Business Central 2026 release wave 1 (BC28.2): Use new APIs for analyzing permissions for auditors and IT staff

Hi, Readers.
Dynamics 365 Business Central 2026 wave 1 (BC28.2) is generally available. More details: Cumulative Update Summary for Microsoft Dynamics 365 Business Central (June, 2026)

I will continue to test and share some new features that I hope will be helpful. In this post, I would like to talk about Use new APIs for analyzing permissions for auditors and IT staff.
Use new APIs for analyzing permissions for auditors and IT staff

Business value:
The new read-only permission APIs empower businesses to strengthen security and compliance by enabling external auditing and analytics without compromising system integrity. With seamless integration into tools like Power BI and Microsoft Copilot Studio, organizations can create advanced reports and intelligent agents for deeper insights. This capability enhances transparency, supports regulatory requirements, and accelerates decision-making by providing secure, real-time access to permission data. Ultimately, it helps businesses maintain robust governance while unlocking new opportunities for automation and analytics.

In this release wave, Microsoft is introducing read-only APIs on the permission system. The APIs are read-only and allow querying for:

• Permission Set
• Object, Scope, Extension info, and Permission Set
• Permission Set and Security Group mappings
• Permission Set and User mappings

I have exported the object list for all API page types and compared the code with BC28.1. Regarding the addition of permissions, here are the five new APIs:

All of these belong to the Automation API. More details: Endpoints for the APIs (V1.0, V2.0, Beta, custom, automation……)

Let’s look at a few simple examples.

APIV2 Expanded Permission Sets: expandedPermissionSets

https://api.businesscentral.dynamics.com/v2.0/7e47da45-7f7d-448a-bd3d-1f4aa2ec8f62/Sandbox282/api/microsoft/automation/v2.0/companies(2c609aa2-9863-f111-ab09-7c1e524d5686)/expandedPermissionSets

Response:

{
            "@odata.etag": "W/\"JzE5OzY1MzA3MjQzODkwODg2NzYwMzkxOzAwOyc=\"",
            "id": "00000000-0000-0000-0000-000000000000",
            "appId": "00000000-0000-0000-0000-000000000000",
            "appName": "",
            "roleId": "SECURITY",
            "roleName": "Assign permissions to users",
            "objectType": "Table Data",
            "objectId": 8,
            "objectName": "Language",
            "readPermission": " ",
            "insertPermission": "Yes",
            "modifyPermission": "Yes",
            "deletePermission": "Yes",
            "executePermission": " ",
            "alObjectName": "Language",
            "scope": "System"
        }

APIV2 – Access Control: accessControls

https://api.businesscentral.dynamics.com/v2.0/7e47da45-7f7d-448a-bd3d-1f4aa2ec8f62/Sandbox282/api/microsoft/automation/v2.0/companies(2c609aa2-9863-f111-ab09-7c1e524d5686)/accessControls

Response:

{
            "@odata.etag": "W/\"JzE4OzM5MjIwMDUyNjM3MDA4MTcxNzE7MDA7Jw==\"",
            "id": "155c658c-f25e-f111-8e2b-6045bde9ba59",
            "userSecurityId": "fdadc38f-f99c-4d7f-b38f-23a4ddfcf99c",
            "roleId": "SUPER",
            "roleName": "This role has all permissions.",
            "company": "",
            "userName": "MSOLSYNC",
            "fullName": "Microsoft Online Sync Daemon",
            "userLicenseType": "External User",
            "scope": "System",
            "appId": "00000000-0000-0000-0000-000000000000",
            "appName": ""
        }

APIV2 – Users Permissions: usersPermissions

https://api.businesscentral.dynamics.com/v2.0/7e47da45-7f7d-448a-bd3d-1f4aa2ec8f62/Sandbox282/api/microsoft/automation/v2.0/companies(2c609aa2-9863-f111-ab09-7c1e524d5686)/usersPermissions

Response:

        {
            "@odata.etag": "W/\"JzIwOzE1NTY1NzA5OTc3OTIwMjEyNTk4MTswMDsn\"",
            "id": "deaba468-9763-f111-ab09-7c1e524d5686",
            "userSecurityId": "180bfcec-be24-40b5-bc46-9322a75f16b1",
            "userName": "ADMIN",
            "fullName": "YUN ZHU",
            "state": "Enabled",
            "expiryDate": "0001-01-01T00:00:00Z",
            "windowsSecurityID": "",
            "changePassword": false,
            "licenseType": "Full User",
            "authenticationEmail": "Admin@2qcj3x.onmicrosoft.com",
            "contactEmail": "Admin@2qcj3x.onmicrosoft.com",
            "exchangeIdentifier": "",
            "applicationId": "00000000-0000-0000-0000-000000000000"
        }

APIV2 – User Permission Sets: userPermissionSets

https://api.businesscentral.dynamics.com/v2.0/7e47da45-7f7d-448a-bd3d-1f4aa2ec8f62/Sandbox282/api/microsoft/automation/v2.0/companies(2c609aa2-9863-f111-ab09-7c1e524d5686)/userPermissionSets

Response:

        {
            "@odata.etag": "W/\"JzIwOzEyMTU2NDM2NjkzODY3MDgwNTc1MTswMDsn\"",
            "id": "00000000-0000-0000-0000-000000000000",
            "userSecurityId": "fdadc38f-f99c-4d7f-b38f-23a4ddfcf99c",
            "type": "User",
            "roleId": "SUPER",
            "roleName": "This role has all permissions.",
            "securityGroupCode": "",
            "company": "",
            "scope": "System",
            "appId": "00000000-0000-0000-0000-000000000000",
            "appName": ""
        }

APIV2 – Permission Sets: aggregatePermissionSets

https://api.businesscentral.dynamics.com/v2.0/7e47da45-7f7d-448a-bd3d-1f4aa2ec8f62/Sandbox282/api/microsoft/automation/v2.0/companies(2c609aa2-9863-f111-ab09-7c1e524d5686)/aggregatePermissionSets

Response:

        {
            "@odata.etag": "W/\"JzE5OzYwNjc3MTU1OTg0MzI1NzQ3MzExOzAwOyc=\"",
            "id": "00000000-0000-0000-0000-000000000000",
            "appId": "00000000-0000-0000-0000-000000000000",
            "appName": "",
            "name": "Assign permissions to users",
            "roleId": "SECURITY",
            "scope": "System"
        }

Great. This allows for establishing security and auditing analytics and reporting outside Business Central—for example, creating reports with Power BI or agents with Microsoft Copilot Studio and MCP Server for Business Central.

Give it a try!!!😁

END

Hope this will help.

Thanks for reading.

ZHU