Analyzing Permission Changes Trace Telemetry

APPLIES TO: Business Central 2020 release wave 2, version 17.2, and later

Note

Azure Active Directory is now Microsoft Entra ID. Learn more

Permission changes telemetry gathers data about the following operations on permission sets:

• A user-defined permission set was added or removed
• A link between a user-defined permission set and system permission set was added or removed
• A permission set was assigned to or removed from a user or user group
• A permission set was changed by an app/extension

For information about managing permission sets, see Assign Permissions to Users and Groups.

Common custom dimensions

The following table explains custom dimensions that are common to all permission traces.

Dimension	Description or value
aadTenantId	Specifies the Microsoft Entra tenant ID used for Microsoft Entra authentication. For on-premises, if you aren't using Microsoft Entra authentication, this value is common.
alCategory	AL PermissionSet
alDataClassification	SystemMetadata
alObjectId	1351, which is the ID of the system application codeunit that subscribes to the telemetry events.
alObjectName	Telemetry Subscribers, which is the name of the system application codeunit that subscribes to the telemetry events.
alObjectType	CodeUnit
component	Dynamics 365 Business Central Server.
componentVersion	Specifies the version number of the component that emits telemetry (see the component dimension.)
environmentType	Specifies the environment type for the tenant, such as Production, Sandbox, Trial. See Environment Types.
telemetrySchemaVersion	Specifies the version of the Business Central telemetry schema.

User-defined permission set added

Occurs when a user-defined permission set is created.

General dimensions

Dimension	Description or value
message	User-defined permission set added: {alPermissionSetId}
severityLevel	1
user_Id	The user telemetry ID for the user. From the user card, you can use user_Id to identify the user who triggered this telemetry event. Learn more in Assign a telemetry ID to users.

Custom dimensions

Dimension	Description or value
eventId	AL0000E2A
alNumberOfUserDefinedPermissionSets	Specifies the total number of user-defined permission sets.
alPermissionSetId	Specifies the ID assigned to the permission set.

Sample KQL code (user-defined permission set added)

This KQL code can help you get started analyzing when a user-defined permission set was added.

// User-defined permission set added 
traces
| timestamp > ago(60d) // adjust as needed
| where customDimensions has 'AL0000E2A'
| where customDimensions.eventId == 'AL0000E2A'
| project timestamp
// in which environment/company did it happen
, aadTenantId = customDimensions.aadTenantId
, environmentName = customDimensions.environmentName
, environmentType = customDimensions.environmentType
, companyName = customDimensions.companyName
// what was changed
, alNumberOfUserDefinedPermissionSets = customDimensions.alNumberOfUserDefinedPermissionSets
, alPermissionSetId = customDimensions.alPermissionSetId
// which user did it
, usertelemetryId = case(
  toint( substring(customDimensions.componentVersion,0,2)) >= 20, user_Id // user telemetry ID was introduced in the platform in version 20.0
, 'N/A'
)

User-defined permission set removed

Occurs when a user-defined permission set is deleted.

General dimensions

Dimension	Description or value
message	User-defined permission set removed: {alPermissionSetId}
severityLevel	1
user_Id	The user telemetry ID for the user. From the user card, you can use user_Id to identify the user who triggered this telemetry event. Learn more in Assign a telemetry ID to users.

Custom dimensions

Dimension	Description or value
eventId	AL0000E2B
alNumberOfUserDefinedPermissionSets	Specifies the total number of user-defined permission sets.
alPermissionSetId	Specifies the ID of the permission set that was deleted.
See common custom dimensions

Sample KQL code (User-defined permission set removed)

This KQL code can help you get started analyzing when a user-defined permission set was removed.

