Business Central

Connecting Microsoft Dynamics 365 Business Central

INTERA can connect directly to Microsoft Dynamics 365 Business Central using the standard Business Central API.

The connection uses Microsoft Entra ID application authentication (OAuth 2.0 Client Credentials). This allows INTERA to access Business Central automatically without requiring a Business Central user to sign in each time data is synchronized.

To configure the connection, you need administrator access to:

• Microsoft Entra ID for your organization;
• Microsoft Dynamics 365 Business Central.

At the end of the procedure you will receive three values that must be entered into INTERA:

• Application (Client) ID
• Directory (Tenant) ID
• Client Secret

Security: The Client Secret is a password for the integration. Store it securely and do not send it by email or share it with users who do not administer the integration.

---

1. Register INTERA in Microsoft Entra ID

Open the Microsoft Entra admin center and sign in using an administrator account.

Go to:

Applications → App registrations → New registration

Create a new application.

Recommended settings:

Name

Enter a descriptive name, for example:

INTERA Business Central Integration

Supported account types

Select:

Accounts in this organizational directory only (Single tenant)

Redirect URI

Leave this field empty.

A redirect URI is not required when administrator consent is granted directly from Microsoft Entra ID. Microsoft supports both single-tenant and multi-tenant application registrations for Business Central S2S authentication.

Click Register.

---

2. Save the Client ID and Tenant ID

After registration, Microsoft opens the application’s Overview page.

Locate and save:

Application (client) ID

and

Directory (tenant) ID

You will enter both values into INTERA later.

The Application ID uniquely identifies the INTERA connection application, while the Tenant ID identifies your Microsoft Entra organization.

---

3. Allow the application to access Business Central

Inside the newly created application, open:

API permissions → Add a permission

Select:

Dynamics 365 Business Central

Then select:

Application permissions

Add:

API.ReadWrite.All

This permission allows the application to access Business Central APIs and web services using application authentication.

After adding the permission, select:

Grant admin consent for

Confirm the request.

The permission should then show a status of:

Granted

Important: API.ReadWrite.All allows the application to authenticate against the Business Central API. It does not by itself give INTERA unrestricted access to all Business Central data. Actual access is additionally controlled by the Permission Sets assigned to the application inside Business Central.

Do I need Automation.ReadWrite.All?

Normally, no.

INTERA requires API.ReadWrite.All to access Business Central APIs and web services.

The separate Microsoft permission:

Automation.ReadWrite.All

is intended for Business Central Automation APIs, which are primarily used for administrative operations such as automated company/environment setup. It is not required for normal INTERA data integration unless a future INTERA function explicitly uses those Automation APIs.

---

4. Create a Client Secret

In the Microsoft Entra application, go to:

Certificates & secrets → Client secrets → New client secret

Enter a description, for example:

INTERA

Choose an expiration period according to your organization’s security policy and click Add.

Microsoft will display the new secret.

Immediately copy the value shown in the:

Value

field.

Important: INTERA requires the secret Value, not the Secret ID.

Microsoft only displays the full secret value when it is created. Once you leave the page, the complete value cannot be displayed again. If it is lost, create a new Client Secret.

You should now have:

• Application (Client) ID
• Directory (Tenant) ID
• Client Secret Value

Do not enter them into INTERA yet. The application must first be authorized inside Business Central.

---

5. Register the application in Business Central

Sign in to Microsoft Dynamics 365 Business Central using an account with sufficient administrative permissions.

Press:

Alt+Q

to open Business Central search.

Search for:

Microsoft Entra Applications

Open the page and select:

New

Business Central will open a new Microsoft Entra Application Card. Microsoft uses this record to associate the Entra application with permissions inside Business Central.

Enter:

Client ID

Paste the Application (Client) ID created earlier in Microsoft Entra ID.

Description

Enter a recognizable description, for example:

INTERA Integration

State

Set to:

Enabled

---

6. Assign Business Central permissions

On the same Microsoft Entra Application Card, assign the required User Permission Sets.

These permissions determine which Business Central data INTERA can actually access.

Only assign the permissions required by the INTERA DataSources you intend to use.

For example, if INTERA only needs to read:

• customers;
• vendors;
• invoices;
• financial balances;

the application should receive permissions covering those objects rather than broad administrative access.

Microsoft recommends following the least privilege principle: an integration should receive only the permissions it actually requires.

Do not assign SUPER

A Microsoft Entra application cannot be assigned the SUPER permission set in Business Central.

Create or assign appropriate restricted Permission Sets instead.

Where appropriate, the Permission Set can also be restricted to a specific Company, preventing the integration from accessing other Business Central companies.

After assigning the required permissions, confirm again that:

State = Enabled

---

7. Configure the integration in INTERA

You can now return to INTERA.

Open:

Settings → Integrations

Select:

Add Integration

Find:

Microsoft Dynamics 365 Business Central

and start the setup.

Enter the three values created earlier:

Application (Client) ID

xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx

Directory (Tenant) ID

xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx

Client Secret

<secret value>

INTERA uses these credentials to request an OAuth access token from Microsoft Entra ID and authenticate against the Business Central API. Microsoft defines the standard Business Central OAuth scope as https://api.businesscentral.dynamics.com/.default.

INTERA does not require a Business Central username or password for this connection.

---

8. Test the connection

Select Test Connection in INTERA.

If authentication and permissions are configured correctly, INTERA should be able to connect to Business Central and discover the Business Central environment and available companies/data exposed through the API.

Business Central API endpoints include the environment in their address, and the API can expose available companies before company-specific resources are queried.

After a successful test, save the integration.

The Business Central integration can now expose its available DataSources to INTERA.

---

Troubleshooting

Authentication failed / Invalid client secret

Check that the value entered into INTERA is the Client Secret Value, not the Secret ID.

If the original value was lost, create a new Client Secret in Microsoft Entra ID and update the INTERA integration.

---

Access denied / 403 Forbidden

Authentication may be working while Business Central refuses access to the requested data.

Check:

Business Central → Microsoft Entra Applications → INTERA application → User Permission Sets

Make sure the application has permission to access the required Business Central objects and, where company-specific permissions are used, the correct company.

The Entra API.ReadWrite.All permission and the Business Central Permission Sets perform different jobs: the first allows API authentication, while the second controls access to Business Central objects.

---

Application is registered but INTERA cannot connect

Check all of the following:

• the Application (Client) ID is correct;
• the Directory (Tenant) ID is correct;
• the Client Secret Value is correct and has not expired;
• API.ReadWrite.All has been added as an Application permission;
• administrator consent has been granted;
• the application exists under Microsoft Entra Applications in Business Central;
• its State is Enabled;
• appropriate Business Central Permission Sets have been assigned.

---

Security recommendations

Create a dedicated Microsoft Entra application specifically for INTERA instead of reusing credentials belonging to another integration.

Give the application only the Business Central Permission Sets required for the DataSources being used.

Treat the Client Secret as a password.

When the Client Secret approaches its expiration date, create a replacement secret and update the Business Central integration settings in INTERA.

If access is no longer required, disable the application in Business Central or revoke/delete its credentials in Microsoft Entra ID.

This approach keeps INTERA access independent from individual Business Central user accounts and allows administrators to control exactly which Business Central data the integration can access.