Skip to main content

App registration and permissions

To make the BI endpoints available to tools outside Business Central — Power BI, Microsoft Fabric, Postman, your own code — you need an app registration in Microsoft Entra ID that can authenticate against your Business Central environment, and that app needs permission inside Business Central.

1. Create the app registration​

  1. Sign in to the Azure portal.
  2. Navigate to Microsoft Entra ID > App registrations.
  3. Click New registration.
  4. Enter a name for your application, for example Business Central API Access.
  5. Select Single tenant only for supported account types.
  6. Under Redirect URI insert https://businesscentral.dynamics.com/OAuthLanding.htm.
  7. Click Register.

Configure API permissions​

  1. In your new app registration, go to API permissions.
  2. Click Add a permission.
  3. Select Dynamics 365 Business Central.
  4. Choose Application permissions.
  5. Select API.ReadWrite.All.
  6. Click Add permissions.
  7. Click Grant admin consent for [your organization].

Create a client secret​

  1. Go to Certificates & secrets.
  2. Click New client secret.
  3. Enter a description and select an expiration period.
  4. Click Add.
  5. Copy the secret value immediately — it will not be shown again.

Note the IDs​

  1. Go to Overview.
  2. Copy the Application (client) ID.
  3. Copy the Directory (tenant) ID.
  4. From the Microsoft Entra ID overview, copy the Primary domain. This is either your company domain, like datawareness.com, or <your domain>.onmicrosoft.com.
note

Store the IDs and the secret securely. You need them to authenticate, and the secret expires on the date you chose — put a reminder in your calendar.

2. Register the application in Business Central​

  1. Open Business Central and search for Microsoft Entra Applications.
  2. Click New to create a new entry.
  3. Enter the Client ID from your app registration.
  4. Enter a Description, for example Business Central API Access.
  5. Set the State to Enabled.

3. Assign permission sets​

Grant the application the permissions it needs on the same page:

Permission setCaptionUse it for
DTW BI ENDPOINTSBI Endpoints - ReadRequired. Read access to every standard endpoint, including the Business Central tables behind them, the metadata endpoints and the Management API.
Custom permission sets—Optional. When you set up custom endpoints on tables the standard endpoints do not cover, add a permission set that can read those tables.
D365 READ—Optional. Read access to most Business Central data.
D365 FULL ACCESS—Optional, use with caution. Comprehensive access.

:::tip Least privilege

Only grant the permissions your use case needs. DTW BI ENDPOINTS alone is enough for every standard endpoint.

:::

The two permission sets that come with the app:

Permission setCaptionWho gets it
DTW BI ENDPOINTSBI Endpoints - ReadThe app registration (and any user) that reads data through the API
DTW BI Endpoints AdmBI Endpoints - AdminBusiness Central users who manage the app: setup, subscription, custom endpoints

Before leaving the Microsoft Entra Applications card, choose Grant Consent. This requires admin permissions in Business Central.

Next​

Activate the subscription on BI Endpoints Setup.