Remote support: how does a consultant get access safely?

A consultant often needs to get into your Business Central to find an error. The question is how that happens without sharing passwords and without giving more access than necessary. Microsoft has built-in options that most customers can use. This article goes through the most important: delegated administration, guest users, permissions, restricting access and a log of what has happened. It is written for those who have to say yes or no to access.

Never share passwords

Never ask a consultant to use a colleague's login, and never share a user's password. It breaks your security rules, and afterwards you cannot see who did what.

The same applies to shared accounts. A shared user that several consultants sign in with makes it impossible to follow who has done what. Use personal access.

Delegated administration

According to Microsoft Learn, a partner gets access to your environments through a GDAP relationship that a global administrator on your side accepts. The recommended minimum role for Business Central is Dynamics 365 Business Central Administrator. It requires no separate Business Central licence for the consultant.

The consultant is created automatically as a user in the environment the first time they sign in, with a pseudonym and the company's name. The actions can be seen in the change log. Microsoft mentions that you can accept short relationships that do not renew automatically if the need is temporary.

Ask the partner which of their staff have access to your tenant and how they remove people who leave the company. Microsoft recommends that the partner itself keeps track of which pseudonyms their people have with each customer.

Restrict access

Check the Partner access setting. Microsoft Learn says that new partners get access to environments by default if all partners are allowed. If you want to avoid that, choose selected partners. When a GDAP relationship expires, the setting is kept, so access can return if the relationship is re-established.

Business Central lets you control access in the admin center. Microsoft Learn mentions these options:

Switch off partner access on an environment, or allow only selected partners
Deactivate a specific delegated user in the environment
Remove or change the permissions in the licence configurations for delegated administrators
Use Conditional Access in Microsoft Entra, for example a requirement for multifactor authentication
Accept short-lived GDAP relationships instead of permanent ones

Guest users, log and control

If an external person needs to work with data as a user, for example an auditor, you can create them as a guest in your Microsoft Entra and give them a suitable licence. Microsoft says that an external accountant must have the External Accountant licence, and that delegated administrators cannot provide accounting services.

Give only the permissions the person needs, and remove them when the task is finished.

Both internal and external administrators can see delegated users in the user list and follow their changes in the change log, if it is switched on for the relevant fields. So check your change log setup before you give access.

Ask your partner to document who has access and when it was last reviewed.

Check that the change log is actually set up to track the fields where you want to see changes. It does not track everything by default, and you cannot afterwards see what was not logged.

Checklist

Go through the list every six months and after every change of partner. Agree with the partner who contacts whom if there is suspicion of misuse.

Is access given through delegated administration and not a shared login
Is the role the least necessary one
Is MFA switched on
Is the time frame agreed
Is there a data processing agreement
Is the access removed after the task

At Addverk

Read about our support on the page about services and prices.