Register application with Microsoft Entra ID

Register an application in Microsoft Entra ID so it can access D365 F&SCM. For more information, refer to Register an application with the Microsoft identity platform.

The values to use depend on the product. They are described in the product documentation that refers to this article.

Register the application

1. In the Azure portal or the Microsoft Entra admin center, go to App registrations, and click New registration.

2. In the Name field, enter a name for the registration.

3. In the Supported account types field, select the account type that your product requires. Usually, this is Accounts in this organizational directory only (Single tenant).

   For more information, refer to Supported account types.

4. Click Register.

5. On the Overview page, copy the Application (client) ID and the Directory (tenant) ID, and keep them.

Add platforms and redirect URIs

Add the platforms and redirect URIs that your product requires. For more information, refer to How to add a redirect URI to your application and Redirect URI best practices and limitations.

1. On the app registration, go to Authentication, and add a platform.

2. Select the platform type, and enter the redirect URIs.

   Options:

   • Web: For server-side apps, for example an Azure web app. If your product requires it, also select the token types for the implicit grant.

   • Mobile and desktop applications: For OAuth 2.0 public clients. Select the suggested redirect URIs that your product requires.

3. Click Configure.

Add API permissions

Make sure the application has the required API permissions. For more information, refer to Add permissions to access your web API and Permissions and consent in the Microsoft identity platform.

1. On the app registration, go to API permissions, and click Add a permission.

2. Add these delegated permissions, unless your product documentation states otherwise.

   API	Type	Permissions
   Microsoft Graph	Delegated	openid, User.Read
   Dynamics ERP	Delegated	AX.FullAccess, CustomService.FullAccess

3. Click Grant admin consent for <your tenant>, and confirm.

   Admin consent makes sure users are not prompted to consent. For more information, refer to Grant tenant-wide admin consent to an application.

   Note

   Only a Global Administrator or a Privileged Role Administrator can grant admin consent.

Expose an API

If your product requires it, expose an API and add a scope. For more information, refer to Configure an application to expose a web API.

1. On the app registration, go to Expose an API.

2. Next to Application ID URI, click Add, and then click Save.

   The default value is api://<Application (client) ID>.

3. Click Add a scope.

4. Enter the Scope name, select who can consent, and enter the display names and descriptions.

5. Click Add scope.

Add an authorized client application

If your product requires it, authorize a client application for the scope. For more information, refer to Configure an application to expose a web API.

1. On the app registration, go to Expose an API, and click Add a client application.

2. In the Client ID field, enter the client ID that your product requires.

3. Select the scope, and then click Add application.