Prevent access to default API Pages (via Postman or PowerBi) for specific users or security groups

(3) Share

Report

Posted on by FJ-14031703-0

Hi all,

i was wondering how to prevent users from using default and customer made API calls and datasets eg. via Postman or PowerBi.

As i understand access rights are the same as in in client, but is there an easier way to prevent API access completely?

Thks Frank

Categories:

Dynamics 365 Business Central

All responses (5)

Answers (4)

FJ-14031703-0 75 on at

Like (3)

Report

Prevent access to default API Pages (via Postman or PowerBi) for specific users or security groups

Hi all,

first of all, thanks for your fast and helpfull tips.

By now i figured out, that there is some kind of misunterstanding the exlusion permission.

I had to add the permission set witch grants permission for being able to exlude special objects, like the api page objects.

Right now i have to firgure out how to add this recently learned to my existing security groups and permission set combination.

But the path is way clearer now for me. Thanks to you all.
Verified answer

Jainam M. Kothari 5,891 on at

Like (2)

Report

Prevent access to default API Pages (via Postman or PowerBi) for specific users or security groups

Hello,

To prevent users from accessing APIs in Business Central, you can use a combination of permission sets, security filters, and API management. By creating or modifying permission sets to exclude access to specific API objects, configuring security filters to limit data access, and disabling or restricting unwanted API endpoints, you can effectively control and prevent unauthorized API access. Additionally, assigning users to specific groups with restricted permissions ensures only authorized users have API access.

May this can help : https://learn.microsoft.com/en-us/dynamics365/business-central/dev-itpro/security/security-filters
Verified answer

YUN ZHU 81,360 Super User 2025 Season 1 on at

Like (2)

Report

Prevent access to default API Pages (via Postman or PowerBi) for specific users or security groups

If you want to set global read-only permissions, you can use the following method.

More details:

Dynamics 365 Business Central: Managing Database Access Intent (Managing write access to APIs from the client)

https://yzhums.com/19105/

If you want to restrict a user's API permissions, which are either pages or queries, you can create a permission set to exclude those permissions individually.

Dynamics 365 Business Central: A simple way to view the list of all APIs

https://yzhums.com/22845/

Hope this helps.

Thanks.

ZHU
Verified answer

Ramesh Kumar 3,280 on at

Like (2)

Report

Prevent access to default API Pages (via Postman or PowerBi) for specific users or security groups

There is no master switch — but you can use Permission Sets or disable Web Services for Specific Users or Azure AD authentication.

Thanks!

Ramesh

If this was helpful, please check the "Does this answer your question?" box and mark it as verified.
Verified answer

Khushbu Rajvi. 14,415 Super User 2025 Season 1 on at

Like (4)

Report

Prevent access to default API Pages (via Postman or PowerBi) for specific users or security groups

Yes, there is a way to block API access for specific users or security groups in Business Central. To prevent specific users from accessing Web Services in Business Central (e.g., via Power BI or Postman), remove their API-related permission sets (like API Read or D365 POWER BI), avoid assigning Web Service Access Keys, and optionally create a custom permission set that blocks access to API and OData objects—this way, they can still use the web client but won’t consume external connections or hit the 100-connection limit.

Please check this: https://community.dynamics.com/forums/thread/details/?threadid=f33b7934-ee2f-ef11-840a-000d3a56a6aa

https://learn.microsoft.com/en-us/dynamics365/business-central/ui-security-groups