// User-defined permission set removed 
traces
| where timestamp > ago(60d) // adjust as needed
| where customDimensions.eventId == 'AL0000E2B'
| project timestamp
// in which environment/company did it happen
, aadTenantId = customDimensions.aadTenantId
, environmentName = customDimensions.environmentName
, environmentType = customDimensions.environmentType
, companyName = customDimensions.companyName
// what was changed
, alNumberOfUserDefinedPermissionSets = customDimensions.alNumberOfUserDefinedPermissionSets
, alPermissionSetId = customDimensions.alPermissionSetId
// which user did it
, usertelemetryId = case(
  toint( substring(customDimensions.componentVersion,0,2)) >= 20, user_Id // user telemetry ID was introduced in the platform in version 20.0
, 'N/A'
)

Permission set link added

Occurs when a user-defined permission set is created from a copy of a system permission set, and the Notify on Changed Permission Set option is selected. The Notify on Changed Permission Set option creates a link between the system permission set and the user-defined permission set.

General dimensions

Dimension	Description or value
message	Permission set link added: {alSourcePermissionSetId} -> {alLinkedPermissionSetId}
severityLevel	1
user_Id	The user telemetry ID for the user. From the user card, you can use user_Id to identify the user who triggered this telemetry event. Learn more in Assign a telemetry ID to users.

Custom dimensions

Dimension	Description or value
eventId	AL0000E28
alSourcePermissionSetId	Specifies the ID of the system permission set that was copied to create the user-defined permission set.
alLinkedPermissionSetId	Specifies the ID of the user-defined permission that was created from a copy of the system permission set.
alNumberOfUserDefinedPermissionSetLinks	Specifies the total number of user-defined permission sets that are linked to system permission sets.
See common custom dimensions

Sample KQL code (permission set link added)

This KQL code can help you get started analyzing when a permission set link was added.

// Permission set link added 
traces
| where timestamp > ago(60d) // adjust as needed
| where customDimensions.eventId == 'AL0000E28'
| project timestamp
// in which environment/company did it happen
, aadTenantId = customDimensions.aadTenantId
, environmentName = customDimensions.environmentName
, environmentType = customDimensions.environmentType
, companyName = customDimensions.companyName
// what was changed
, alSourcePermissionSetId = customDimensions.alSourcePermissionSetId
, alLinkedPermissionSetId = customDimensions.alLinkedPermissionSetId
, alNumberOfUserDefinedPermissionSetLinks = customDimensions.alNumberOfUserDefinedPermissionSetLinks
// which user did it
, usertelemetryId = case(
  toint( substring(customDimensions.componentVersion,0,2)) >= 20, user_Id // user telemetry ID was introduced in the platform in version 20.0
, 'N/A'
)

Permission set link removed

Occurs when a user-defined permission set, which is linked to a system permission set, is deleted.

General dimensions

Dimension	Description or value
message	Permission set link removed {alSourcePermissionSetId} -> {alLinkedPermissionSetId}
severityLevel	1
user_Id	The user telemetry ID for the user. From the user card, you can use user_Id to identify the user who triggered this telemetry event. Learn more in Assign a telemetry ID to users.

Custom dimensions

Dimension	Description or value
eventId	AL0000E29
alSourcePermissionSetId	Specifies the ID of the system permission set that the deleted user-defined permission set was linked to.
alLinkedPermissionSetId	Specifies the ID of the deleted user-defined permission set.
alNumberOfUserDefinedPermissionSetLinks	Specifies the total number of user-defined permission sets that are linked to system permission sets.
See common custom dimensions

Sample KQL code (Permission set link removed)

This KQL code can help you get started analyzing when a permission set link was removed.

// Permission set link removed 
traces
| where timestamp > ago(60d) // adjust as needed
| where customDimensions.eventId == 'AL0000E29'
| project timestamp
// in which environment/company did it happen
, aadTenantId = customDimensions.aadTenantId
, environmentName = customDimensions.environmentName
, environmentType = customDimensions.environmentType
, companyName = customDimensions.companyName
// what was changed
, alSourcePermissionSetId = customDimensions.alSourcePermissionSetId
, alLinkedPermissionSetId = customDimensions.alLinkedPermissionSetId
, alNumberOfUserDefinedPermissionSetLinks = customDimensions.alNumberOfUserDefinedPermissionSetLinks
// which user did it
, usertelemetryId = case(
  toint( substring(customDimensions.componentVersion,0,2)) >= 20, user_Id // user telemetry ID was introduced in the platform in version 20.0
, 'N/A'
)

Permission set assigned to user

Occurs when a permission set is assigned to a user.

