Table of Contents

Microsoft Entra app for the service

Against Business Central online the service signs in through an app registration in Microsoft Entra ID. This page describes the registration, the certificate and the entry in Business Central. Against Business Central on-premises all steps on this page do not apply; see Operation against Business Central on-premises.

Important

All values (<tenant-guid>, <client-guid>, thumbprint) are placeholders. Enter real values only in the configuration file of the service, never in tickets, chats or documents.

1. Register the app in the Entra portal

  1. Open the Azure portal → Microsoft Entra ID → App registrations → New registration.
  2. Name, for example, MSGreenTec Filesharing <customer>, account type Accounts in this organizational directory only.
  3. After the registration note the Application (client) ID and the Directory (tenant) ID. You need both in the Configuration for BusinessCentral:ClientId and BusinessCentral:TenantId.
  4. API permissions → Add a permission → Dynamics 365 Business Central → Application permissions → select API.ReadWrite.All.
  5. Choose Grant admin consent (button at the top of the permissions page).
  6. Upload the certificate (section 2): Certificates & secrets → Certificates → Upload certificate → select the exported .cer file.

Alternatively the service supports a client secret (Certificates & secrets → New client secret). The certificate is the standard way; a secret is only the alternative. In the configuration set exactly one of the two (CertificateThumbprint or ClientSecret).

Note

This version of the documentation has no screenshots of the Entra portal. The steps above describe the procedure.

2. Create the certificate

On the target computer (or a computer with access to its certificate store) run in PowerShell as administrator:

$cert = New-SelfSignedCertificate `
    -Subject "CN=MSGreenTec Filesharing <customer>" `
    -CertStoreLocation Cert:\LocalMachine\My `
    -KeyExportPolicy NonExportable `
    -NotAfter (Get-Date).AddYears(2)

# Export the public part for the upload to Entra:
Export-Certificate -Cert $cert -FilePath 'C:\temp\filesharing.cer'

# Thumbprint for BusinessCentral:CertificateThumbprint:
$cert.Thumbprint
  • The validity is 2 years (-NotAfter). Plan the renewal in good time; an expired certificate leads to AADSTS errors (see Service troubleshooting).
  • The .cer file contains only the public key and is not a secret. It is uploaded to Entra (section 1, step 6).
  • The private key must be readable for the service account so that the service can use the certificate when it retrieves a token:
    1. Open the certificate MMC (certlm.msc) → Personal → Certificates.
    2. Select the certificate, All Tasks → Manage Private Keys.
    3. Add the service account with Read.

3. Register the Entra application in Business Central

  1. In BC open the page Microsoft Entra Applications and choose New.
  2. Enter the client ID from section 1, step 3.
  3. Assign the permission set MGT Filesharing Svc. Assign no other permission sets: the Entra app of the service deliberately gets only this one. See Permissions.
  4. Set the state to Enabled.

If the service then shows HTTP 401 or 403, check exactly this page (state and permission set). See Service troubleshooting.

Next