Permission Sets
You assign two permission sets of the MCP Guard extension in Microsoft Dynamics 365 Business Central. Assign MCP GUARD - USER to every user who works through an AI assistant, and MCP GUARD - ADMIN to whoever manages the rules. Neither set grants anything on business data: a user also needs the Business Central permissions for the data itself.
What each set grants
| Permission set | Name | Grants |
|---|---|---|
| MCP GUARD - USER | MCP Guard - user | Reading the rule that applies to the caller through the mcpUserSettings API page, and the caller's own verdicts through the effectivePermissions API page. Execute on the production, planning, assembly and project API pages. Reporting the caller's own usage, and the My MCP Guard page. |
| MCP GUARD - ADMIN | MCP Guard - administrator | Everything in MCP GUARD - USER, plus the MCP Guard User Settings page and its lookups, with insert, modify and delete on the rules. Also the MCP Guard Administration, MCP Guard Usage Overview and MCP Guard Usage pages, and the mcpUsageTotals API page. |
Sets that you do not assign
| Permission set | Name | Why it is not assignable |
|---|---|---|
| MCP GUARD | MCP Guard - read own effective permissions | It is part of MCP GUARD - USER. Up to version 1.12.0.0 it could be assigned on its own. |
| MCP GUARD - SANDBOX | MCP Guard - sandbox access without a licence | Business Central gives it to users without an MCP Guard licence, so that they can try the app in a sandbox environment. See Assign Licences. |
Sets that no longer exist
Up to version 1.12.0.0, a user also needed MCP GUARD - PROD, MCP GUARD - ASSEMBLY or MCP GUARD - PROJECTS for the API pages of a module. The rule already says per module what the user may do, so the same decision was made in two places. Since version 1.13.0.0 these three sets are removed, and MCP GUARD - USER holds the pages. An assignment of one of them that is still in your tenant has no effect. You can delete it.
Who needs which set
- Every user of an AI assistant: MCP GUARD - USER. It lets the MCP client read the user's own rule and effective permissions, and reach the extension's API pages.
- Administrators of the rules: MCP GUARD - ADMIN. It includes MCP GUARD - USER.
What a user may do in a module
With MCP GUARD - USER, a user can reach every module page: production, planning, assembly and projects. What the user may do there is the access level of the user's rule, which starts at Read. Business Central's own permissions on the data still apply. See Access Levels per Module.
To keep a user out of a module altogether, leave the user without Business Central permissions on that data.
What the sets do not grant
No business data. MCP GUARD - USER grants the API pages for production orders, and nothing on production orders themselves. The user needs Business Central's own permissions on production orders, and the Premium experience and licence that production requires. The same holds for assembly orders and projects: the user needs Business Central's own permissions on them.
No browsing of other users' rules. A user with MCP GUARD - USER reads the rule that applies to them through the API page. The user cannot open the table with all rules. Only MCP GUARD - ADMIN gives the MCP Guard User Settings page.
No write access through a permission set alone. For the production, planning, assembly and project API pages, the user's rule must also grant an access level above Read. See Access Levels per Module.
No changing of usage lines. MCP GUARD - ADMIN reads the usage, but has no direct delete permission on it. Only the retention policy removes usage lines. See Usage per User.
Check that a user has the set
On the MCP Guard User Settings page, the User Permission Set column shows whether a permission set assigned to the user includes MCP GUARD - USER.
| Value | Meaning |
|---|---|
| Assigned | A permission set assigned to the user includes MCP GUARD - USER. |
| Not found | No assigned permission set includes MCP GUARD - USER. Without it the user cannot read the rule, and the BC MCP Pro connector refuses the connection. |
| Empty | The line is a rule for a security group. |
Not found is a hint, not a final verdict. A permission set that the user gets through a security group is not checked, so Not found can also mean that the set comes through a security group.
Assign a permission set
- Choose the search icon (Tell Me), enter Users, and then choose the related link.
- Open the user.
- Add MCP GUARD - USER or MCP GUARD - ADMIN to the user's permission sets.