Service-to-Service (S2S) authentication is suited for scenarios where integrations are required to run without any user interaction. S2S authentication uses the Client Credentials OAuth 2.0 Flow. This flow enables you to access resources by using the identity of an application.
For more information, refer to the Microsoft article linked below:
Using S2S Authentication with Automation APIs.
If you’d like to watch the video that accompanies this, please see below or click here.
To set up service-to-service authentication, you’ll have to do two things:
- Register an application in your Microsoft Entra tenant for authenticating API calls against Dynamics 365 Business Central.
- Grant access for that application in Dynamics 365 Business Central.
These tasks are described in the sections that follow.
Task 1: Register a Microsoft Entra application for authentication to Dynamics 365 Business Central
Setting Up the Application in Microsoft Azure:
Follow steps 1 to 16 in the guide below:
Connecting to Dynamics 365 Business Central Using an OAuth Token
Additionally, you need to add the following API permissions: API.ReadWrite.All and Automation.ReadWrite.All, and grant admin consent for <tenant name>.
- Select ‘API permissions’ > ‘Add a permission’ > ‘Microsoft APIs’.
- Select ‘Dynamics 365 Business Central’.
- Select ‘Application permissions’, and select ‘API.ReadWrite.All’ and ‘Automation.ReadWrite.All‘ then select ‘Add permissions’.
| API / Permission name | Type | Description |
| Dynamics 365 Business Central / Automation.ReadWrite.All | Application | Full access to automation |
| Dynamics 365 Business Central / API.ReadWrite.All | Application | Access to APIs and web services |
For Example:
Task 2: Grant access to that application in Dynamics 365 Business Central
Complete these steps to set up the Microsoft Entra application for service-to-service authentication in Dynamics 365 Business Central.
- In the Dynamics 365 Business Central client, search for Microsoft Entra applications and open the page. PS: Microsoft Azure Active Directory Applications has been renamed to Microsoft Entra Applications
- Select ‘New. >> Microsoft Entra application Card‘ opens.
- In the Client ID field, enter the Application (Client) ID for the registered application in Microsoft Entra ID from task 1.
- Fill in the Description field. If this application is set up by a partner, please enter sufficient partner-identifying information, so all applications set up by this partner can be tracked in the future if necessary.
- Set the State to Enabled.
For example, if the description field is set to “SCEntraIDUser,” you will see the prompt:
“A user named ‘SCEntraIDUser’ will be created. Do you want to continue?”
Respond with “Yes” to proceed. - Assign permissions to objects as needed.
For more information, Assign Permissions to Users and Groups.
The most commonly used permission in this scenario is D365 BUS FULL ACCESS.
(optional) Select ‘Grant Consent’ and follow the wizard.
This step will grant consent to the API. This step is only required if you haven’t granted consent from the Microsoft Azure portal in task 1. You can only complete this step if you’ve configured a redirect URL in the registered Microsoft Entra app.
Setting up the connector in SmartConnect 21:
- Navigate to Connections and click the ‘Create Connection button’ (or edit an existing BC connection).
- Select ‘Dynamics 365 Business Central OData’.
| Description | Name given to the new Connection. |
| Service URL | Enter your Service URL – this will be the base URL for OData services up to the /ODataV4/ portion of the URL (ie. https://api.businesscentral.dynamics.com/v2.0/<tenant-guid-here>/Production/ODataV4/). Your tenant GUID will be unique for each BC tenant/instance. |
| Use OAuth | If checked, the connection will need to be set up using the new OAuth process. Below is the link on how to set up that process. Connecting to Dynamics 365 Business Central using an OAuth Token | SmartConnect (eonesolutions.com) If not checked, the connection will be setup using username/password. The username can be found in Dynamics 365 Business Central under “Users”, and the password will be the Web Service Access Key for that user. Note: OAuth will be the only option in the future. |
| Tenant Id | The ID of the Dynamics 365 Business Central Tenant being used. This can be located within the Service URL. |
| Client Id | The Client (Application) Id from the application that was registered in the Microsoft Azure Portal. |
| Client Secret | The Client Secret from the application. If the secret value was not saved when registering the application, then a new secret and value will need to be created. |
| Use Service Authentication | Allows the connection to be made without using a user account. |
| Authorize | This will start the OAuth process and you will be directed to a Microsoft login if not already logged in. If you are still logged in, you will be asked to grant permission. Click ‘accept’ to grant the permissions. If your user does not have the proper permissions, you will need to have an admin user grant the permissions. Not used when Use Service Authentication is enabled. |
| Get Access Token | Click to finish the validation process for both authentication methods. For service Authentication, access, and permissions will need to be setup in Microsoft Entra Applications within Dynamics 365 Business Central. |
| Default Company | The company that will be used by default. |
| Refresh Metadata | Click to refresh the metadata of the Dynamics 365 Business Central Tenant. |
| Extension Version | Choose the version of the SmartConnect change tracking extension that is installed in the Business Central Instance. |
| Authorizing Person | User that authenticated the connection and what permissions will be used. |
Have a question? Please reach out to us at support@eonesolutions.com
