D365 Business Central : Setup OAuth2 Authentication

We need to use OAuth2 when we want to connect to Business Central API. In this post, I would like to talk about how to setup OAuth2 authentication. OAuth 2.0 (Open Authorization) is a standard authorization protocol designed to allow a website or application to access resources hosted by other web apps on behalf of a user. There are basically two things that we need to do to set it up: register the app in Azure Portal and in Business Central.

Access the Azure Portal and search for App Registrations.

Click New Registration.

Provide the name and supported account types for the new applications, then click Register. Depends on the requirement, we can choose Single Tenant or Multitenant.
Select Web as Redirect URI and specify this url: https://businesscentral.dynamics.com/OAuthLanding.htm

Go to API Permissions and add a permission.

Select Dynamics 365 Business Central.

Click Application Permissions.

Select API.ReadWrite.All then click Add Permissions. This permission does not mean that we give full access to all Business Central API. Data access is still being managed by permission inside Business Central.

We need to grant admin consent to the permission.

Go to Certificates & Secrets and create new client secret. We can determine the duration of the secret. The longest period is 24 months. This means that you need to update the secret every two years.

Copy and store the secret value. Also make sure to store the Application (client) ID and Directory (tenant) ID that we can get from the Overview page. We need this three values to connect to Business Central API.

Time to work on Business Central. Head to Business Central and search for Azure Active Directory Applications (it is now called Microsoft Entra Applications).

Click New.

Enter the Application (client) ID from Azure. We can also specify Description here.

Change the State to Enabled and assign the permissions. Note that we cannot assign SUPER permission.

Click Grant Consent.

That’s it. We can then use any of our preferred method to test the connection.

Refer to this post to test OAuth2.