How to Set Up Business Central Service-to-Service Authentication (API Guide)

Introduction

Business Central service-to-service (S2S) authentication allows an application to access Business Central APIs and web services without requiring an interactive user sign-in.

It uses Microsoft Entra ID and the OAuth 2.0 client credentials flow, where the application authenticates using its own identity rather than a user’s credentials.

This approach is useful when Business Central needs to communicate with:

• eCommerce platforms
• CRM systems
• middleware
• reporting applications
• internal business systems
• scheduled background processes
• other API-based integrations

In this guide, we’ll walk through how Business Central S2S authentication works, configure a Microsoft Entra application, assign the required permissions, generate an OAuth access token, test the connection in Postman, and troubleshoot common authentication errors.

Quick Answer: How Does Business Central S2S Authentication Work?

Business Central S2S authentication uses a Microsoft Entra application to authenticate API requests without requiring a user to sign in.

The application requests an OAuth 2.0 access token using the client credentials flow. That token is included in Business Central API requests, while Business Central uses the application’s assigned permission sets to determine which data and operations it can access.

For standard Business Central APIs and web services, Microsoft documents the API.ReadWrite.All application permission and the scope https://api.businesscentral.dynamics.com/.default

Quick Summary

• Business Central S2S authentication allows API access without interactive user sign-in
• Authentication is handled through Microsoft Entra ID
• S2S uses the OAuth 2.0 client credentials flow
• The external system authenticates using an application identity
• Business Central APIs and web services can use the API.ReadWrite.All application permission
• Business Central Automation APIs use Automation.ReadWrite.All
• Access also depends on the permission sets assigned to the application inside Business Central
• S2S authentication does not require a refresh toke

What Is Business Central S2S Authentication?

Business Central S2S authentication is an OAuth-based authentication method that allows an application to access Business Central APIs or web services using an application identity.

Instead of requiring an employee or administrator to sign in, the external application authenticates through Microsoft Entra ID.

The application requests an access token using its:

• Tenant ID
• Application (Client) ID
• Application credential
• Business Central OAuth scope

The access token is then passed with the API request.

Business Central evaluates both the application identity and its assigned permission sets before allowing access to the requested resources.

This makes S2S authentication suitable for integrations that need to operate without repeated user interaction.

When to use service-to-service authentication for Business Central?

As mentioned above, service-to-service authentication should be used in cases where we need to integrate a third-party service with Business Central in a way that once that service is set up it can work automatically and securely.

A third can exchange data with Business Central using service-to-service authentication in an automated way.

Prerequisites

To complete the Business Central integration, you will need the following two things

• Administrative access to Business Central.
• Administrative access to Azure Portal Account that has an active subscription.

When Do You Need Service-to-Service Authentication?

You should use service-to-service authentication in Business Central when:

• You are building API-based integrations with external systems
• You want to automate processes without user intervention
• You need secure backend communication between applications
• You are syncing data between Business Central and other platforms

How Business Central S2S Authentication Works

Business Central S2S authentication involves two authorization layers:

1. Microsoft Entra ID authentication
2. Business Central application permissions

The process works as follows:

External Application → Microsoft Entra ID → OAuth Access Token → Business Central API → Business Central Permission Check

Step 1: Register the Application

The application is registered in Microsoft Entra ID and receives an Application (Client) ID and Tenant ID.

Step 2: Configure Credentials

The application uses an appropriate credential, such as a client secret or certificate, to authenticate itself.

Step 3: Request an OAuth Access Token

The application sends a token request to Microsoft Entra ID using the OAuth 2.0 client credentials flow.

Step 4: Call the Business Central API

The returned access token is sent with the API request as a Bearer token.

Step 5: Business Central Checks Permissions

Business Central identifies the application and verifies whether its assigned permission sets allow access to the requested APIs, tables, or operations.

If authentication and authorization both succeed, Business Central processes the API request.

Microsoft confirms that S2S uses the OAuth 2.0 Client Credentials flow and an application’s identity rather than an interactive user’s identity.

Business Central Authentication Methods: S2S vs Delegated OAuth

Business Central OAuth authentication can use either a user account or an application account, depending on how the integration needs to operate.

Use delegated authentication when a user needs to actively sign in and the application performs actions under that user’s identity.

Use S2S authentication when an integration needs to operate independently, such as:

• background integrations
• scheduled data synchronization
• ERP connections
• eCommerce integrations
• CRM integrations
• middleware processes

Microsoft specifically distinguishes user impersonation from application-account S2S authentication and notes that application accounts do not require refresh tokens.

