Skip to content

Configuring an App Registration in Azure

The following steps must be performed to create an App Registration in Business Portals. An App Registration is required for Business Portals to utilize all the features available in Business Portals.

Info

To perform this setup, the Administrator account must exist in both Business Central and the Azure Portal, as only administrators have the necessary permissions.

Business Central (SaaS)

An App Registration wizard is available in Business Portals to configure an App Registration in Business Portals. The App Registration Wizard guides you through creating a new App Registration for Business Portals or using an existing App Registration. Follow the steps below to configure the App Registration in Business Portals for Business Central in a SaaS environment.

  1. Navigate to Business Portals - Setup.
  2. Click on the App Registration action and perform the Configure App Registration action.
  3. Click Start to begin the configuration of the App Registration.
  4. Choose whether to create a new App Registration or to use an existing App Registration.

Creating a New App Registration

In the following steps, you will learn how to create a new App Registration for Business Portals using the App Registration Wizard:

  1. If a sign-in pop-up appears, ensure that you sign in to both Business Portals and Azure with an Administrator account to proceed with creating the App Registration.
  2. Enter a name for the App Registration in the App Registration Name field.
  3. Clicking Next will start the creation process of the App Registration in Azure. This process will create all necessary permissions and credentials to be used by Business Portals.
  4. A pop-up will appear allowing you to create a new user in the Azure Active Directory application. Click Yes to continue with the creation of the App Registration.
  5. You will be navigated to the Azure Active Directory application page, where you can click the Grant Consent action button to provide the administrator's consent and permissions in Azure. If a pop-up appears, ensure that you sign in to both Business Portals and Azure with an Administrator account.
  6. Close the Azure Active Directory application page, and the App Registration Wizard will automatically navigate to the next step.
  7. The client secret will only be displayed once. The client secret is required if you want to reuse an existing App Registration. You cannot return to this step once you click Next.
  8. Click Next to continue.
  9. The configuration of the App Registration is now complete. Click Finish to close the App Registration Wizard.

Using an Existing App Registration

The following steps show you how to use an existing App Registration for Business Portals through the App Registration Wizard.

  1. If a sign-in pop-up appears, ensure that you sign in to both Business Portals and Azure with an Administrator account to proceed with creating the App Registration.
  2. Enter the Name of the App Registration you want to use in the App Registration Name field, or use the lookup function to search for all existing App Registrations in your Azure tenant.

Using the Search to Auto-fill the App Registration Data

  1. Select an App Registration from the search, and the wizard will automatically fill in all required fields in the App Registration Wizard, except for the client secret.
  2. Enter the client secret of the selected App Registration in the client secret field. If the client secret is correct, the Next button will be enabled to continue with the configuration of the App Registration.

Manually Entering the App Registration Data

  1. Enter the Name of the App Registration you want to use in the App Registration Name field.
  2. Enter the Application ID (Client ID) of the App Registration you want to use in the Client ID field.
  3. Enter the client secret of the App Registration you want to use in the Client Secret field.
  4. Enter the Directory ID (Tenant ID) of the App Registration you want to use in the Tenant ID field.
  5. Enter the Redirect URL of the App Registration you want to use in the Redirect URL field. In a SaaS environment, the Redirect URL should be https://businesscentral.dynamics.com/OAuthLanding.htm.
  6. Enter the Service Principal ID of the App Registration you want to use in the Service Principal ID field.
  7. Click Next to continue with the configuration. If the Next button is disabled, ensure that all fields are filled out correctly.

Info

To retrieve the Service Principal ID, the following steps can be performed:

  1. Navigate to Enterprise Applications in the Azure Portal.
  2. Change the filter to Application Type == All Applications.
  3. Search for the App Registration you want to use.
  4. Click on the App Registration to open the App Registration page.
  5. Copy the Object ID from the Overview page. The Object ID is the Service Principal ID.

Warning

Existing App Registrations will be overwritten upon completion of the App Registration Wizard.

Renewing the App Registration Credentials

The client secret has an expiration date. The credentials can be automatically renewed without the administrator needing to switch to the Azure Portal using the Renew Secret action. In the following steps, you will learn how to renew the credentials of an App Registration.

  1. Navigate to Business Portals - Setup.
  2. Click on Renew Secret to start the renewal process.
  3. Once the renewal process is complete, a message will appear informing the user that the renewal process was successful, and the new client secret will be displayed once. An administrator can note the new client secret for future use.
  4. Click OK to close the message, and the new client secret will be automatically saved and used by Business Portals.

Info

The new client secret will automatically apply to the other companies in Business Central if the company uses the same App Registration data.

