Connecting with a user who is not hosted in the Business Central tenant but needs authorization from the Business Central tenant requires specific OAuth configuration that differs from OAuth configuration when users are hosted in the Business Central tenant.

From Warehouse Insight’s Login configuration page, administrators can set the following fields.

Anywhere ‘xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx’ appears below, replace with the Business Central Tenant ID you are connecting to:

• Login Method: OAuth  –  On-Premise
• Authorization URI: https://login.microsoftonline.com/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/oauth2/v2.0/authorize
• Token URI: https://login.microsoftonline.com/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/oauth2/v2.0/token
• Redirect URI: https://global.consent.azure-apim.net/redirect
• Scopes: openid offline_access https://api.businesscentral.dynamics.com/.default
• Tenant ID: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
• Client ID: 3a171073-4bea-41f2-af3b-0431195184f8 (Use this value as-is. This documentation does not use a custom App Registration in Azure; the Azure Enterprise application’s client ID is used.)
• Client Secret: Leave this field empty
• Clear Cookies: Off by default
• Use Additional Insight Works User Logins: On or Off are both supported, but Insight Works users are typically used when the Business Central User is generic and not named.