Registering Your Application in Microsoft Entra ID
Article Status Update: This article has been recently updated and is currently under review. Please check back later.
Before an external application can read or write Garage Hive data, it has to be registered in Microsoft Entra ID and given permission to call Business Central. This article covers everything you do on the Microsoft side, from registering the application to confirming you can obtain an access token.
This is the first of two setup articles. Completing it proves that Microsoft will issue your application a token. It does not yet let you read data, because Business Central keeps its own separate list of applications it trusts. That is covered in the next article.
Important: These steps create credentials that give an external application direct access to Garage Hive data. Only carry them out for a third party you trust, and share the client secret with nobody else.
Who this article is for
Whoever administers the customer's Microsoft environment, or the developer building the integration if they have been given that access. It assumes no prior knowledge of Microsoft Entra ID.
Three separate things are needed, and they are often three different people:
- Someone with the Application Administrator role, or higher, to register the application.
- Someone with the Global Administrator role to grant consent. This is frequently the step that stalls a project, so identify that person before you start.
- Access to the Business Central environment the application will connect to.
Note: A paid Microsoft Entra ID plan is not required. Everything in this article works on Microsoft Entra ID Free. If you see a prompt about Entra ID Premium P1 or P2, it relates to other features and can be ignored.
Step 1: Confirm you are in the right tenant
The application registration must be created in the same Microsoft Entra tenant as the Business Central environment. This sounds obvious, and it is the most expensive mistake to make, because an application registered in the wrong tenant looks completely correct and Business Central will never accept it.
Select your account name in the top right.
Note the Directory name, the Domain , and the directory ID shown in brackets.
Confirm that the Business Central environment you intend to connect to belongs to that same directory. If it does not, switch tenants before going any further.
Step 2: Register the application
In the Azure portal, search for Microsoft Entra ID and open it.
Select App registrations, then New registration.
Enter a Name. This is only a label, but choose something that will still make sense to someone else in a year, for example GH API Integration.
Under Supported account types , choose Single tenant only, followed by your organisation name.
Leave Redirect URI empty.
Select Register.
Do not use Enterprise applications. A Business Central tenant already contains an enterprise application called Dynamics 365 Business Central. That is Microsoft's own, and it is not the one you are configuring. Your application is created under App registrations.
When registration finishes, the Overview page opens. Copy these two values and keep them to hand, as both are needed to request a token:
- Application (client) ID
- Directory (tenant) ID
Neither of these is secret. They identify the application, they do not give access to it.
Step 3: Create a client secret
The client secret is the application's password.
Select Manage, then Certificates & secrets.
Stay on the Client secrets tab and select New client secret.
Enter a Description .
Choose an expiry period. The options are 90 days, 180 days, 365 days, 545 days, 730 days, or a custom date. 180 days is preselected and labelled as recommended.
Select Add.
Copy the Value, not the Secret ID. The table shows two columns that both look like what you need. You need the one in the Value column. The Secret ID is only an identifier and will not authenticate anything.
This is the single most common cause of a failed setup. Microsoft displays no warning at this point, and the confirmation message does not mention it.
Copy the Value immediately. Once you navigate away or refresh the page, only the first few characters remain visible, the rest is replaced with asterisks, and the copy button disappears. There is no way to retrieve it. If you lose it, delete the secret and create a new one.
This is precisely why the mistake is so easy to make. After a refresh the Value can no longer be copied, but the Secret ID still can. The only copyable value left on the page is the wrong one. Always take the Value from wherever you saved it, never from this page after the fact.
Make a note of the expiry date shown against the secret. On that date the integration will stop working, and the error gives no hint that expiry is the cause. Set a reminder ahead of it.
Step 4: Grant permission to call Business Central
Registering the application is not enough on its own. It must also be granted permission to call the Business Central API, and an administrator has to consent to that.
Select API permissions, then Add a permission.
Choose Microsoft APIs, then Dynamics 365 Business Central.
Choose Application permissions. This is the correct choice for an integration that runs on its own without a signed-in user.
Select API.ReadWrite.All and Automation.ReadWrite.All .
Select Add permissions.
Note: These are the only two permissions available at this level; the actual scoping is handled through the permission sets covered in Enabling Your Application in Business Central article.
Both permissions now appear in the list with a Status of Not granted, marked with an orange warning triangle. They are not yet usable.
Select Grant admin consent for, followed by your organisation name.
Confirm.
The Status column changes to a green tick reading Granted for, followed by your organisation name.
Do not skip the consent step. If you stop at the orange triangle, Microsoft will still issue your application a perfectly valid access token. Every request to Business Central will then fail, and nothing in the error explains why. Confirm the green tick before moving on.
Next step. The Microsoft side is now complete. Continue with Enabling Your Application in Business Central , which registers the application inside Business Central and grants it permission to read data.
Need Help?
If you have questions about connecting to the Garage Hive APIs or need assistance with your integration, contact Garage Hive support .
See Also
English (UK, IE, IM and IZ). To find documentation in other regions where Garage Hive operates, click here.
English (UK, IE, IM and IZ). To find documentation in other regions where Garage Hive operates, click here.