and hold permissions for the company and data they need.
- Assign permission sets by role, so sales staff see customers and finance staff see ledgers.
- Copy standard permission sets and adjust the copy.
- Review who holds SUPER permission, because fewer is safer.
Microsoft explains this layered model in its application security guide. Our post on 13 Business Central tips shows how to check effective permissions.
4. GDPR and Data Privacy Tools
UK GDPR sets a maximum fine of £17.5 million or 4% of annual global turnover, whichever is higher, according to the UK government’s business guidance. Business Central includes tools that help you handle personal data.
- Classify fields as normal, personal, sensitive or confidential.
- Export a person’s data with the data privacy tools, for example to answer a subject access request.
- Block processing of a specific person’s record with the data processing block.
Microsoft describes these options in its guide to data subject requests. A partner may need to classify fields for you, and you remain the data controller.
5. UK Financial Compliance
Business Central supports Making Tax Digital for VAT through Microsoft’s UK extension. You create the VAT return, release it and submit it from the system, so the process stays in one place.
- Retrieve VAT return periods from HMRC.
- Keep a record of posted transactions in the ledger.
- Switch on the change log to record changes to chosen fields.
Group VAT has no built-in mechanism, so VAT groups need a partner solution. Our post on the core finance system covers the finance features.
6. Backup and Recovery
Microsoft backs up Business Central online environments automatically. Administrators can restore an environment to an earlier point in time from the Business Central admin center.
- Restore within the retention period that applies to production environments.
- Use a sandbox copy to test a restore before you rely on it.
- Microsoft protects backups with encryption, just as it protects live data.
A restore rolls an environment back, so plan who may approve one and how you communicate it.
7. Monitoring and Audit
You cannot protect what you cannot see, so several tools help you see who did what.
- Review who signed in with the Microsoft Entra sign-in log.
- See who changed chosen fields in the change log.
- Send Business Central telemetry to your monitoring tools if you need deeper analysis.
Business Central does not send automatic security alerts or show a compliance dashboard out of the box. Your IT team or partner must set up the monitoring you need.
8. Safe Integrations
Every connection to another system is a possible weak point, so Business Central controls access through Microsoft Entra ID and permissions.
- Register apps in Entra ID, so each integration has its own identity.
- Give each integration only the permissions it needs.
- Expose only the API pages that an AI or external tool needs.
Review third-party apps before you install them, and test them in a sandbox. Our posts on Shopify integration and agentic AI in ERP cover two common cases.
9. Mobile and Remote Work
Staff work from home, client offices and on the road. Business Central online works in a browser and on mobile, so access follows the user, not the office.
- Apply the same sign-in rules everywhere through Entra ID.
- Limit access from unmanaged devices with Conditional Access.
- Manage phones with a device management tool, such as Microsoft Intune.
Business Central does not wipe lost devices by itself, so plan device management separately.
10. Getting Started with Secure Operations
You can improve security without a long project if you work through these steps with your partner.
- Switch on multi-factor authentication and Conditional Access.
- Review permission sets and remove access that people no longer need.
- Classify personal data fields and agree who answers subject access requests.
- Test a restore in a sandbox.
Our post on implementation mistakes explains why access and data clean-up belong in the project plan.
What Stays Your Responsibility
Microsoft secures the platform, but you manage your users and your data. Several areas sit with you.
- Choosing who gets access, and removing it when staff leave.
- Setting and reviewing permission sets.
- Switching on multi-factor authentication and Conditional Access.
- Training staff to spot phishing, because the system cannot do that for them.
- Meeting UK GDPR duties as the data controller.
Microsoft’s compliance reports, such as its ISO 27001 and SOC reports for Dynamics 365, are available through the Microsoft Service Trust Portal. Check the current scope there, and ask your partner to explain what it means for you. Our post on on-premise vs cloud ERP covers the security trade-offs of each model.
What This Means for Your Business
Business Central online gives you a strong security foundation, but it works best when you configure it well. Most incidents start with weak passwords, loose permissions or untested recovery, not with the platform itself.
Start with the basics: multi-factor authentication, tidy permissions and a tested restore. Then add monitoring and data privacy processes as you grow. Our post on manufacturing compliance shows how the same controls support audits.
Get Help with Business Central Security
Tecvia helps UK businesses configure Business Central securely and review their permissions. Get in touch with Tecvia to book a free review of your security settings.
You can also meet our support team, learn how our implementation approach works, or visit our page for IT Directors and Managers. See how Business Central supports your sector. We serve Manufacturing and Engineering, Food and Beverage, Distribution and Wholesale, Life Sciences, and Medical Devices and Technology businesses.
FAQs
Business Central online runs on Microsoft’s cloud with Entra ID sign-in, encryption at rest and in transit, and isolated databases. Security also depends on your own set-up, such as multi-factor authentication and permissions. Ask your partner to review both.
Yes, through Microsoft Entra ID. You switch it on in Entra. Conditional Access policies can also allow or deny sign-ins, based on location or device.
Yes. Microsoft encrypts data at rest with Transparent Data Encryption and encrypts backups. Network communication uses industry-standard encryption in transit. For online environments, encryption is always on.
Yes. Microsoft backs up online environments automatically. Administrators can restore an environment to an earlier point in time from the admin center, within the retention period. Test a restore in a sandbox first.
It includes tools to classify personal data, export a person’s data and block processing of a record. These tools help, but they do not make you compliant. You remain the data controller under UK GDPR.
Assign permission sets by role, review them regularly and limit SUPER permission. A user also needs to exist in the environment with access to the company, so an Entra ID licence alone does not grant access.
Online Business Central benefits from Microsoft’s managed platform, automatic encryption and updates. On-premise gives you full control, but your team must patch, back up and secure everything. Choose based on your team’s real capacity.
It does not manage staff training, wipe lost devices, or send automatic security alerts out of the box. You need separate tools and processes for those, such as device management and monitoring.
