Talking in these days with some partners, I discovered that it’s not so clear how to handle the possibility to install apps on a Dynamics 365 Business Central SaaS tenant. Who can do that? The answer is: it depends 🙂
As a general rule:
- To install extensions from AppSource or add per-tenant extensions to a tenant, you must have the right permissions and more specifically you must either be a member of the D365 EXTENSION MGMT user group or you must have the D365 EXTENSION MGMT permission set.
- If you are an administrator (SUPER role), you can assign user groups and permissions to other users in your company.
This is clear I think. So, what’s the sneaky part of that?
You need to remember that with Dynamics 365 Business Central SaaS, licenses are purchased by the CSP partner and when a tenant is activated, the first user that logs into that tenant gets the SUPER permission set. This means that if the first user that logs into the tenant is the PARTNER (what I think normally should happen), it’s the partner itself that can install apps and can assign the D365 EXTENSION MGMT permission to the customer’s users only if needed (please don’t do that with too much users).
If instead is the CUSTOMER that first logs into the tenant, the customer itself gets the SUPER permission set, he can install and remove apps and then you (as a partner) need to discuss with him the appropriate permissions to assign to you and them (you’re not automatically a SUPER user).
Just FYI… 🙂
Stefano Demiliani 
Interesting. I was not aware that the first user gets the super permission set. Good to know 🙂
LikeLike
Hi Stefano.
We have a customer that their office 365 provider has given us admin permissions in their azure active directory and created an external user for us to access their BC. Although we cannot publish an extension with that user because of the below message .
You do not have the required permissions to install the selected app. Contact your Partner or system administrator to install the app or assign you permissions.
Note that our user has the mentioned permissions.
Do we need license assigned as developers to achieve that?
Regards Andreas Panayiotou.
LikeLike
Are you a delegated admin? To install or uninstall apps from AppSource or add per-tenant apps, you must either be a member of the EXTEND. MGT. – ADMIN user group or you must have the EXTEND. MGT. – ADMIN permission set now.
LikeLike
Hi Stefano,
One of our customer’s user has installed an extension in BC SaaS.
We thought he was not allowed to do that, because he was “SUPER” but only on one company.
We know that beeing “SUPER” on one company doesn’t allow to edit permissions, but I’m surprised that it allows to install an extension from AppSource, even if (NAV)App tables are not companies depandant (DataPerCompany = false).
Do you ever hear about that?
LikeLike
To install extensions you must either be a member of the D365 Extension MGT user group or you must have the EXTEND. MGT. – ADMIN permission set. Check if the user has these roles assigned. Installing an app in a company install that apps for everything.
LikeLike