Skip to content

Configuration of an App Registration in Azure

The following steps must be completed to create an App Registration in Document Central. An App Registration is required by Document Central to utilize all available features of Document Central.

Info

To perform this setup, it is necessary that the Administrator account exists in both Business Central and the Azure Portal, as only administrators have the necessary permissions.

Business Central (On-Premise)

The automatic creation of the App Registration from Business Central On-Premise is not possible. Therefore, the creation of the App Registration must be done manually through the Azure Portal.

Creating the Azure App Registration in the Azure Portal

The following steps guide you on how to create a new App Registration for Document Central in the Azure Portal.

  1. Sign in to the Azure Portal at Azure Portal.
  2. Click on the Azure Active Directory icon in the left navigation pane.
  3. Click on App registrations in the Azure Active Directory menu.
  4. Click on the New registration button.
  5. Enter the name Document Central in the Name field.
  6. Select the appropriate option for the Supported account types for the app registration.
  7. Enter the appropriate Redirect URI for your app registration. This is the URI to which Azure AD redirects the user after authentication. The URI should be set to Web for the platform and written in the following format: https://**external Business Central address/BC/OAuthLanding.htm**.
  8. Click the Register button to create the app registration.
  9. Note the Application (client) ID and Directory (tenant) ID on the app registration page. This is the unique identifier for your app registration that you will need when configuring your Document Central in Business Central.
  10. Click on New client secret under the Certificates & secrets tab to create a new secret that will be used to authenticate your app with Azure AD.
  11. Enter a description for the secret, select an expiration date, and click Add.
  12. Note the generated Client secret, as it will only be displayed once and cannot be retrieved later. Please note the Client secret, as it is needed to configure Document Central in Business Central.
  13. Click on Add permission under the API permissions tab and add the following permissions.
Permission Group API/Permission Name Type Description
Microsoft Graph offline_access Delegated Allows refresh tokens to be used so that user authentication can be renewed automatically. This means users do not have to sign in again in every session when using Document Central and connected Microsoft services.
Microsoft Graph User.Read Delegated Used to identify the currently signed-in user and provide the user context for authentication and authorization checks. This permission is used during sign-in and when checking the connection to Microsoft services.
Microsoft Graph User.Read.All Delegated Allows users to be searched for, selected, and resolved from Microsoft Entra ID. It is used when configuring and managing user groups and when selecting users within Document Central.
Microsoft Graph Group.ReadWrite.All Delegated Allows Microsoft Entra ID groups to be created and managed directly from Document Central. This permission is particularly required for user group features and when creating new SharePoint sites, as groups can be created automatically in the process.
Microsoft Graph GroupMember.ReadWrite.All Delegated Allows users to be added to and removed from Microsoft Entra ID groups. This permission is used to manage group memberships from Document Central and automatically assign users to the relevant groups.
Microsoft Graph Sites.ReadWrite.All Delegated Required to create SharePoint sites directly from Document Central. Without this permission, new SharePoint sites cannot be created automatically and related setup processes fail.
SharePoint AllSites.Read Delegated Allows read access to the content of connected SharePoint sites. This permission is required for exporting documents, Document Entry Synchronization, and displaying documents in Document Preview.
SharePoint AllSites.Manage Delegated Used for administrative tasks within existing SharePoint sites. This includes publishing metadata, content types, and document libraries, as well as uploading documents to SharePoint libraries.
SharePoint AllSites.FullControl Delegated Allows subsites to be published. This permission is particularly required during initial setup or later extensions of the SharePoint structure, for example when additional subsites are to be published.
  1. Click the Grant admin consent button to grant the permission an admin consent.

Caution

Removing or disabling individual permissions may cause certain features of Document Central to no longer function correctly or to fail completely.

Since individual functions depend on different permissions, we strongly recommend not removing any of the provided permissions. Otherwise, it cannot be ensured that Document Central will function properly with future updates or the use of additional features.

Creating a Certificate

Creating a Client Certificate allows Document Central to authenticate with SharePoint without impersonating the user. This also avoids the issue of token expiration that can occur when working with a user context. Using a Client Certificate is optional. However, if you wish to use a Client Certificate for authentication with SharePoint, follow the steps below to create a Client Certificate for Document Central.

  1. Navigate to Certificates and follow the steps to create a Client Certificate. The .pfx file and the .cer files will be needed. Please note the password of the .pfx file, as it is required to configure Document Central in Business Central.
  2. Navigate to the created Azure App Registration for Document Central.
  3. Click on the Certificates tab under Certificates & secrets.
  4. Click on Upload certificate, then upload the .cer file and write a description.
  5. Click on Add to save the certificate.
  6. The pfx file will be uploaded in the Document Central Configuration.

Adding a Role to a Subscription

Assigning a role for the Document Central App in a subscription is necessary to enable the creation and configuration of a Storage Account for Azure Blob Storage. However, if Azure Blob Storage is not used in Document Central in the subscription, this step can be skipped.

Info

The role assignment can only be performed by an administrator account.

  1. Sign in to the Azure Portal at Azure Portal.
  2. Search for Subscriptions using the search bar.
  3. If you have multiple subscriptions, select the one intended for Azure Blob Storage, as a storage account must have a subscription.
  4. Go to the Access control (IAM) tab and click on the Role assignments tab.
  5. Click the Add button and select Add role assignment.
  6. Under the Role tab, select the Contributor role and click Next.
  7. Under the Members tab, click the Select members button and add Document Central.
  8. Click on Review + assign to complete the role assignment process.

Inputting the Azure App Registration Information in Business Central

The following steps guide you on how to configure the App Registration for Document Central using the App Registration Wizard.

  1. Navigate to Document Central - Module Setup.
  2. In the Document Central - Module Setup, click on the Configure App Registration action to proceed.
  3. An App Registration Wizard will appear. Click on Start to begin the configuration.
  4. To proceed with this step, it is necessary to have already prepared an App Registration for Document Central. If you have not yet created an App Registration for Document Central, please refer to the section Creating the Azure App Registration in the Azure Portal.
  5. Fill in the fields App Registration Name, Client ID, Client Secret, Tenant ID, and Redirect URL.
  6. Once all fields are correctly filled out, click Next to continue with the configuration.
  7. The configuration page for the Client Certificate will be displayed. This step is optional and can be skipped by clicking Next. However, if you wish to use a Client Certificate for authentication with SharePoint, a Certificate must be prepared.
  8. Click on the Certificate key field to open a popup that allows you to select the .pfx file created in the Creating a Certificate step.
  9. Enter the password of the .pfx file in the Certificate key password field and click Next to continue with the configuration.
  10. After clicking Finish, the changes to the App Registration settings in Document Central will be applied.

Warning

  • If the App Registration is not configured correctly, Document Central may not function properly in some areas.
  • Existing App Registrations will be overwritten upon completion of the App Registration Wizard.

See also