Skip to content

Configuration of an App Registration in Azure

The following steps must be completed to create an App Registration in Document Central. An App Registration is required by Document Central to utilize all available features of Document Central.

Info

To perform this setup, it is necessary that the Administrator account exists in both Business Central and the Azure Portal, as only administrators have the necessary permissions.

Business Central (SaaS)

An App Registration wizard is available in Document Central to configure an App Registration in Document Central. The App Registration wizard will guide you through creating a new App Registration for Document Central or using an existing App Registration. The following steps describe the configuration of the App Registration in Document Central for Business Central in the SaaS environment.

  1. Navigate to Document Central - Module Setup.
  2. In the Document Central - Module Setup, click on the action Configure App Registration to proceed.
  3. Click on Start to begin the configuration of the App Registration.
  4. Choose either Create New App Registration or Use Existing App Registration.

Create New App Registration

The following steps will guide you on how to create a new App Registration for Document Central using the App Registration wizard.

  1. If a sign-in popup appears, ensure that you sign in with an Administrator account in both Document Central and Azure to proceed with creating the App Registration.
  2. Enter a name for the App Registration in the App Registration Name field.
  3. Clicking Next will start the creation process of the App Registration in Azure. This process creates all necessary permissions and credentials that will be used by Document Central.
  4. A popup will appear to create a new user in the Azure Active Directory application. Click Yes to continue with the creation of the App Registration.
  5. You will be redirected to the Azure Active Directory application page, where you can click the action button Grant Consent to grant administrator consent and permissions in Azure. If a popup appears, ensure that you sign in with an Administrator account in both Document Central and Azure.
  6. Close the Azure Active Directory application page, and the App Registration wizard will automatically navigate to the next step.
  7. The Client Secret of the App Registration will only be displayed once. Please make a note of the Client Secret. You cannot return to this step once you click Next.
  8. Click Next to continue.
  9. The configuration of the App Registration is now complete. Click Finish to close the App Registration wizard.

Use Existing App Registration

The following steps will guide you on how to use an existing App Registration for Document Central through the App Registration wizard.

  1. If a sign-in popup appears, ensure that you sign in with an Administrator account in both Document Central and Azure to proceed with creating the App Registration.
  2. Enter the App Registration Name of the App Registration you wish to use in the App Registration Name field, or use the search function to look for all existing App Registrations in your Azure tenant.

Using the Search to Auto-fill App Registration Data

  1. Select an App Registration via the search, and the wizard will automatically fill in all necessary fields in the App Registration wizard, except for the Client Secret.
  2. Enter the Client Secret of the selected App Registration in the Client Secret field. If the Client Secret is correct, the Next button will be enabled to continue with the configuration of the App Registration.

Manual Entry of App Registration Data

  1. Enter the App Registration Name of the App Registration you wish to use in the App Registration Name field.
  2. Enter the Application (Client) ID of the App Registration you wish to use in the Client ID field.
  3. Enter the Client Secret of the App Registration you wish to use in the Client Secret field.
  4. Enter the Directory (Tenant) ID of the App Registration you wish to use in the Tenant ID field.
  5. Enter the Redirect URL of the App Registration you wish to use in the Redirect URL field. In the SaaS environment, the Redirect URL should be https://businesscentral.dynamics.com/OAuthLanding.htm.
  6. Enter the Service Principal ID of the App Registration you wish to use in the Service Principal ID field.
  7. Click Next to continue with the configuration. If the Next button is disabled, ensure that all fields are filled out correctly.

Info

To obtain the Service Principal ID, the following steps can be performed:

  1. In the Azure Portal, navigate to Enterprise Applications.
  2. Change the filter to Application Type == All Applications.
  3. Search for the App Registration you wish to use.
  4. Click on the App Registration to open the App Registration page.
  5. Copy the Object ID from the Overview page. The Object ID is the Service Principal ID.

You can configure an App Registration in Document Central without granting administrator consent. This option is intended for customers who do not wish to grant consent to our application.

