Business Central security

This section helps you understand and improve the security of your Business Central tenant. In the links below you'll find information, guidance, and recommended practices related to authentication, data encryption, and safely integrating with other services. You'll also find information on Business Central certifications and regulatory compliance.

Authentication

Business Central uses Microsoft Entra ID as the authentication method, which is automatically set up and managed for you. It is possible to configure Microsoft Entra ID to allow or deny authentications to Business Central only if certain additional conditions are met using Conditional Access to further improve security of your environments. For more information, see Conditional Access.

Access can be controlled per Business Central environment for internal users, delegated administrators, and multitenant applications. For more information, see Manage Access to Environments.

Data isolation and encryption

Data belonging to a single tenant is stored in an isolated database and is never mixed with data from other tenants. This ensures complete isolation of data in day-to-day use and in backup/restore scenarios. Furthermore, Business Central uses encryption to help protect tenant data in the following ways:

• Data at rest is encrypted by using Transparent Data Encryption (TDE) and backup encryption.
• Data backups are always encrypted.
• All network traffic inside the service is encrypted by using industry-standard encryption protocols.

Service integration

We recommend that you use encrypted network protocols to connect to the Power BI server and Business Central web services. For more information, see the following articles:

Connect to Business Central with Power BI

Using Security Certificates with Business Central on-premises

Customer Lockbox

Most operations, support, and troubleshooting performed by Microsoft personnel (including subprocessors) don't require access to customer data. With Customer Lockbox, we provide an interface for the customers to review and approve (or reject) data access requests in the rare occasion when data access to customer data is needed. It's used in cases where a Microsoft engineer needs to access customer data, whether in response to a customer-initiated support ticket or a problem identified by Microsoft.

Customer Lockbox for Business Central is administered in the Power Platform Admin Center and requires the Business Central environment to be linked to a Power Platform environment. Learn more about administering Customer Lockbox in the Power Platform Admin Center here. If the Business Central environment is linked to a Power Platform for which Lockbox is enabled, Lockbox will automatically also be enabled for the linked Business Central environment. Lockbox requests for the Business Central environment can only be approved or rejected in the Power Platform Admin Center by users with at least the Power Platform Administrator role.

See also

Microsoft Trust Center (what we do to make the service secure)
Microsoft Dynamics 365 Cloud Services Compliance
Security and Protection
Security Tips for Business Users