To use SAP Business One more efficiently, once authorizations have been defined for one user, this authorization profile can be copied to another user. For example, by copying an authorization profile, the same permissions can be granted to all the employees who work in the same department.

SAP Business One is equipped with a comprehensive authorization facility that can be tailored to every user. During the implementation phase, the system administrator should devise an authorization policy to prevent unauthorized access to the database.

Note that changes to the history for user and authorization settings are not recorded. Any changes in customization (system configuration) and user settings must be documented manually. Since changes to system parameters are part of the internal monitoring system, they must also be documented. Documentation can take the form of a simple printout of the table contents, or screenshots.

Certain precautions must be taken to ensure that access to the data is monitored. In the General Ledger, users who do not have authorization for the document journal but are authorized for journal entries can use the data record pushbuttons to scroll through the database and view documents. In this way, they can display other entries, even though they are not authorized to display lists, for example in the document journal.

By assigning the correct authorization, changes to document fields can be restricted. This does not apply to users who have been defined as superusers.