Setting up Azure Active Directory (AAD) authentication

Description

Let's set up AAD authentication

Overview

1. Limitations

Barcode login is not suited for use with AAD as it will require two barcodes and generally lacks security.

2. Prerequisites

• This guide only applies to Business Central Online

• An Administrator user account associated with the Customers Business Central environment

• Extension version MOB5.18
• Android App 1.5.0

3. Creating Microsoft Azure App Registration

To access Business Central using AAD authentication, you must grant client access to this service.

1. Log into https://portal.azure.com using an administrator user associated with the Customers Business Central environment
2. Navigate to “Azure Active Directory” -> “App registrations”:
   
   
   
   
   
3. Select “New registration” and name it Mobile WMS
   
   
   
   
   

4. Go to Redirect URI (this step is NOT optional)
   
   Select “Public client/native (mobile & desktop)”
   
   Enter this URI: https://businesscentral.dynamics.com/
   
   
   
   Select “Register” 

4. Configuring the Application Registration

1. Navigate to “API permissions”
2. Select “Add a permission”
   
   
   
   
3. Select "Dynamics 365 Business Central"
   
   
   
   
   
4. Select "Delegated permissions"
   
   
   
   
5. Select “user_impersonation” 
   
   

5. Gathering Information

This section outlines how to gather the data required for the mobile devices to connect using AAD.

Tasklet Factory needs the following data from you: 

1. TenantId

2. ClientId

3. Soap URL
   

Get ID's

1. Navigate to "Azure active directory"
2. Select "Manage"
3. Select "App registration"
4. Select the new App registration
5. Please copy and save the values marked in red

Get theClient ID

Get the Tenant ID

Get Soap URL

1. Log into Business Central
2. Go to Web services page and
3. Find the entry for MOB WS Dispatcher
4. Please copy the SOAP URL field

6. Updating Mobile Configuration

Using the Service Desk please send us the TenantId, ClientId and Soap URL on the project ticket or raise a new ticket 

 or

if this is for your own partner device, see below and just fill in the info in the placeholders for Tenant ID, Client Id + Soap URL.

Example and Template for Start.cfg -file

Modify in the red marked sections with the gathered information.

<!-- ENDPOINTS -->
  <endpoints>

    <endpoint id="01" displayName="D365BC" protocol="classic" type="D365BC" 
    address="Soap URL">
      <azureConfiguration authority="https://login.windows.net/TenantId/oauth2/authorize?resource=https://api.businesscentral.dynamics.com" clientId="ClientId" returnUri="https://businesscentral.dynamics.com/"/>
    </endpoint>    

  </endpoints>

7. Troubleshooting Login Issues

• I cannot log in from mobile device