Business Central (On-Premise)

Automatically creating the App Registration from Business Central On-Premise is not possible. Therefore, the creation of the App Registration must be done manually through the Azure Portal Azure.

Creating the Azure App Registration in the Azure Portal

In the following steps, you will learn how to create a new portal for the App Registration for Companies in the Azure Portal.

  1. Sign in to the Azure Portal at Azure Portal.
  2. Click on the Azure Active Directory icon in the left navigation menu.
  3. In the Azure Active Directory menu, click on App Registrations.
  4. Click on the New Registration button.
  5. Enter the name Business Portals in the Name field.
  6. Select the appropriate option for Supported Account Types for the App Registration.
  7. Enter the appropriate Redirect URI for your App Registration. This is the URI to which Azure AD redirects the user after authentication. The URI should be set to Web for the platform and written in the following format https:// external Business Central address/BC/OAuthLanding.htm.
  8. Click the Register button to create the App Registration.
  9. Note the Application ID (Client) and Directory ID (Tenant) on the App Registration page. This is the unique identifier for your App Registration that you will need when configuring your Business Portals in Business Central.
  10. On the Certificates & Secrets tab, click on New client secret to create a new secret that will be used to authenticate your app with Azure AD.
  11. Enter a description for the secret, select an expiration date, and click Add.
  12. Note the generated secret value, as it will only be displayed once and cannot be retrieved later. Please note the secret value, as it is required for configuring Business Portals in Business Central.

Click on the API Permissions tab, click Add Permission, and add the following permissions.

Permission Group API Name / Permission Type Description
Azure Service Management user_impersonation Delegated Access Azure Service Management as an organizational user
Dynamics 365 Business Central API.ReadWrite.All Application Full access to the Web Services API
Dynamics 365 Business Central Automation.ReadWrite.All Application Full access to automation
Microsoft Graph User.Read Application Read all user profiles

Click the Grant Admin Consent button to grant admin consent to the permission.

Adding a Role to a Subscription

Assigning a role in a subscription for the Business Portals app is required to allow them access to the App Service.

Info

The role assignment can only be performed by an Administrator account.

  1. Sign in to the Azure Portal at Azure Portal.
  2. Search for Subscriptions using the search bar.
  3. If you have multiple subscriptions, select the subscription intended for Azure Blob Storage, as a storage account must have a subscription.
  4. Go to the Access Control (IAM) tab and click on the Role Assignments tab.
  5. Click the Add button, and select Add Role Assignment.
  6. On the Role tab, select the Contributor role and click Next.
  7. On the Members tab, click the Select Members button and then add Business Portals.
  8. Click Review + Assign to complete the role assignment process.

Entering the Azure App Registration Information in Business Central

In the following steps, you will learn how to configure the App Registration for Business Portals using the App Registration Wizard.

  1. Navigate to Business Portals - Setup.
  2. Click on the Configure App Registration action in Business Portals - Setup to proceed.
  3. An App Registration Wizard will appear. Click Start to begin the configuration.
  4. To proceed with this step, it is necessary that you have already prepared an App Registration for Business Portals. If you have not created an App Registration for Business Portals, refer to the section Creating the Azure App Registration in the Azure Portal.
  5. Fill in the App Registration Name, Client ID, Client Secret, Tenant ID, and Redirect URL fields.
  6. If all fields are filled out correctly, click Next to continue with the configuration.
  7. When you click Finish, the changes will be applied to the App Registration settings in Business Portals.

Warning

  • If the App Registration is not configured correctly, the Business Portals may not function properly in some areas.
  • Existing App Registrations will be overwritten upon completion of the App Registration Wizard.

Permission Sets on the Entra Application Card

Certain permission sets are assigned to the App Registration user in Business Portals. These are required to enable core functions such as creating invoices through the portal. Below are all the permission sets assigned to the App Registration, including their respective functions:

Permission Set Usage
D365 BASIC Executes the codeunit for master data management upon login.
LOGIN Allows basic sign-in.
SIM_CORE ADMIN Enables license verification
SIM_DPS ADMIN Required for using the standard features of Business Portals.
SIM_DMS USER Automatically assigned when licensing DMStoDPS. Required for uploading and downloading documents.

Info

The Entra Application Card represents the Microsoft Entra ID App Registration through which Business Portals authenticates against Business Central.

The default assigned permission sets cover the functions required for Business Portals. If additional extensions, custom processes, or customizations are used, further permission sets may be required.

In this case, assign the appropriate permission sets to the Entra Application Card so that the app can access the necessary data and functions.