Permission Sets

The app ships two assignable permission sets. Give E-Invoice Platform Admin to whoever administers the connection, and E-Invoice Platform User to everyone who sends invoices day to day. The user set is deliberately narrower — not as a formality, but because nobody needs write access to API credentials in order to send a document.

What each set grants

Both sets also need the standard Business Central permissions for the areas they touch — sales and purchase documents, vendors and customers. Neither set replaces those.

Three things that look like bugs and are not

The user set cannot open the setup page. That is on purpose. The page needs insert rights when it opens, so granting read-only access to it would not work anyway, and the settings on it are an administrator's decisions. A day-to-day user who needs to check a setting should ask, or be given the admin set.

Approving supplier bank details fails without D365 PURCH. Approving an account can write a vendor bank account, which is standard purchasing data this app does not grant on its own. Without those rights Business Central refuses with its ordinary permission error. That is the right outcome — this app should not be a side door into writing vendor master data — but it is worth knowing so it is not mistaken for a fault in the approval feature.

The same applies to setting a supplier default on the vendor card:

You do not have permission to change vendor number, so the supplier default was not set. Ask for the D365 PURCH permission set.

Tile choices are not row-level secured. The per-user tile setup is readable across users. It holds nothing sensitive — only which counters somebody has chosen to see — but do not treat it as private.

Why the log cannot be deleted

The user set can insert and update log entries but never delete them. The send log is the record of what left the company and what the platform said about it. A user who can delete rows from it can make a failed send disappear, which is precisely the evidence you want when a customer says an invoice never arrived.

Administrators can correct the log. That is a deliberate difference between the two sets.

The read-only API pages

The app exposes API pages over its main lists and setup, and the ordinary user set can reach several of them — the ones covering company identity, customer and vendor setup, vendor bank accounts and VAT posting setup.

That is intentional: the person who phones support is usually the one sending invoices, and those pages let the state be read from outside the UI at exactly the moment something is broken. They project no secrets — the API secret is never exposed by any of them, only a flag saying whether one is stored.

Assign a permission set

1. Choose the Search icon, enter User Setup or Users, and then choose the related link.
2. Select the user.
3. Add E-Invoice Platform Admin or E-Invoice Platform User to their permission sets.

Neither set requires SUPER.

Related information

• E-Invoice Platform Setup Reference
• Approve Supplier Bank Details
• Assign permissions to users and groups