> ## Documentation Index
> Fetch the complete documentation index at: https://conductorone-docs-terraform-v2-owner-resources.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Set up a Microsoft Dynamics 365 Business Central connector

> C1 provides identity governance for Microsoft Dynamics 365 Business Central. Integrate your Business Central environment with C1 for unified visibility and governance over user access.

C1 provides identity governance for Microsoft Dynamics 365 Business Central. Integrate your Business
Central environment with C1 for unified visibility and governance over who can access Business Central
and which permission sets they hold.

## Capabilities

| Resource                   | Sync                                                          | Provision |
| -------------------------- | ------------------------------------------------------------- | --------- |
| Users                      | <Icon icon="square-check" iconType="solid" color="#c937ae" /> |           |
| Permission sets            | <Icon icon="square-check" iconType="solid" color="#c937ae" /> |           |
| Permission set assignments | <Icon icon="square-check" iconType="solid" color="#c937ae" /> |           |
| Companies                  | <Icon icon="square-check" iconType="solid" color="#c937ae" /> |           |
| Security groups            | <Icon icon="square-check" iconType="solid" color="#c937ae" /> |           |

The connector syncs Business Central users (with display name, sign-in name, contact email, and
enabled/disabled state), permission sets as roles, companies, and security groups.

### How permission set access is modeled

In Business Central, a permission set is granted to a user **for a particular company**, or for
every company if no company is chosen when the set is assigned. The same permission set can be
assigned to one user in several companies, and each of those is a separate grant of access.

To reflect that, the connector syncs a **permission set assignment** for each combination of
permission set and company that someone actually holds — for example *SUPER in CRONUS USA, Inc.*
Users are granted the assignment rather than the permission set itself, so an access review shows
not just which permission sets a person holds but which companies each one applies in. Assignments
made without a company appear under **All companies — tenant-wide access**, a scope shown alongside
your real companies to represent access that spans all of them.

Only combinations that are actually assigned are synced, so the number of assignments tracks real
access rather than the number of permission sets multiplied by the number of companies.

Security group memberships are synced as grants on the security group.

## Gather Microsoft Dynamics 365 Business Central credentials

The connector authenticates to the Business Central Automation API using OAuth 2.0 with a Microsoft
Entra ID app registration (client credentials flow).

<Warning>
  You need permission to register an application in Microsoft Entra ID and to grant it admin consent for
  Business Central API permissions.
</Warning>

<Steps>
  <Step>
    In the [Microsoft Entra admin center](https://entra.microsoft.com), register a new application
    under **Identity** > **Applications** > **App registrations**.
  </Step>

  <Step>
    Under **API permissions**, add the **Dynamics 365 Business Central** application permission
    **API.ReadWrite.All**, then grant admin consent for your tenant. If you add this permission
    after already granting consent once, you need to grant admin consent again — consent doesn't
    retroactively cover permissions added later.
  </Step>

  <Step>
    Under **Certificates & secrets**, create a new **client secret** and copy its value.
  </Step>

  <Step>
    Sign in to the **Business Central client** (the operational app where you open a company, not
    the separate Business Central admin center) and search for **Microsoft Entra applications**.
    Add the registered application there as a
    [Microsoft Entra application](https://learn.microsoft.com/dynamics365/business-central/dev-itpro/administration/automation-apis-using-s2s-authentication),
    and assign it at least the **D365 BASIC** permission set (covers everything
    this connector needs).
  </Step>

  <Step>
    Copy the following values to configure the connector:

    * The **Application (client) ID** and **Directory (tenant) ID** from the app registration overview.
    * The **client secret** value.
    * Your Business Central environment name (for example `Production`).
  </Step>
</Steps>

## Configure the Microsoft Dynamics 365 Business Central connector

<Tabs>
  <Tab title="Cloud-hosted">
    Follow these instructions to use a built-in, no-code connector hosted by C1.

    <Steps>
      <Step>
        In C1, navigate to **Integrations** > **Connectors** and click **Add connector**.
      </Step>

      <Step>
        Search for **Microsoft Dynamics 365 Business Central** and click **Add**.
      </Step>

      <Step>
        Choose how to set up the new Microsoft Dynamics 365 Business Central connector.
      </Step>

      <Step>
        Set the owner for this connector.
      </Step>

      <Step>
        Click **Next**.
      </Step>

      <Step>
        Find the **Settings** area of the page and click **Edit**.
      </Step>

      <Step>
        Enter the Microsoft Dynamics 365 Business Central credentials:

        * **Base URL**: The Automation API base URL for your environment, e.g.
          `https://api.businesscentral.dynamics.com/v2.0/Production/api/microsoft/automation/v2.0`.
        * **OAuth token URL**: `https://login.microsoftonline.com/<tenant-id>/oauth2/v2.0/token`.
        * **Client ID**: The application (client) ID of your Entra ID app registration.
        * **Client secret**: The client secret value you created.
        * **OAuth scope** (optional): Defaults to `https://api.businesscentral.dynamics.com/.default`.
      </Step>

      <Step>
        Click **Save**.
      </Step>

      <Step>
        The connector's label changes to **Syncing**, followed by **Connected**. You can view the logs to ensure that information is syncing.
      </Step>
    </Steps>

    **Done.** Your Microsoft Dynamics 365 Business Central connector is now pulling access data into C1.
  </Tab>

  <Tab title="Self-hosted">
    Follow these instructions to run the Microsoft Dynamics 365 Business Central connector in your own
    environment.

    <Steps>
      <Step>
        Create secrets for the Business Central client secret.
      </Step>

      <Step>
        Configure the connector with the following settings:

        * **Base URL**: The Automation API base URL for your environment.
        * **OAuth token URL**: Your tenant's Entra ID token endpoint.
        * **Client ID**: The application (client) ID of your Entra ID app registration.
        * **Client secret**: The client secret value (stored as a secret).
        * **OAuth scope** (optional): Defaults to `https://api.businesscentral.dynamics.com/.default`.
      </Step>

      <Step>
        Deploy the connector using your standard self-hosted connector process.
      </Step>
    </Steps>

    **Done.** Your Microsoft Dynamics 365 Business Central connector is now pulling access data into C1.
  </Tab>
</Tabs>