Microsoft Entra App Registration

This guide walks you through creating an app registration in Microsoft Entra ID (formerly Azure AD) for the SharePoint Connector. An app registration of your own is recommended for enterprise production environments.

Do You Need an App Registration?

It depends on the Microsoft Login Method (and Authentication Method) in SharePoint Setup:

Login method	App registration of your own	Platform	Client secret
PKCE, Client Id blank	Not needed (the connector's app registration is used)	-	-
PKCE, Client Id filled in	Yes, as a public client	Mobile and desktop applications	No
Device Code	Not needed (the connector's app registration is used)	-	-
Modern App Registration	Yes	Web	Yes
App Registration	Yes	Web	Yes
Certificate (Authentication Method)	Yes, with an application permission	None (no redirect)	No, a certificate

One app registration cannot serve both PKCE and the Web-based methods: PKCE needs the redirect URI under Mobile and desktop applications, while App Registration and Modern App Registration need it under Web with a client secret. Create separate app registrations if you need both.

Overview

An app registration creates a trusted identity that Business Central can use to access SharePoint. This provides:

Controlled access permissions
Central administration
Audit capabilities
Production-grade security

Prerequisites

Before you begin, ensure you have:

Requirement	Description
Microsoft Entra Access	Admin access to Azure portal
Permission to Register Apps	Application Administrator or Global Admin role
Permission to Grant Consent	To approve API permissions

Step-by-Step Registration

Step 1: Access Microsoft Entra ID

Go to https://portal.azure.com
Search for "Microsoft Entra ID" (or "Azure Active Directory")
Open the Microsoft Entra ID service

Step 2: Create App Registration

In the left menu, select App registrations
Click New registration
Fill in the registration form:

Field	Value	Notes
Name	SharePoint Connector for BC	Or your preferred name
Supported account types	Single tenant	For your organization only
Redirect URI	See below	Platform: Web for App Registration and Modern App Registration, Public client/native (mobile & desktop) for PKCE

Click Register

Single tenant and the Entra Tenant Id: Modern App Registration and PKCE sign in through the tenant in the Entra Tenant Id field. When it is blank, Modern App Registration uses the Microsoft Entra tenant of the Business Central environment and PKCE uses the common endpoint. For a single-tenant app registration used with PKCE, or with Modern App Registration on-premises without Microsoft Entra authentication, fill in the Entra Tenant Id, otherwise the sign-in fails with AADSTS50194.

Step 3: Configure Redirect URI

The redirect URI depends on the Microsoft Login Method you use in SharePoint Setup.

Modern App Registration

Use the Callback URL from the SharePoint Setup page (it is filled in when you set Microsoft Login Method to "Modern App Registration"). This is the standard Business Central OAuth redirect page, for Business Central Online:

https://businesscentral.dynamics.com/OAuthLanding.htm

The same redirect URI works for all Business Central Online environments. For on-premises it is the web client URL followed by /OAuthLanding.htm. Register it under the Web platform.

PKCE (your own app registration)

Only needed when you fill in Client Id with PKCE. Leave Client Id blank to use the connector's app registration and skip this guide.

PKCE uses the same OAuthLanding.htm redirect URI as Modern App Registration, but as a public client, because no client secret is sent:

Go to Authentication and click Add a platform
Select Mobile and desktop applications
Under Custom redirect URIs, enter the Callback URL from the SharePoint Setup page, for Business Central Online:

   https://businesscentral.dynamics.com/OAuthLanding.htm

Under Advanced settings, set Allow public client flows to Yes
Save

Do not register the URL under Web (Microsoft Entra then requires a client secret, AADSTS7000218) or Single-page application (those codes can only be redeemed by a browser, AADSTS9002327). The connector recognizes both errors and explains how to move the URL. Skip Step 6: PKCE does not use a client secret.

App Registration

The redirect URI must include page=70319501:

For Business Central Online:

https://businesscentral.dynamics.com/[EnvironmentName]?page=70319501

Replace:

[EnvironmentName] with your BC environment name

This is the form the connector generates as the default Callback URL in SharePoint Setup.

Examples:

https://businesscentral.dynamics.com/Production?page=70319501
https://businesscentral.dynamics.com/Sandbox?page=70319501

Important: The redirect URI registered in Microsoft Entra must match the Callback URL field in SharePoint Setup exactly.

For Business Central On-Premises:

https://[YourBCServer]/[Instance]?page=70319501

Step 4: Configure API Permissions

The connector calls the SharePoint REST API directly (not Microsoft Graph). You must add SharePoint delegated permissions, not Microsoft Graph permissions.

In your app registration, go to API permissions
Click Add a permission
Select SharePoint (under "Microsoft APIs")
Choose Delegated permissions
Add the following permissions:

Permission	Purpose
AllSites.Manage	Full read/write access to SharePoint sites the signed-in user has access to
offline_access	Maintain refresh token so users do not have to re-authenticate every hour

Click Add permissions

Note: The Device Code flow requests the scope string <BaseURL>/AllSites.Manage offline_access. The App Registration OAuth flow uses the classic SharePoint resource model (resource=<BaseURL> with scope=offline_access). The Modern App Registration flow uses the Business Central OAuth module against the v2.0 endpoint with the scope <BaseURL>/AllSites.Manage (offline access is requested automatically). The PKCE flow uses the v2.0 endpoint with the scope <BaseURL>/AllSites.Manage offline_access. None of the flows talk to Microsoft Graph.

Certificate authentication: The delegated permissions above cover the Proxy and Personal (delegated) flows. If you use the Certificate authentication method, the connector uses an app-only client_credentials flow with the scope <BaseURL>/.default -- the app registration must additionally be granted a SharePoint application permission, and admin consent must be granted for it.