  1. Navigate to Document Central – Module Setup.
  2. Click on Configure App Registration and select Manual App Registration.

  3. Enter the following information:

  4. App Registration Name

  5. Application (Client) ID
  6. Client Secret
  7. Directory (Tenant) ID
  8. Redirect URL (In SaaS environments: https://businesscentral.dynamics.com/OAuthLanding.htm)
  9. Service Principal ID
  10. Click Next to continue.

Info

To obtain the Service Principal ID, follow the steps from the section Use Existing App Registration → Manually Enter App Registration Data. Since no administrator consent is granted, ensure that you manually check the configured permissions of the App Registration in Azure to ensure that all required permissions are correctly set.

(Optional) In the next step, you can upload a Certificate for authentication with SharePoint instead of using user impersonation. This step is optional and can be skipped.

Certificate

Document Central provides the option to authenticate with SharePoint using a certificate, allowing the App Registration to use a certificate for authentication with SharePoint. If the selected App Registration has not configured a certificate in Azure, a page will appear asking if you want to create a certificate for the selected App Registration. This is an optional step and can be skipped by clicking Next. However, without a certificate, Document Central cannot authenticate with a App Context in SharePoint.

By using a certificate, Document Central can work with SharePoint without impersonating the user. This also avoids the issue of token expiration that can occur when working with a user context.

To create a certificate for the selected App Registration, the following steps can be performed:

  1. Enable the option Create New Certificate to create a certificate for the selected App Registration. By enabling this option, a certificate for Document Central will be created in this App Registration at the end of the configuration.
  2. Click Next to continue with the configuration.

Warning

Existing App Registrations will be overwritten upon completion of the App Registration wizard.

Renewing App Registration Credentials

The Client Secret and Certificate Credentials have an expiration date. The credentials can be updated without the administrator needing to go to the Azure Portal through the action Renew Secret/Certificate. The following steps describe how to renew the credentials of an App Registration:

  1. Navigate to Document Central - Module Setup.
  2. Click on Renew Secret/Certificate to start the renewal process.

  3. Choose between:

  4. Automatic Renewal – automatically creates and applies a new Client Secret via API calls.

  5. Manual Renewal – opens a field where the administrator can enter a new Client Secret previously created in the Azure Portal. This option is intended for App Registrations that were added manually and do not support automatic renewal.
  6. If manual renewal is selected, enter the newly created Client Secret and confirm. Additionally, enter the expiration date of the secret in the End Date field, as the system cannot automatically retrieve this information for manually entered secrets. The value will then be set and saved directly in the system.
  7. Once the renewal process is complete, a message will be displayed confirming successful completion, and the new Client Secret will be displayed once. An administrator can note the new Client Secret for future use.
  8. Click OK to close the message. The updated Client Secret and certificate will be automatically used by Document Central.

Info

The new Client Secret and Certificate will automatically be adopted in the other tenants of Business Central, provided they use the same App Registration record.

Adding a Role to a Subscription

Assigning a role for the Document Central App in a subscription is necessary to enable the creation and configuration of a Storage Account for Azure Blob Storage. However, if Azure Blob Storage is not used in Document Central in the subscription, this step can be skipped.

Info

Role assignment can only be performed by an administrator account.

  1. Sign in to the Azure Portal at Azure Portal.
  2. Search for Subscriptions using the search bar.
  3. If you have multiple subscriptions, select the one intended for Azure Blob Storage, as a storage account must have a subscription.
  4. Go to the Access Control (IAM) tab and click on the Role Assignments tab.
  5. Click the Add button and select Add Role Assignment.
  6. Under the Role tab, select the Contributor role and click Next.
  7. Under the Members tab, click the Select Members button and add Document Central.
  8. Click Review + Assign to complete the role assignment process.

Entering Azure App Registration Information in Business Central

The following steps will guide you on how to configure the App Registration for Document Central through the App Registration wizard.

