Table of Contents

Set up SwissSalary users and allocation group filters

On the User Setup SwissSalary page, system or payroll administration controls the visible scope of data for each Business Central user — in addition to permission sets. The Allocation Group Filter (and optionally Insights groups) limits access to allocation groups and to the personnel, journal, payroll run, and budget data that depend on them. Set up the filters when creating users, when roles change, and before productive access to separate allocation groups.

Wichtig

This setup doesn't replace permission sets. Whether someone may read, edit, or post data is governed by the Business Central permission sets (for example, SwS Setup, SwS Read, SwS Process, SwS Posting). The allocation group filter additionally limits the visible scope of data.

Prerequisites

  • The user exists in Business Central (User ID / user name).
  • The required allocation groups are set up. For more information, see Set up allocation groups for separate payroll processes.
  • You have administrative rights for the SwissSalary user setup (for example, the SwS Setup permission set).

Add a user in User Setup SwissSalary

  1. Open the User Setup SwissSalary page (administration).
  2. Create a new line and choose the User ID of the Business Central user.
  3. Set the Allocation Group Filter (see the next section).
  4. Optionally, set the Insights Group Filter if Insights groups control access.
  5. Save the line.
Hinweis

The underlying table is called User SwissSalary.

In the default view, Employee No., department authorizations, and the consortium access-level filter, among others, are hidden. Use only the fields and processes released by your organization; don't invent additional UI.

Allocation Group Filter

Filter value Effect
BLOCKED Default when inserting a new user line. No allocation group data is visible until you set the filter deliberately.
empty Unrestricted: all allocation groups and dependent data.
Specific filter Only the specified allocation groups (and dependent data).

The filter is a text field that refers to allocation groups (Allocation Group). Enter multiple values and ranges using the usual Business Central filter syntax (for example, several codes separated by the pipe character or ranges with ..), provided the codes support it.

Warnung

If the value BLOCKED remains in place, the user sees no data in the filtered SwissSalary areas. Set up the filter before productive use and check the access with the affected user account.

When a line is created, SwissSalary sets Allocation Group Filter and Insights Group Filter automatically to BLOCKED.

Effect of the security filters

When applying the security filters (session/login through Security Filter Management), SwissSalary evaluates the user line and sets filters on the relevant tables, including:

  • employees and dependent personnel data (for example, banks, children, social insurance, statistics)
  • allocated salaries, salary entries, journal batches, and journal lines
  • payroll run headers, payroll cues, and logs
  • pay-increase data
  • with licensed budget functionality, budget entries and structures
  • with licensed Plus functionality, among others, documents, KLE, SmartPort, Direct, and consortiums
Hinweis

If the user line in User Setup SwissSalary is missing, the filter logic blocks access to the secured tables. Create every payroll user explicitly and configure the filter.

Operations blocked while a filter is active

Users with a non-empty Allocation Group Filter are considered restricted. Certain master data changes are then blocked, including:

  • creating, renaming, or deleting an allocation group
  • creating or deleting benefits and the associated rates, limits, thresholds, and contract lines (and renaming them where applicable)
  • renaming or deleting benefit types
  • creating, renaming, or deleting social funds (Social Fund)

The error message appears in the product in English:

This operation is not allowed because an allocation group filter is applied to your user.

Only users with an empty Allocation Group Filter (unrestricted) may perform such centrally effective master data changes.

First user and delegated admin

  • First user: When you open the SwissSalary activities in the Role Center, SwissSalary creates the current user if the User SwissSalary table is still empty, and sets the Allocation Group Filter to empty (unrestricted).
  • Delegated admin: For authorized SwissSalary support accounts, a user line with an empty Allocation Group Filter can be created automatically, provided no line exists yet for the User ID.

Then plan deliberately which further users should work restricted and which unrestricted.

How this differs from permission sets

Control Purpose
Business Central permission sets (for example, SwS Setup, SwS Read, SwS Process, SwS Posting) Which actions and table rights the user has
User Setup SwissSalary / Allocation Group Filter Which allocation groups and dependent records are visible or usable

Both layers must match: without matching permission sets, the pages don't open; without a matching filter, the user sees too many or too few payroll areas.

Verification

  1. Does every payroll user have a line in User Setup SwissSalary?
  2. Is BLOCKED set only as a deliberate blocked state, not as a permanent state?
  3. Do restricted users see only the intended allocation groups (spot check with a test user)?
  4. Can unrestricted admins maintain allocation groups and benefits, and can restricted users not perform these central changes?
  5. Do the permission sets and filters match the distribution of roles?

Good to know

  • If you leave the Allocation Group Filter at BLOCKED, the user sees no payroll data and can't edit the run.
  • If the line in User Setup SwissSalary is missing, access to the secured tables remains blocked — the payroll process comes to a standstill.
  • If you confuse rights and filters, you open other groups or block postings; compliance and the separation of responsibilities suffer.
  • If you plan restricted users for allocation groups, benefits, or social funds, central master data changes fail in the middle of the month.
  • If you leave the first user unrestricted and don't distribute roles, you risk uncontrolled changes to payroll and reports.

See also