Talking in these days with some partners, I discovered that it’s not so clear how to handle the possibility to install apps on a Dynamics 365 Business Central SaaS tenant. Who can do that? The answer is: it depends
As a general rule:
This is clear I think. So, what’s the sneaky part of that?
You need to remember that with Dynamics 365 Business Central SaaS, licenses are purchased by the CSP partner and when a tenant is activated, the first user that logs into that tenant gets the SUPER permission set. This means that if the first user that logs into the tenant is the PARTNER (what I think normally should happen), the partner itself that can install apps and can assign the D365 EXTENSION MGMT permission to the customer’s users only if needed (please don’t do that with too much users).
If instead is the CUSTOMER that first logs into the tenant, the customer itself gets the SUPER permission set, he can install and remove apps and then you (as a partner) need to discuss with him the appropriate permissions to assign to you and them (you’re not automatically a SUPER user).