Skip to content

Creating an App Registration in Azure

The following steps must be taken to create an App Registration in Document Inbound from Simova. An App Registration is required for Document Inbound to utilize all available features.

Info

To perform this setup, the Administrator account must be present in both Business Central and the Azure Portal, as only administrators have the necessary permissions.

Business Central (SaaS)

  1. Navigate to the Document Inbound - Module Setup.
  2. Click on the Create Registration action in the Document Inbound - Module Setup to proceed.
  3. When a sign-in pop-up appears, sign in with an Administrator account in both Document Inbound and Azure to continue creating the App Registration.
  4. Once the App Registration is created, a new user named Document Inbound by Simova will be automatically generated for the Azure Active Directory application. A pop-up will direct you to the Azure Active Directory application page, where you can click the Grant Consent button to provide administrator consent and permissions in Azure.
  5. The App Registration field group in the Document Inbound - Module Setup should now be filled out, and an App Registration named Document Inbound by Simova has been created in your Azure Portal App Registrations.

Business Central (On-Premise)

The automatic creation of the App Registration from Business Central On-Premise is not possible. Therefore, the creation of the App Registration must be done manually through the Azure Portal.

Creating the Azure App Registration in the Azure Portal

The following steps guide you on how to create a new App Registration for Document Inbound in the Azure Portal.

  1. Sign in to the Azure Portal at Azure Portal.
  2. Click on the Azure Active Directory icon in the left navigation pane.
  3. In the Azure Active Directory menu, click on App Registrations.
  4. Click on the New Registration button.
  5. Enter the name Document Inbound in the Name field.
  6. Select the appropriate option for the Supported account types for the app registration.
  7. Enter the appropriate Redirect URI for your app registration. This is the URI to which Azure AD redirects the user after authentication. The URI should be set to Web for the platform and written in the following format: https://**external Business Central address/BC/OAuthLanding.htm**.
  8. Click the Register button to create the app registration.
  9. Note the Application (client) ID and Directory (tenant) ID on the app registration page. This is the unique identifier for your app registration that you will need when configuring your Document Inbound in Business Central.
  10. Under the Certificates & secrets tab, click on New client secret to create a new secret that will be used to authenticate your app with Azure AD.
  11. Enter a description for the secret, select an expiration date, and click Add.
  12. Note the generated Secret value, as it will only be displayed once and cannot be retrieved later. Please note the Secret value, as it is needed to configure Document Inbound in Business Central.
  13. Under the API permissions tab, click on Add a permission and add the following permissions.
Permission Group API / Permission Name Type Description
Microsoft Graph Directory.Read.All Application Allows reading directory data across the Microsoft Entra ID tenant. This includes users, groups, app registrations, and other directory objects. The permission is used to retrieve information tenant-wide, resolve directory objects, and check their existence or properties without requiring a user to be signed in.
Microsoft Graph Directory.Read.All Application Required when the product needs to identify, verify, or display user, group, or application information across tenants. This may be necessary for user selections, group assignments, permission checks, or background processes.
Microsoft Graph Group.ReadWrite.All Application Allows creating, reading, updating, and deleting Microsoft 365 and Entra ID groups. Additionally, group properties and memberships can be managed without requiring a user to be signed in.
Microsoft Graph Group.ReadWrite.All Application Allows managing group memberships, such as adding or removing users in Microsoft 365 or Entra ID groups. This enables users to be automatically assigned to the appropriate groups and permissions.
Microsoft Graph Group.ReadWrite.All Application Allows reading and writing group-related content and conversations within Microsoft 365 groups. This permission is used when the application provides features based on group collaboration or group-based communication.
Microsoft Graph Mail.ReadBasic.All Application Allows reading basic properties of emails in all mailboxes, such as sender, recipient, subject, and received date. Access explicitly does not include message content, preview texts, attachments, or extended email properties.
Microsoft Graph Mail.ReadBasic.All Application Used to provide email metadata for overviews, audits, search functions, or synchronization processes without needing to access confidential email content.
Microsoft Graph Mail.ReadWrite Application Allows creating, reading, updating, and deleting emails in all mailboxes of the tenant. The application can manage and edit email objects without requiring a user to be signed in.
Microsoft Graph Mail.ReadWrite Application Used for automated processing of emails, such as moving, filing, adjusting, or deleting messages. The permission does not include sending emails.
Microsoft Graph User.Read Delegated Allows a user to sign in to the application and read basic profile information of the currently signed-in user. This includes name, email address, and other information needed for user identification.
Microsoft Graph User.Read Delegated Used to provide the current user context within the application, such as displaying user information or associating actions with the signed-in user.
Microsoft Graph User.Read.All Application Allows reading the full user profiles of all users in the Microsoft Entra ID tenant. This includes information such as names, email addresses, departments, and other profile attributes.
Microsoft Graph User.Read.All Application Used to resolve, display, and process user information tenant-wide. Typical use cases include user lists, user assignments, audits, permission analyses, or automated background processes.
  1. Click the Grant admin consent button to grant the permission for admin consent.

Entering Azure App Registration Information in Business Central

The following steps guide you through configuring the App Registration for incoming documents via the App Registration Wizard.

  1. Navigate to Incoming Document - Module Setup.
  2. Click on the Configure App Registration action in the Document Inbound - Module Setup to proceed.
  3. An App Registration Wizard will appear. Click Start to begin the configuration.
  4. To proceed with this step, it is necessary that you have already prepared an App Registration for Document Inbound. If you have not created an App Registration for incoming documents, refer to the section Creating the Azure App Registration in the Azure Portal.
  5. Fill in the fields App Registration Name, Client ID, Client Secret, Tenant ID, and Redirect URL.
  6. Once all fields are correctly filled out, click Next to continue with the configuration.
  7. When you click Finish, the changes will be applied to the settings for the App Registration in Incoming Document.

!! Warning * If the App Registration is not configured correctly, Document Inbound may not function properly in some areas. * Existing App Registrations will be overwritten after completing the App Registration Wizard.

See also