Set up Microsoft Entra ID authentication

Overview

This guide describes how to set up Microsoft Entra ID authentication for Mobile WMS.

This guide covers:

Creating and configuring an app registration in the Microsoft Entra admin center
Collecting the required IDs and SOAP URL
Configuring the Business Central Service Tier (On-Premises only)
Configuring the Mobile WMS endpoint

An app registration establishes a trust relationship between Mobile WMS and the Microsoft identity platform, enabling the app to securely authenticate users and interact with Business Central through Microsoft's identity and access management. Without it, users cannot sign in to Mobile WMS using their Microsoft Entra ID organizational accounts.

Version requirements for Entra ID authentication

For Business Central Online:

Mobile WMS Android app 1.5.0 or later

For On-Premises installations:

Mobile WMS BC extension 5.18 or later
Mobile WMS Android app 1.6.0.1 or later

Do you need an app registration?

For Business Central Online: An app registration is always required.

For On-Premises installations: An app registration is only required when the Business Central Server instance that Mobile WMS connects to is configured with credential type AccessControlService.
You do not need an app registration if the server instance uses one of the following credential types: UserName, NavUserPassword or Windows.

Manual or automatic setup?

For Business Central Online:

MOB5.67 or later: Start from Tasklet Setup Center in Business Central and use the Set up an App Registration guide, which can automatically create the app registration in the tenant's Entra ID, covering all BC environments in that tenant (Sandbox and Production).
Before MOB5.67: Use the Mobile WMS Sandbox Configuration Guide for automatic app registration creation. The guide must be run in a sandbox environment, but the app registration covers both Sandbox and Production.

Use this manual guide instead if you prefer manual setup or if automatic setup is not available.

For On-Premises installations: The app registration must always be created manually using this guide.

1 Do you need an app registration?
2 Manual or automatic setup?
3 Step 1 – Create a new app registration
4 Step 2 – Add API Permissions
5 Step 3 – Collect the required values
- 5.1 Client ID and Tenant ID
- 5.2 SOAP URL
6 Step 4 – Configure the Service Tier (On-Premises only)
- 6.1 BC 21 and later – PowerShell
- 6.2 Before BC 21 – PowerShell or Server Administration tool
7 Step 5 – Connect the mobile devices to Business Central
- 7.1 Managed devices (customers)
- 7.2 Partner devices
8 See also

Navigation

Step 1 – Create a new app registration

Go to https://entra.microsoft.com and sign in.

Note: Sign in to Microsoft Entra admin Center with a user account that belongs to the same Entra ID tenant as your Business Central environment, and that has permission to register applications.

In the left-hand navigation, expand Entra ID and select App registrations.
Click New registration.

MS Entra Admin Center 1 - New registration.png

Enter a name for the registration, e.g. Mobile WMS.
Under Supported account types, select:
- Single tenant only - <your tenant>
Under Redirect URI, select Public client/native (mobile & desktop) from the platform dropdown and enter:
https://businesscentral.dynamics.com/
Click Register.

MS Entra Admin Center 2 - Register an application.png

The application's Overview page is displayed.
Here you see the Application (client) ID, which uniquely identifies your application.

Step 2 – Add API Permissions

In the left menu of the app registration, select API permissions.
Click Add a permission.

MS Entra Admin Center 3 - Add a permission.png

In the panel that opens, select APIs my organization uses and search for Dynamics 365 Business Central, then select it.

MS Entra Admin Center 4 - API Permissions - Select BC.png

Select Delegated permissions.
Check user_impersonation.
Click Add permissions.

MS Entra Admin Center 5 - API Permissions - Add permission.png

Click Grant admin consent for [your organization] and confirm.

MS Entra Admin Center 7 - API Permissions - Grant consent.png

Step 3 – Collect the required values

You need three values to configure Mobile WMS: the Application (client) ID and Directory (tenant) ID from the app registration, and the SOAP URL from Business Central.

Client ID and Tenant ID

In the left menu of the app registration, click Overview.
Copy and save:
- Application (client) ID
- Directory (tenant) ID

SOAP URL

Log into Business Central in the environment that Mobile WMS should connect to.
Switch to the company that Mobile WMS should connect to.
Go to the Web Services page.
Find the entry for MOB WS Dispatcher.
Copy the SOAP URL field.

Note: The SOAP URL contains the Tenant ID — if it does not match the Directory (tenant) ID from your app registration, the app registration has been created in the wrong Entra ID tenant.

https://api.businesscentral.dynamics.com/v2.0/[TenantId]/[EnvironmentName]/WS/[CompanyName]/Codeunit/MobileDocumentService

Step 4 – Configure the Service Tier (On-Premises only)

This step configures the Business Central server instance to accept Entra ID access tokens from Mobile WMS by setting the ValidAudiences property.

ValidAudiences tells the server instance which access token audiences to accept — setting it to <https://api.businesscentral.dynamics.com> allows Mobile WMS to authenticate using the same standard scopes as Business Central Online, with no custom scopes needed.

BC 21 and later – PowerShell

Open the Business Central Administration Shell as administrator (Start → search Business Central Administration Shell → Run as administrator) and run:

Set-NAVServerConfiguration -ServerInstance <BC server instance name> -KeyName ValidAudiences -KeyValue "https://api.businesscentral.dynamics.com"
Restart-NAVServerInstance -ServerInstance <BC server instance name>

Replace <BC server instance name> with the name of your server instance.

Note: The Business Central Administration Shell is a pre-configured PowerShell session that loads the required BC management module automatically. You can also use regular PowerShell (7 or 5) by importing the module first: Import-Module -Name "C:\\Program Files\\Microsoft Dynamics 365 Business Central\\<version>\\Service\\navadmintool.ps1"

Before BC 21 – PowerShell or Server Administration tool

You can either use the PowerShell command above, or configure it via the Server Administration tool:

Open the Business Central Server Administration tool.
Select the server instance used for mobile devices.
Locate the Azure Active Directory (Azure AD) section.
In the Valid Audiences field, enter:
https://api.businesscentral.dynamics.com
Restart the server instance.

Step 5 – Connect the mobile devices to Business Central

How to complete this step depends on whether the devices are managed in MobiControl by Tasklet Factory or by you as a partner.

Managed devices (customers)

Using the values collected in Step 3, send the following to Tasklet Factory via the Service Desk on the project ticket, or raise a new ticket:

Application (client) ID
Directory (tenant) ID
SOAP URL

Partner devices

Update the start.cfg file directly using the template below. Replace the placeholders with the values collected in Step 3.

<endpoints>
    <endpoint id="01" displayName="D365BC" protocol="classic" type="D365BC" address="[SOAP URL]">
        <azureConfiguration
            authority="https://login.microsoftonline.com/[TenantId]/oauth2/v2.0/authorize"
            scopes="https://api.businesscentral.dynamics.com/user_impersonation"
            clientId="[ClientId]"
            returnUri="https://businesscentral.dynamics.com/"/>
    </endpoint>
</endpoints>