Decorating an event subscriber with InherentPermissions 'R' is insufficient because users still need Insert permission to post sales orders

MB-820 By islever Editorial Last updated

Create entitlement and permission set objects

Short answer

B The event subscriber only adds Read ('R') permission, but users also need Insert to post sales orders, so the solution does not fully meet the goal.

Question

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. A company creates a Business Central app and a table named MyTable to store records when sales orders are posted. Users report the following issues: • The users receive permission errors related to MyTable. • Users are no longer able to post sales orders since installing the new app. • The users cannot access the list page created in MyTable. You need to resolve the user issues without creating new permission sets. You must use the principle of least privilege. Solution: Decorate the event subscriber used for inserting data in MyTable by entering (InherentPermissions(PermissionObjectType::TableData. Database::MyTable. 'R')] Does the solution meet the goal?
  1. Yes
  2. No Correct Answer

Key Takeaways

InherentPermissions must grant every permission the task needs. Here the insert path is the missing piece, so a Read-only grant fails the goal even though it partially addresses permission errors and list access.

This question reuses the same scenario but applies InherentPermissions only at the event subscriber level with the value 'R' (Read). Because the reported issue includes the inability to post sales orders, which requires Insert, granting only Read leaves the core problem unresolved.

Common mistake: Do not be misled by the fact that Read helps with some errors; the question asks whether the solution meets the goal, and the missing Insert means it does not. Always map each reported issue to a required permission letter.

Expert Analysis

Why the Answer Is Correct

Option B is correct because the proposed solution grants only Read ('R') permission through the event subscriber, but posting sales orders requires Insert permission on MyTable. Since the insert capability is still missing, the solution does not resolve all three user issues and therefore does not meet the goal. The community strongly favors B (100 votes), and 5e11cb9 explains that 'Insert is Missing,' so the answer is No.

Why the Other Options Are Wrong

Option A (Yes) would only be valid if Read alone solved every issue, but the blocked sales-order posting needs Insert, which is absent here. The earlier question in the series showed that 'RI' works, which highlights by contrast that 'R' alone is incomplete. The principle is that the granted permission set must cover reading, inserting, and page access together.

Community Comment Notes

5e11cb9 states the solution adds only Read and 'Insert is Missing,' and edbb578 notes that read permission covers only half the issues, both supporting B.

Official Reference

https://learn.microsoft.com/en-us/dynamics365/business-central/dev-itpro/developer/properties/devenv-inherentpermissions-property

This link opens the official vendor documentation in a new tab.

Community Votes

B
100%

100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 4 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 4

  1. 5e11cb9 👍 18
    The solution presented here is to add inherent permissions of type "Read". This does not solve the problem of permission errors when INSERTING data. Correct answer should be B "No"
  2. edbb578 👍 3 Answered B
    read permission is only a half of the issues .... need insert too ... the answer is "No"
  3. ddc215f 👍 1
    a table named MyTable to store records. So indeed B is the right answer. Type 'R' does not solve the problem
  4. e3b13ec 👍 2 Answered B
    Insert is Missing -> Answer B

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Snapshot debugging only fires on the next session of the configured user, so a session that never occurs means debugging never starts

S-grade

Use Get-BcArtifactUrl with -select Current to pull the most recent Business Central artifact URL when setting up a local development Docker container

S-grade

Adding InherentPermissions = 'RI' to a table object grants Read and Insert permissions and resolves permission errors, blocked posting, and list-page access without a new permission set

S-grade

On a Role Center page, define the navigation bar (second-level navigation) in the area(Embedding) to link to other pages

S-grade

← Back to MB-820 Study Guide