Page Comparison

Description

Overview

1. Limitations

Barcode login is not suited for use with AAD as it will require two barcodes and generally lacks security.

2. Prerequisites

• Note that the OnPrem setup requires an additional step (step 7), which should not be done for Business Central Online

• An Administrator user account associated with the Customers Business Central environment

• Extension version MOB5.18
• Android App 1.5.0

3. Creating Microsoft Azure App Registration

To access Business Central using AAD authentication, you must grant client access to this service.

1. Log into https://portal.azure.com using an administrator user associated with the Customers Business Central environment
2. Navigate to “Microsoft Entra ID” -> “App registrations”:
   
   
   
   
   
3. Select “New registration” and name it Mobile WMS
   
   
   
   

4. Configure Redirect URI

1. Go to Redirect URI
   

2. Select “Public client/native (mobile & desktop)”(Do not select "Web")
   
   Enter this URI: https://businesscentral.dynamics.com/
   
   
   
   Select “Register” 

5. Configuring the Application Registration

1. Navigate to “API permissions”
2. Select “Add a permission”
   
   
   
   
3. Select "Dynamics 365 Business Central"
   
   
   
   
   
4. Select "Delegated permissions"
   
   
   
   
5. Select “user_impersonation” 
   
   
   
   
6. "Grant admin consent"
   It might be necessarry necessary to grant admin consent for the App registration to work depending the organization settings . (Requires requires admin rights).
   
   

6. Gathering Information

This section outlines how to gather the data required for the mobile devices to connect using AAD.

Tasklet Factory needs the following data from you: 

1. TenantIdTenant ID

2. ClientIdClient ID

3. Soap SOAP URL
   

Get ID's

1. Navigate to "Azure active directory"
2. Select "Manage"
3. Select "App registration"
4. Select the new "Mobile WMS" registration
5. Please copy and save the values marked in red

Get Application (client) ID

Get the Directory (tenant) ID

Get SOAP URL

1. Log into Business Central
2. Go to Web services page and
3. Find the entry for MOB WS Dispatcher
4. Please copy the SOAP URL field

7. Configure the Service Tier

On the service tier that you are using for the Mobile Devices, find the section called Azure Active Directory (Azure AD) - see below.

In the Valid Audiences field enter https://api.businesscentral.dynamics.com

It is possible to have several inputs in this field, they can be separated by a semicolon.

The value is a semicolon-separated list of audiences.

To configure SOAP and OData web services for Azure AD authentication, specify the App ID URI that is registered for your Business Central installation in Azure Active Directory (Azure AD)

8. Updating Mobile Configuration

Using the Service Desk service desk please send us the TenantIdTenant ID, ClientId Client ID and Soap SOAP URL on the project ticket or raise a new ticket 

 or

if this is for your own partner device, see below and just fill in the info in the placeholders for Tenant ID, Client Id + Soap URL.

Example and Template for Start.cfg -file

Modify in the red marked sections with the gathered information.

<!-- ENDPOINTS -->
<endpoints>

    <endpoint id="01" displayName="D365BC" protocol="classic" type="D365BC" address="Soap URL">
      <azureConfiguration authority="https://login.microsoftonline.com/TenantId/oauth2/v2.0/authorize" scopes="https://api.businesscentral.dynamics.com/user_impersonation" clientId="ClientId" returnUri="https://businesscentral.dynamics.com/"/>
    </endpoint>

</endpoints>

9. Define Scopes if connecting to OnPrem installation or different product family (e.g. LS Central or Wiise)

When connecting to OnPrem installation or a different product family like LS Central or Wiise, we will use the standard scope of Business Central to authenticate against in Azure AD. For this we will need to add the scopes attribute as shown below to the start.cfg file.

Modify in the red marked sections with the gathered information.

<!-- ENDPOINTS -->
<endpoints>

    <endpoint id="01" displayName="D365BC" protocol="classic" type="D365BC" address="Soap URL">
      <azureConfiguration authority="https://login.microsoftonline.com/TenantId/oauth2/v2.0/authorize" scopes="https://api.businesscentral.dynamics.com/user_impersonation" clientId="ClientId" returnUri="https://businesscentral.dynamics.com/"/>
    </endpoint>

</endpoints>

10. Troubleshooting Login Issues

• I cannot log in from mobile device

Next

Basic configuration (3/4)