  1. Navigate to Document Central - Module Setup.
  2. In the Document Central - Module Setup, click on the action Configure App Registration to proceed.
  3. An App Registration wizard will appear. Click Start to begin the configuration.
  4. To proceed with this step, it is necessary to have already prepared an App Registration for Document Central. If you have not yet created an App Registration for Document Central, please refer to the section Creating the Azure App Registration in the Azure Portal.
  5. Fill in the fields App Registration Name, Client ID, Client Secret, Tenant ID, and Redirect URL.
  6. Once all fields are correctly filled out, click Next to continue with the configuration.
  7. The configuration page for the Client Certificate will be displayed. This step is optional and can be skipped by clicking Next. However, if you wish to use a Client Certificate for authentication with SharePoint, a Certificate must be prepared.
  8. Click on the Certificate Key field to open a popup that allows you to select the .pfx file created in the step Creating a Certificate.
  9. Enter the password for the .pfx file in the Certificate Key Password field and click Next to continue with the configuration.
  10. After clicking Finish, the changes to the App Registration settings in Document Central will be applied.

Warning

  • If the App Registration is not configured correctly, Document Central may not function properly in some areas.
  • Existing App Registrations will be overwritten upon completion of the App Registration wizard.

App Registration Permissions

To utilize the full functionality of Document Central, several permissions are assigned in Azure or Microsoft 365 during setup. These permissions represent the necessary minimum permissions for all functions of Document Central to operate correctly.

Attention

Removing or disabling individual permissions may cause certain functions of Document Central to no longer work correctly or to fail completely.

Since individual functions depend on different permissions, we strongly recommend not removing any of the provided permissions. Otherwise, it cannot be ensured that Document Central will function without issues in future updates or when using additional features.

Permission Group API/Permission Name Type Description
Microsoft Graph offline_access Delegated Allows the use of refresh tokens so that user authentication can be automatically renewed. This means users do not have to sign in again each session when using Document Central and connected Microsoft services.
Microsoft Graph User.Read Delegated Used to determine the currently signed-in user and provide the user context for authentication and permission checks. This permission is used during sign-in and when checking the connection to Microsoft services, among other things.
Microsoft Graph User.Read.All Application Allows searching, selecting, and resolving users from Microsoft Entra ID. Used in configuring and managing user groups and selecting users within Document Central.
Microsoft Graph Group.ReadWrite.All Application Allows creating and managing Microsoft Entra ID groups directly from Document Central. This permission is particularly needed for user group functions and when creating new SharePoint sites, as groups can be created automatically in this process.
Microsoft Graph GroupMember.ReadWrite.All Application Allows adding and removing users in Microsoft Entra ID groups. This permission is used to manage group memberships from Document Central and automatically assign users to the appropriate groups.
Microsoft Graph Sites.ReadWrite.All Application Required to create SharePoint sites directly from Document Central. Without this permission, new SharePoint sites cannot be created automatically, and corresponding setup processes will fail.
SharePoint AllSites.Read Delegated Allows read access to content of connected SharePoint sites. This permission is required for exporting documents, Document Entry Synchronization, and displaying documents in Document Preview.
SharePoint AllSites.Manage Delegated Used for administrative tasks within existing SharePoint sites. This includes publishing metadata, content types, and document libraries, as well as uploading documents to SharePoint libraries.
SharePoint AllSites.FullControl Delegated Allows publishing subsites. This permission is particularly needed during the initial setup or when later expanding the SharePoint structure, for example, when additional subsites are to be published.

Permission Types

Delegated permissions apply in the context of a signed-in user. The application makes requests on behalf of this user and can only access data and functions for which the user has the necessary rights. The granted permission does not extend the user's personal access rights.

Application permissions apply independently of a signed-in user. The application authenticates itself and can access the data and functions covered by the permissions granted to it. With extensive permissions, this can include access to data across the entire Microsoft 365 tenant.

See also