How to Create an S2S Token for Business Central

Step 1: Register an Application in Microsoft Entra ID

Go to Microsoft Entra ID and create a new app registration. This will generate a Client ID and Tenant ID, which are required for authentication.

Step 2: Add API Permissions

Navigate to API permissions and add the required Business Central permissions. Make sure to grant admin consent so the application can access APIs without user intervention.

Step 3: Create a Client Secret or Certificate

Under certificates and secrets, create a new client secret. Store this securely, as it will be used to request the access token.

How to Generate a Business Central S2S OAuth Access Token

Once the Microsoft Entra application and Business Central permissions are configured, the application can request an OAuth 2.0 access token.

For a Business Central S2S token request, the important values are:

The request follows this pattern:

POST https://login.microsoftonline.com/<tenantId>/oauth2/v2.0/token

grant_type=client_credentials
client_id=<clientId>
client_secret=<clientSecret>
scope=https://api.businesscentral.dynamics.com/.default

If Microsoft Entra ID validates the application successfully, it returns an access token.

The application then includes that token in Business Central API calls:

Authorization: Bearer <access_token>

Required Permissions for Business Central S2S Authentication

Business Central S2S authentication requires permissions at both the Microsoft Entra ID level and inside Business Central.

1. Microsoft Entra Application Permissions

For Business Central APIs and web services, Microsoft documents:

API.ReadWrite.All

For Business Central Automation APIs, Microsoft documents:

Automation.ReadWrite.All

Select the permissions that match the integration being implemented.

2. Business Central Permission Sets

Registering the Microsoft Entra application does not automatically give the application unrestricted access to Business Central data.

The application must also be created on the Microsoft Entra Applications page in Business Central and assigned the permission sets required for its operations.

These permissions determine which Business Central objects and operations the integration can use.

Apply the principle of least privilege. Assign only the permissions required for the integration.

Microsoft states that Microsoft Entra applications cannot be assigned the SUPER permission set.

How to Configure Partner Permissions for S2S Authentication

Even if your S2S token is generated successfully, the application will not be able to access Business Central data unless the correct permissions are configured.

You need to assign appropriate permission sets within Business Central that define what the application is allowed to do. These permission sets control access to tables, APIs, and specific operations.

Start by identifying the APIs or data your application needs to access. Then assign permission sets that grant access to those resources. It is also important to ensure that the application has been granted the required API permissions in Microsoft Entra ID.

How to Adjust Dashboard Partner Role Permissions for S2S Token Access

In many cases, developers face issues where the S2S token is generated successfully, but API requests still fail. This is usually due to incorrect or incomplete partner role permissions.
To resolve this, you need to review how roles and permission sets are configured inside Business Central.
Start by verifying that the application is mapped correctly and that the required permission sets are assigned. Then check whether the role includes access to the specific APIs or data entities being used.

Step-by-Step: Set Up Business Central Service-to-Service Authentication

1. Register a Microsoft Entra application in the Azure Portal Account

   1. To begin the API integration process, Sign in to the Azure portal and register an application for Business Central in the Microsoft Entra tenant. Make sure you log in to the default directory.
      
   2. Register the application for custom integration
      
      
   3. Once registered, an overview of the new application will be displayed in the portal.
   4. Copy the Application (client) ID and Directory (tenant) ID of the registered application. You’ll need this later. You can get this value from the Overview page.
      
   5. Select Certificates & secrets > New client secret to generate a secret key for the API integration.
   6. Add a description, select a duration, and select Add.
      
   7. It will generate values. Copy the secret’s value to use it later.
      
   8. Add API permissions by selecting: API permissions > Add a permission > Microsoft APIs > Dynamics 365 Business Central.
      
   9. Under Application permissions, select the Business Central permissions required by your integration.

      For Business Central APIs and web services, use API.ReadWrite.All.

      For Automation APIs, use Automation.ReadWrite.All.

      Select Add permissions after choosing the relevant permissions.

      
   10. Review whether consent has already been granted for the required Business Central API permissions.

       Admin consent can be granted from Microsoft Entra ID. Microsoft also documents a consent option from the Business Central web client, so the exact consent step depends on how the application is being configured.

       

2. Set up the Microsoft Entra application in the Business Central Account

   1. In the Business Central client, search for Microsoft Entra Applications and open the page.
      
   2. Create a New Microsoft Entra Application Card.
   3. In the Client ID field, enter the Application (Client) ID for the registered application in Microsoft Entra ID from step 1.
   4. Fill in the Description and Status to Enabled.
   5. Assign the Business Central permission sets required by the integration.