Admin consent allows the app to be used without individual user consent:

In API permissions, click Grant admin consent for [Organization]
Confirm by clicking Yes
Verify all permissions show "Granted for [Organization]"

Step 6: Create Client Secret

App Registration and Modern App Registration only. Skip this step for PKCE and Certificate.

Go to Certificates & secrets
Under Client secrets, click New client secret
Enter a description (e.g., "BC SharePoint Connector")
Choose an expiration period
Click Add
Important: Copy the secret Value immediately (it won't be shown again)

Step 7: Collect Required Values

Record these values for Business Central configuration:

Value	Location	Example
Application (client) ID	Overview page	`12345678-1234-1234-1234-123456789abc`
Client Secret	Certificates & secrets	(the value you copied; not for PKCE)
Directory (tenant) ID	Overview page	(Entra Tenant Id in SharePoint Setup for PKCE with a single-tenant app registration and for Modern App Registration on-premises, otherwise for reference)
Redirect URI	Authentication	(what you configured)

Configuring Business Central

Enter Values in SharePoint Setup

Open SharePoint Setup in Business Central
Enter the values:

Modern App Registration:

Field	Value
Microsoft Login Method	Modern App Registration
Client ID	Your Application (client) ID
Client Secret Value	Your client secret value
Callback URL	Filled in automatically (`.../OAuthLanding.htm`), copy this value to the app registration
Entra Tenant Id	Leave blank on Business Central Online. On-premises without Microsoft Entra authentication: your Directory (tenant) ID

PKCE with your own app registration:

Field	Value
Microsoft Login Method	PKCE
Client ID	Your Application (client) ID
Client Secret Value	Not used (greyed out)
Callback URL	Filled in automatically (`.../OAuthLanding.htm`), copy this value to the app registration under Mobile and desktop applications
Entra Tenant Id	Your Directory (tenant) ID when the app registration is single tenant, otherwise blank

App Registration:

Field	Value
Microsoft Login Method	App Registration
Client ID	Your Application (client) ID
Client Secret Value	Your client secret value
Callback URL	Your redirect URI

Click Connect
Authenticate when prompted (with Modern App Registration the standard Business Central sign-in window opens, with PKCE the Sign in to SharePoint page opens the Microsoft sign-in window - allow pop-ups)
Verify connection is established successfully

Permissions Explained

Delegated vs Application Permissions

Type	Description	Use Case
Delegated	Acts on behalf of signed-in user	Standard usage
Application	Acts as the app itself	Background processing

The connector uses delegated permissions for the Proxy and Personal flows, acting on behalf of the authenticated user. The exception is Certificate authentication, which is an app-only flow and requires an application permission with admin consent.

Required Permissions Detail

Permission	What It Allows
AllSites.Manage	Read/write access to SharePoint sites the signed-in user has access to (SharePoint REST scope)
offline_access	Obtain refresh tokens so users do not have to re-authenticate every hour

These delegated permissions cover the delegated flows (Proxy and Personal). Certificate authentication additionally requires a SharePoint application permission with admin consent.

No Microsoft Graph permissions are required -- the connector does not call Microsoft Graph.

Multi-Environment Considerations

Multiple BC Environments

For multiple Business Central environments:

With Modern App Registration and PKCE, all Business Central Online environments share the redirect URI https://businesscentral.dynamics.com/OAuthLanding.htm, so one app registration covers every environment without extra redirect URIs. The options below apply to App Registration, where each environment has its own ?page=70319501 Callback URL.

Option A: Single App Registration

Add multiple redirect URIs to one app
One for each environment
Simpler to manage

Option B: Separate App Registrations

Create one app per environment
More isolation
More complex to manage

Adding Multiple Redirect URIs

Go to Authentication in your app registration
Under Web > Redirect URIs, click Add URI
Add URIs for each environment
Save changes

Security Recommendations

Client Secret Management

Applies to App Registration and Modern App Registration. PKCE has no client secret to manage.

Best Practice	Description
Use short expiration	Set 6-12 month expiry
Rotate regularly	Change before expiration
Store securely	Don't share in plain text
Track expiration	Set reminders

Permission Minimization

The connector uses the SharePoint REST AllSites.Manage scope, which grants access to all sites the signed-in user can reach. To narrow access, restrict the user account's SharePoint permissions themselves (e.g., by limiting the site collections the user can see) rather than changing the app's API scope.

Conditional Access

You can apply conditional access policies:

Require MFA for app access
Limit to corporate networks
Block risky sign-ins

Troubleshooting

Common Issues

Issue	Cause	Solution
AADSTS65001	Consent not granted, or the app only has application permissions (e.g. an app registration made for Certificate authentication)	Add the delegated SharePoint permission AllSites.Manage and grant admin consent
AADSTS70011	Invalid scope	Check permission configuration
AADSTS700016	App not found	Verify tenant and client ID
Redirect mismatch	URI doesn't match	Ensure exact match in Azure
AADSTS50194	Single-tenant app registration signed in through the common endpoint (PKCE, or Modern App Registration on-premises)	Fill in Entra Tenant Id with the Directory (tenant) ID
AADSTS7000218 (PKCE)	Redirect URI registered under Web, so Microsoft Entra expects a client secret	Move it to Mobile and desktop applications and allow public client flows
AADSTS9002327 (PKCE)	Redirect URI registered under Single-page application	Move it to Mobile and desktop applications and allow public client flows

Verifying Configuration

Check permissions - All should show "Granted"
Verify redirect URI - Must match exactly, on the right platform (Web, or Mobile and desktop applications for PKCE)
Test client secret - Ensure it's the value, not the ID (not used by PKCE)
Confirm consent - Admin consent granted