Microsoft Business Central Service Account — Setup Guide

Use this guide to configure a Business Central service account in MinuteView. This service account is required for all Business Central workflow tasks, including BOM Operations, Item Operations, Attachments, and Get Lookups.

How it works

MinuteView connects to BC using application-only (client credentials) authentication via Azure Active Directory. No user login or consent flow is involved — the connection runs unattended using an Azure App Registration you create in your tenant.

---

Network Requirements

Business Central authentication is OAuth (client credentials). The MinuteView server acquires an access token from Microsoft's identity platform and automatically refreshes it in the background, then calls the Business Central API directly. This means the server must have outbound internet access to the following domains.

Required Firewall / Proxy Whitelist

The following domains must be accessible via HTTPS (port 443) from the server where MinuteView is installed:

Domain	Purpose
login.microsoftonline.com	Azure AD token acquisition and background token refresh
api.businesscentral.dynamics.com	Business Central API calls (companies, items, BOMs, attachments, lookups)

Server Access Required

These domains must be reachable from the server, not just from an administrator's PC. All Business Central authentication and API calls are made server-side by MinuteView. If the server cannot reach these domains, every BC workflow task will fail with a connection error.

---

What You Need

Before starting, confirm you have:

• Admin access to your organisation's Azure Portal (to create an App Registration)
• Admin access to Business Central (to authorise the app as a BC user)
• The name of the BC environment you want to connect to (e.g. Production)

---

Step 1 — Create an Azure App Registration

1. Sign in to the Azure Portal → Microsoft Entra ID → App registrations
2. Click New registration
3. Enter a name, e.g. MinuteView – Business Central
4. Leave Redirect URI blank — it is not needed for service accounts
5. Click Register

From the app's Overview page, note down:

• Application (client) ID
• Directory (tenant) ID

---

Step 2 — Create a Client Secret

1. In the app registration, go to Certificates & secrets → Client secrets
2. Click New client secret
3. Enter a description (e.g. MinuteView) and choose an expiry (24 months recommended)
4. Click Add
5. Copy the secret value immediately — it is only shown once

WARNING

Set a reminder to rotate this secret before it expires. When it expires, all BC workflow tasks will fail until a new secret is entered in MinuteView Console.

---

Step 3 — Grant Business Central API Permissions

1. In the app registration, go to API permissions → Add a permission
2. Select APIs my organisation uses and search for Dynamics 365 Business Central
3. Choose Application permissions
4. Tick API.ReadWrite.All and click Add permissions
5. Click Grant admin consent for [your organisation] and confirm

Why API.ReadWrite.All?

This scope covers the full BC API surface. MinuteView uses it to access companies, items, BOMs, and attachments. It is the standard permission for unattended server-to-server BC integrations.

---

Step 4 — Authorise the App in Business Central

Azure permissions alone are not enough — you must also register the app inside BC itself and assign it permission sets.

1. In Business Central, search for and open Microsoft Entra Applications (or Azure Active Directory Applications in older versions)
2. Click New
3. Paste the Application (client) ID from Step 1 into the Client ID field
4. Enter a description, e.g. MinuteView Integration
5. Set State to Enabled
6. On the User Permission Sets tab, assign the permission sets needed for your workflows. At minimum:
   • D365 BUS FULL ACCESS — for general item, customer, and vendor access
   • Or assign more specific sets if your security policy requires it

WARNING

If this step is skipped, MinuteView will authenticate successfully with Azure but receive 401 Unauthorised errors when calling BC — which can look like a credentials problem when it is actually a BC permission problem.

---

Step 5 — Create the Service Account in MinuteView

1. Go to Console → Service Accounts
2. Click New
3. Set Service Account Type to Microsoft Business Central
4. Fill in the fields:

Field	Value
Name	Something descriptive, e.g. Business Central – Production
Client ID	Application (client) ID from Step 1
Client Secret	Secret value from Step 2
Tenant ID	Directory (tenant) ID from Step 1
Environment	Your BC environment name exactly as it appears in BC — e.g. Production

5. Click Save

Environment name

The environment name is case-sensitive. You can find it in BC by going to Help → About or by checking the URL when logged into BC: https://businesscentral.dynamics.com/.../**Production**/...

---

Troubleshooting

Authentication failed / invalid client

• Verify Client ID and Client Secret are copied correctly
• Check the client secret has not expired in Azure

401 Unauthorised when calling BC

• The Azure permissions are fine but BC hasn't authorised the app
• Complete Step 4 — the app must exist in BC's Microsoft Entra Applications list with a status of Enabled

Company not found

• The Company field in the task accepts either the display name or GUID
• Verify the exact company name in BC under My Settings → Company

Environment not found

• Check the Environment field in the service account matches the BC environment name exactly (case-sensitive)
• Valid values are visible at https://businesscentral.dynamics.com after login

---

Maintenance

• Client secret expiry: Azure client secrets have a fixed expiry. When expired, update the secret in both Azure and the MinuteView service account.
• Permission set changes: If BC permission sets are modified or reassigned, test MinuteView workflows to confirm they still have required access.