      Grant only the permissions needed to access the relevant APIs, tables, or operations. Microsoft Entra applications cannot be assigned the SUPER permission set.

      
   6. https://learn.microsoft.com/en-us/dynamics365/business-central/dev-itpro/administration/automation-apis-using-s2s-authentication

   Also Read: Guide to Integration with Microsoft Dynamics 365 Business Central for System Integrator

3. Test Business Central S2S Authentication in Postman

   Postman is useful for testing Business Central authentication before implementing the same flow inside an application.

   Test the process in two stages:

   1. Request an OAuth 2.0 access token from Microsoft Entra ID.
   2. Use the returned Bearer token to call a Business Central API endpoint.

   For example, you can test the Business Central companies endpoint before moving authentication into your application code.

   1. To verify the API integration, generate an access token using the following values
      • Application (client) ID (Microsoft Entra)
      • Directory (tenant) Id (from Business Central)
      • Client Secret Value (Microsoft Entra)
      
   2. Use this access token to call Business Central APIs, such as retrieving the account’s companies, to ensure the Business Central integration functions correctly.
      

Here’s the C# code to generate the access token and refresh token.

using Newtonsoft.Json;
using System;
using System.Collections.Generic;
using System.Net.Http;
using System.Threading.Tasks;

namespace BusinessCentral.Authentication
{
    internal class BusinessCentralIntegration
    {
        public string ClientId { get; set; }
        public string ClientSecret { get; set; }
        public string TenantId { get; set; }
        public string Scope { get; set; }
        public string LoginUrl { get; set; }

    }

    internal class BusinessCentralToken
    {
        [JsonProperty("access_token")]
        public string AccessToken { get; set; }

        [JsonProperty("expires_in")]
        public string ExpiresAfterSeconds { get; set; }
    }

    internal class BusinessCentralAuthenticationHelper
    {
        private readonly BusinessCentralIntegration bcCredentials;
        private readonly string tokenEndPointUrl;
        private readonly HttpClient httpClient;

        public BusinessCentralAuthenticationHelper(BusinessCentralIntegration bcCredentials, HttpClient httpClient)
        {
            this.bcCredentials = bcCredentials;
            tokenEndPointUrl = $"{bcCredentials.LoginUrl}{bcCredentials.TenantId}/oauth2/v2.0/token";
            this.httpClient = httpClient;
        }

        public async Task<BusinessCentralToken> GetAccessToken()
        {
            var requestParams = new List<KeyValuePair<string, string>>
            {
                new KeyValuePair<string, string>("grant_type", "client_credentials"),
                new KeyValuePair<string, string>("client_id", bcCredentials.ClientId),
                new KeyValuePair<string, string>("client_secret", bcCredentials.ClientSecret),
                new KeyValuePair<string, string>("scope", bcCredentials.Scope)
            };

            var httpRequest = new HttpRequestMessage(HttpMethod.Post, tokenEndPointUrl)
            {
                Content = new FormUrlEncodedContent(requestParams)
            };

            var httpResponse = await httpClient.SendAsync(httpRequest);

            var responseJson = await httpResponse.Content.ReadAsStringAsync();
            if (!httpResponse.IsSuccessStatusCode)
            {
                throw new Exception($"Authentication failed for the following reason: {responseJson}");
            }

            BusinessCentralToken token = JsonConvert.DeserializeObject<BusinessCentralToken>(responseJson);

            if (token == null)
            {
                throw new Exception($"Authentication failed. Can't deserialize response: {responseJson}");
            }

            return token;
        }
    }
}

  

Ensure that the token is created and the API is called properly.

Download the source code of my application here, you need to replace the blank values in the configuration.

Business Central Online vs On-Premises S2S Authentication

Business Central S2S authentication can apply to both supported online and on-premises environments, but the setup requirements are not identical.

Business Central Online

For Business Central online, the typical process involves:

1. Registering the application in Microsoft Entra ID
2. Assigning Business Central application permissions
3. Adding the Microsoft Entra application in Business Central
4. Assigning the required Business Central permission sets
5. Requesting an OAuth access token
6. Calling the required API or web service

Business Central On-Premises

Business Central on-premises requires additional Microsoft Entra authentication configuration.

Microsoft states that on-premises environments using S2S must be configured for Microsoft Entra authentication with OpenID Connect.

The Business Central ValidAudiences configuration must also include:

https://api.businesscentral.dynamics.com

If the expected audience is missing, API requests can return errors such as:

Authentication_InvalidCredentials

Common Business Central S2S Authentication Errors and Fixes

Authentication problems become easier to diagnose when you first identify whether the failure occurs during token generation or during the Business Central API request.

