Enterprise resource planning systems sit at the heart of modern business operations. They process invoices, manage inventory, handle payroll and store sensitive financial data. Yet the way most organisations handle user authorisations within these systems remains alarmingly casual.
The problem is not a lack of awareness. IT managers and compliance officers understand that poorly configured access rights create risk. What they underestimate is how quickly authorisation structures decay after the initial setup, especially in environments running Microsoft Dynamics 365 Business Central where roles and permissions can number in the hundreds.
A handful of specialised vendors have built tools specifically for this challenge. The Breda-based firm behind 2-controlware.com has spent over 17 years developing authorisation software for the Dynamics ecosystem, which gives some indication of how deep and persistent the problem really is. Most organisations, however, still rely on manual checks or native functionality that was never designed for granular access control.
The Gap Between Implementation and Ongoing Control
When a new ERP system goes live, authorisation is typically part of the project scope. Consultants define roles, assign permissions and document the setup. That documentation tends to be accurate for roughly the first few months.
Then reality sets in. New employees join and inherit permissions from colleagues whose roles differ slightly. Temporary access granted during a project is never revoked. A finance team member who changed departments two years ago still has posting rights in the general ledger.
Native permission management in Business Central offers basic tools, but it was designed for functional configuration rather than compliance governance. There is no built-in mechanism for detecting conflicts between permission sets or flagging when a user accumulates access that violates segregation of duties policies.
Segregation of Duties Demands More Than Good Intentions
Segregation of duties, commonly abbreviated as SoD, is a foundational control in financial governance. The principle is straightforward: no single person should be able to both initiate and approve a transaction. In practice, enforcing this within an ERP system is anything but simple.
Business Central uses a layered permission model with permission sets, user groups and entitlements. A conflict can hide across multiple layers, invisible to anyone reviewing access at a surface level. Organisations subject to SOx requirements or AVG obligations face real regulatory consequences when these conflicts go undetected.
Dedicated authorisation platforms such as those offered through 2-controlware.com address this by mapping permissions across all layers and running automated conflict detection. Without such tooling, compliance teams typically resort to exporting permission data into spreadsheets, a process that is both error-prone and outdated by the time the review is complete.
What Continuous Monitoring Actually Looks Like
The phrase “continuous monitoring” gets used loosely in enterprise software. In the context of ERP authorisations, it means something specific: real-time or near-real-time tracking of permission changes, role assignments and potential SoD violations as they occur rather than during a quarterly review cycle.
Effective monitoring flags the moment a user is granted a permission set that conflicts with existing access. It alerts administrators when someone bypasses established approval workflows. For organisations with multiple Business Central environments, centralised monitoring across tenants becomes essential to maintaining a consistent security posture.
Regulatory frameworks increasingly expect organisations to demonstrate ongoing control rather than point-in-time compliance. Discovering during an annual audit that numerous users hold conflicting permissions is no longer acceptable to auditors or regulators, and the shift from periodic reviews to continuous oversight reflects that reality.
See also: Redefining Tech Design: The Latest Trends Shaping User Experiences in 2026
Building an Authorisation Strategy That Lasts
Getting authorisation right is not a one-time project. It requires a deliberate strategy that includes role design, regular reviews and tooling that supports the complexity of modern ERP environments. Organisations running Dynamics 365 Business Central should start by mapping their current permission landscape before selecting any additional software.
The decision between managing authorisations natively or adopting a specialised platform like those available at 2-controlware.com depends on the organisation’s size, regulatory exposure and internal expertise. Smaller firms with straightforward permission structures may manage with native tools and disciplined processes. Larger enterprises or those facing SOx and AVG compliance obligations typically find that manual approaches simply cannot scale.
Whatever path an organisation chooses, the priority should be visibility. Most Business Central environments offer limited default insight into how permissions are structured and layered across users. Mapping that landscape thoroughly is the necessary first step toward meaningful compliance governance.