General dimensions

Dimension	Description or value
message	Permission set assigned to user: {alPermissionSetId}
severityLevel	1
user_Id	The user telemetry ID for the user. From the user card, you can use user_Id to identify the user who triggered this telemetry event. Learn more in Assign a telemetry ID to users.

Custom dimensions

Dimension	Description or value
eventId	AL0000E2C
alPermissionSetId	Specifies the ID of the permission set that was assigned to a user.
See common custom dimensions

Sample KQL code (Permission set assigned to user)

This KQL code can help you get started analyzing when a permission set was assigned to a user.

// Permission set assigned to user 
traces
| where timestamp > ago(60d) // adjust as needed
| where customDimensions.eventId == 'AL0000E2C'
| project timestamp
// in which environment/company did it happen
, aadTenantId = customDimensions.aadTenantId
, environmentName = customDimensions.environmentName
, environmentType = customDimensions.environmentType
, companyName = customDimensions.companyName
// what was changed
, alPermissionSetId = customDimensions.alPermissionSetId
// which user did it
, usertelemetryId = case(
  toint( substring(customDimensions.componentVersion,0,2)) >= 20, user_Id // user telemetry ID was introduced in the platform in version 20.0
, 'N/A'
)

Permission set removed from user

Occurs when a permission set is removed from a user.

General dimensions

Dimension	Description or value
message	Permission set removed from user: {alPermissionSetId}
severityLevel	1
user_Id	The user telemetry ID for the user. From the user card, you can use user_Id to identify the user who triggered this telemetry event. Learn more in Assign a telemetry ID to users.

Custom dimensions

Dimension	Description or value
eventId	AL0000E2D
alPermissionSetId	Specifies the ID of the permission set that was removed from the user.
See common custom dimensions

Sample KQL code (Permission set removed from user)

This KQL code can help you get started analyzing when a permission set was removed from a user.

// Permission set removed from user 
traces
| where timestamp > ago(60d) // adjust as needed
| where customDimensions.eventId == 'AL0000E2D'
| project timestamp
// in which environment/company did it happen
, aadTenantId = customDimensions.aadTenantId
, environmentName = customDimensions.environmentName
, environmentType = customDimensions.environmentType
, companyName = customDimensions.companyName
// what was changed
, alPermissionSetId = customDimensions.alPermissionSetId
// which user did it
, usertelemetryId = case(
  toint( substring(customDimensions.componentVersion,0,2)) >= 20, user_Id // user telemetry ID was introduced in the platform in version 20.0
, 'N/A'
)

Permission set assigned to user group

Occurs when a permission set is assigned to a user group.

General dimensions

Dimension	Description or value
message	Permission set assigned to user group: {alPermissionSetId}
severityLevel	1
user_Id	The user telemetry ID for the user. From the user card, you can use user_Id to identify the user who triggered this telemetry event. Learn more in Assign a telemetry ID to users.

Custom dimensions

Dimension	Description or value
eventId	AL0000E2E
alPermissionSetId	Specifies the ID of the permission set that was assigned to the user group.
alUserGroupId	Specifies the ID of the user group that the permission set was assigned to.
See common custom dimensions

Sample KQL code (Permission set assigned to user group)

This KQL code can help you get started analyzing when a permission set was assigned to a user group.

// Permission set assigned to user group 
traces
| where timestamp > ago(60d) // adjust as needed
| where customDimensions.eventId == 'AL0000E2E'
| project timestamp
// in which environment/company did it happen
, aadTenantId = customDimensions.aadTenantId
, environmentName = customDimensions.environmentName
, environmentType = customDimensions.environmentType
, companyName = customDimensions.companyName
// what was changed
, alPermissionSetId = customDimensions.alPermissionSetId
, alUserGroupId = customDimensions.alUserGroupId
// which user did it
, usertelemetryId = case(
  toint( substring(customDimensions.componentVersion,0,2)) >= 20, user_Id // user telemetry ID was introduced in the platform in version 20.0
, 'N/A'
)

Permission set removed from user group

Occurs when a permission set is removed from a user.

