This article describes how to configure multiple OAuth Service-To-Service (S2S) for multiple Shop Floor Insight windows services. The following instructions are included:

• Create an App Registration in Azure
• Collect the Client Secret, Client ID, and Tenant ID
• Configure the Specialized IDs
• Grant Consent in Business Central

Create an App Registration (Microsoft Entra Application) in Azure

To create an App Registration in Azure, sign in with an account that has the appropriate permissions to create the App Registration. Complete the following to create the entry:

1. Navigate and log into Azure (if needed).
2. Select More Services to access Azure Active Directory and select App Registrations under the Identity section.
3. Select +New registration.
4. Input a Name (e.g., ShopFloorInsight-TimezoneA).
5. Select Accounts in this organizational directory ([Default Directory] only – Single tenant) under Support account types (limits the use of the app registration to the tenant).
6. Configure and register the following Redirect URI (required for Shop Floor Insight):
   • Web: https://businesscentral.dynamics.com/OAuthLanding.htm
   • Or if using LS Central then configure the following Redirect URI (LS Central only):
     • Web: https://lscentral.bc.dynamics.com/OAuthLanding.htm
7. Select Register.
8. Navigate to the App registrations and select All Applications.
9. Locate and select your new entry.
10. Select Authentication and select “Add a platform”, or “Add Redirect URI”
11. Select Mobile and desktop applications.
12. Check the boxes ON for all three entries.
13. Ensure the entry below appears:

• • https://login.microsoftonline.com/common/oauth2/nativeclient
  • https://login.live.com/oauth20_desktop.srf
  • msal66d9a62b-ddb9-4855-9ed3-361a0515ed2e://auth (generated automatically for the app registration)

16. Select API Permissions and select + Add a Permission.
17. Locate the Dynamics 365 Business Central and Microsoft Graph boxes and enable both the delegated and application permissions below (gives Business Central access permissions).

16. Grant consent.  The button to grant consent might be titled “Grant admin consent for [your organization name here]”.
    • If you see this button, but it is not enabled, then you will need to ask your tenant administrator to grant consent for you.
    • This still is necessary before proceeding with the remainder of the installation.
    • If this step does not occur then you will get authentication errors.
17. A successful grant should show all of the API’s permissions that were requests with the green checkbox in the “Status” column.

Collect the Client Secret, Client ID, and Tenant ID

The GUI allows you to create a client secret that expires after two years. For increased security, we recommend using the GUI and having a timed expiry rather than using PowerShell to set up a client secret with an extended expiration date.

Collect the Client Secret

Complete the following to collect the client secret while still in the app registration’s menu:

1. Navigate to Certificates & Secrets.
2. Select + New Client Secret.
3. Input a description and expiry (maximum 24 months).
4. Select Add.
5. Navigate to Certificates & Secrets.
6. Copy the Client Secret Value (Client Secret).

Collect the Client ID and Tenant ID

1. Navigate to Overview of the app registration.
2. Copy the IDs from the following fields:
   1. Application (client) ID (Client ID) (this is a GUID)
   2. Directory (tenant) ID (Tenant ID)

Configure the Specialized IDs

• If the service is already installed:
  1. Edit the IW.TimeCollectionModule.Service.exe.config file.
  2. Add the following XML into the settings XML area:

<setting name=”OAuthClientID” serializeAs=”String”>

<value>Put in the client ID collected from the previous steps, this will be a guid</value>

</setting>

<setting name=”OAuthClientSecret” serializeAs=”String”>

<value>Put in the secret value collected from the previous steps</value>

</setting>

<setting name=”OAuthTenant” serializeAs=”String”>

<value>Put in the tenant ID collected from the previous steps</value>

</setting>

• If the service is not yet installed:
  1. The application ID can be entered in the installation wizard into the “S2S Client ID” field from the “OAuthS2S Client ID” popup from the service installation wizard. Entering the value here will set the “OAuthClientID” field in the configuration XML file.
  2. The secret collected in the earlier steps can be set in the “Password” field in the “OAuthS2S Client Secret” popup from the service installation wizard. Entering the value here will set the “OAuthClientID” field in the configuration XML file.

Grant Consent in Business Central

When the user selects Grant Consent, the user must have sufficient permissions on the tenant to grant consent. This access might not be available to a Business Central administrator but would be available to the tenant administrator. Contact your IT department if you do not know who your tenant administrator is.

1. Navigate to the Azure Active Directory Applications (Microsoft Entra Applications) Card in Business Central.
2. Select + New.
3. Enter the:
   • Client ID: used in App ID (collected in Collect the Client ID and Tenant ID above)
   • Description
4. Change the state to Enabled.
5. Enter the following (minimum) permissions under the appropriate Fast Tab:
   • D365 BUS PREMIUM
   • IWORKS COMMON
   • SFI-SERVICE
   • IWX REG REGISTRATION
   • IWXQIGENERAL
   • LOCAL
   • LOGIN
   • Sufficient permissions to perform the required Shop Floor Insight tasks (e.g., for jobs, give permissions for jobs; for fixed assets, give permissions for fixed assets; for production orders, give permissions for what they plan on using with production orders).
6. Grant consent and follow the prompts (ensure you are logged in with the appropriate administrative user).