1. 401 Unauthorized

A 401 response generally means the request could not be successfully authenticated.

Check:

• Tenant ID
• Application Client ID
• Application credential
• OAuth scope
• Token endpoint
• Bearer token
• Business Central environment URL

Also confirm that the token has not expired.

2. Token Generated but Business Central API Access Fails

Successfully generating an OAuth token does not automatically mean the application is authorized to access every Business Central resource.

Check:

• Microsoft Entra application permissions
• Microsoft Entra Applications configuration inside Business Central
• Assigned Business Central permission sets
• API or table being requested
• Company and environment context

3. 403 Forbidden or Permission Denied

If authentication succeeds but the requested resource cannot be accessed, review the application’s authorization.

Make sure the assigned permission sets include the objects and operations needed by the integration.

4. Invalid or Expired Client Credential

Application credentials can expire or become invalid.

Verify the currently configured credential before troubleshooting Business Central itself.

5. Consent Has Not Been Granted

Check whether consent has been completed for the required Microsoft Entra application permissions.

Depending on the setup, consent may be handled through Microsoft Entra ID or the Business Central web client.

6. Authentication_InvalidCredentials

For Business Central on-premises environments, check the configured token audience.

Microsoft states that ValidAudiences must include:

https://api.businesscentral.dynamics.com

If it is missing, Business Central can return Authentication_InvalidCredentials.

7. Incorrect API Endpoint

Standard Business Central API endpoints generally begin with:

https://api.businesscentral.dynamics.com/v2.0/

Real-World Use Case

A common use case for service-to-service authentication is integrating Business Central with external platforms such as CRMs, eCommerce systems, or reporting tools.

For example, a business can automatically sync customer data from a CRM to Business Central or push order data from an eCommerce platform without requiring manual login or intervention.

Conclusion

Setting up service-to-service authentication in Business Central is essential for building secure and scalable integrations. By using Azure Active Directory and the client credentials flow, you can enable applications to interact with Business Central APIs without relying on user credentials.

This approach not only improves security but also supports automation, making it ideal for modern business workflows and system integrations.

Business Central S2S Authentication FAQs

What Is Business Central S2S Authentication?

Business Central S2S authentication allows an application to access Business Central APIs and web services using an application identity rather than requiring an interactive user sign-in. It uses Microsoft Entra ID and the OAuth 2.0 client credentials flow.

How Do I Set Up S2S Authentication in Business Central?

The general process involves registering an application in Microsoft Entra ID, assigning the required Dynamics 365 Business Central application permissions, creating the Microsoft Entra application record inside Business Central, assigning permission sets, and requesting an OAuth access token using the client credentials flow.

What OAuth Scope Is Used for Business Central S2S Authentication?

For Business Central API access, Microsoft documents:

https://api.businesscentral.dynamics.com/.default

This scope is included in the OAuth token request made to Microsoft Entra ID.

What Token Endpoint Is Used for Business Central S2S Authentication?

The OAuth 2.0 token endpoint follows this format:

https://login.microsoftonline.com/<tenantId>/oauth2/v2.0/token

Replace <tenantId> with the Microsoft Entra tenant ID associated with the Business Central environment.

What Permissions Are Required for Business Central S2S Authentication?

Microsoft documents API.ReadWrite.All for Business Central APIs and web services and Automation.ReadWrite.All for Automation APIs.

The application also needs appropriate permission sets inside Business Central based on the resources it needs to access.

Does Business Central S2S Authentication Use a Refresh Token?

No. Microsoft states that an application account using S2S authentication does not require a refresh token. When another access token is needed, the application can request one again using its application credentials.

Can a Microsoft Entra Application Be Assigned SUPER Permission in Business Central?

No. Microsoft states that applications cannot be assigned the SUPER permission set. Assign only the permission sets required for the integration.

Why Does My Business Central Access Token Work but the API Still Returns an Error?

Token generation verifies authentication with Microsoft Entra ID, but Business Central still checks application authorization. Verify that the Microsoft Entra application is enabled inside Business Central and that its assigned permission sets provide access to the requested resource.

What Is the Difference Between S2S and Delegated Authentication in Business Central?

Delegated authentication operates under a signed-in user’s identity. S2S authentication operates under an application identity and does not require an interactive user login. This makes S2S more appropriate for unattended integrations and background processes.

Can Business Central On-Premises Use S2S Authentication?

Supported Business Central on-premises versions can use S2S authentication, but Microsoft Entra authentication with OpenID Connect must be configured. Microsoft also requires the Business Central API audience to be included in the ValidAudiences configuration.