General dimensions

Dimension	Description or value
message	Permission set removed from user group: {alPermissionSetId}
severityLevel	1
user_Id	The user telemetry ID for the user. From the user card, you can use user_Id to identify the user who triggered this telemetry event. Learn more in Assign a telemetry ID to users.

Custom dimensions

Dimension	Description or value
eventId	AL0000E2F
alPermissionSetId	Specifies the ID of the permission set that was removed from the user group.
alUserGroupId	Specifies the ID of the user group that the permission set was removed from.
See common custom dimensions

Sample KQL code (Permission set removed from user group)

This KQL code can help you get started analyzing when a permission set was removed from a user group.

// Permission set removed from user group 
traces
| where timestamp > ago(60d) // adjust as needed
| where customDimensions has 'AL0000E2F'
| where customDimensions.eventId == 'AL0000E2F'
| project timestamp
// in which environment/company did it happen
, aadTenantId = customDimensions.aadTenantId
, environmentName = customDimensions.environmentName
, environmentType = customDimensions.environmentType
, companyName = customDimensions.companyName
// what was changed
, alPermissionSetId = customDimensions.alPermissionSetId
, alUserGroupId = customDimensions.alUserGroupId
// which user did it
, usertelemetryId = case(
  toint( substring(customDimensions.componentVersion,0,2)) >= 20, user_Id // user telemetry ID was introduced in the platform in version 20.0
, 'N/A'
)

Permission set changed by an extension.

Occurs when a permission set was changed by an app/extension at install/update time.

General dimensions

Dimension	Description or value
message	Permission set changed by an extension
severityLevel	1

Custom dimensions

Dimension	Description or value
eventId	LC0058
extensionName	Specifies the name of the app/extension that changed the permission set.
extensionId	Specifies the id of the app/extension that changed the permission set.
extensionVersion	Specifies the version of the app/extension that changed the permission set.
extensionpublisher	Specifies the publisher of the app/extension that changed the permission set.
permissionSetExtensionObjectId	Specifies the object ID for the permission set extension that changed the permission set.
permissionSetExtensionObjectName	Specifies the name of the object for the permission set extension that changed the permission set.
permissionSetId	Specifies the ID of the permission set that was changed.
permissionSetName	Specifies the name of the permission set that was changed.
See common custom dimensions

Sample KQL code (analyze permission changes)

This KQL code can help you get started analyzing changes to permission sets.

traces
| where timestamp > ago(60d) // adjust as needed
| where customDimensions.eventId == 'RT0011'
| project timestamp
// in which environment/company did it happen
, aadTenantId = customDimensions.aadTenantId
, environmentName = customDimensions.environmentName
, environmentType = customDimensions.environmentType
, companyName = customDimensions.companyName
// in which extension/app
, extensionId = customDimensions.extensionId
, extensionName = customDimensions.extensionName
, extensionVersion = customDimensions.extensionVersion
, extensionPublisher = customDimensions.extensionPublisher
// in which object
, alObjectId = customDimensions.alObjectId
, alObjectName = customDimensions.alObjectName
, alObjectType = customDimensions.alObjectType
// what did the user do
, documentFormat = customDimensions.documentFormat   // documentFormat dimension added in version 20.0
, LayoutAppId = customDimensions.layoutAppId         // layout dimensions added in version 20.0
, LayoutName = customDimensions.layoutName           // layout dimensions added in version 20.0
, LayoutType = customDimensions.layoutType           // layout dimensions added in version 20.0
, reportAction = customDimensions.reportAction       // reportAction dimension added in version 20.0
, reportingEngine = customDimensions.reportingEngine // reportingEngine dimension was added in version 17.3
// which user ran the report
, usertelemetryId = case(
  toint( substring(customDimensions.componentVersion,0,2)) >= 20, user_Id // user telemetry ID was introduced in the platform in version 20.0
, 'N/A'
)
// why was the report cancelled
, cancelReason = tostring( customDimensions.cancelReason )
, alStackTrace = customDimensions.alStackTrace

Related information

Monitoring and Analyzing Telemetry
Enable Sending Telemetry to Application Insights