Setup steps
Step 1: Check the prerequisites
- Microsoft Dynamics 365 Business Central online (the connector calls api.businesscentral.dynamics.com; on-premises servers are not supported).
- A Microsoft Entra administrator who can register apps and grant tenant-wide admin consent, for example a Global Administrator, Privileged Role Administrator, Cloud Application Administrator or Application Administrator.
- A Business Central user who can add Microsoft Entra applications and assign permission sets, such as your Business Central administrator.
- An Aequo AP workspace. Start a free trial if you do not have one. The connector links one workspace to one Business Central company.
- A sandbox environment is recommended for the first run, but not required.
Step 2: Register an app in Microsoft Entra
- Sign in to the Microsoft Entra admin center and open App registrations > New registration. Name it, for example "Aequo AP", and choose Accounts in this organizational directory only. No redirect URI is needed.
- On the Overview page, copy the Application (client) ID and the Directory (tenant) ID.
- Open Certificates & secrets > New client secret, choose an expiry, and copy the secret Value (not the Secret ID). Microsoft shows the value only once.
- Note the expiry date. When the secret expires, the connection stops until you add a new secret in Aequo.
Step 3: Add the API permission and grant admin consent
- Open API permissions > Add a permission > Microsoft APIs > Dynamics 365 Business Central > Application permissions.
- Select API.ReadWrite.All and Add permissions. Aequo uses only the standard Business Central API, so Automation.ReadWrite.All is not needed.
- Select Grant admin consent for your organization and confirm. The status column should show it as granted.
Step 4: Add the app on the Microsoft Entra Applications page in Business Central
- In the Business Central environment and company Aequo will use, search for Microsoft Entra Applications (page 9860) and select New.
- Enter the Application (client) ID in Client ID, add a description such as "Aequo AP", and set State to Enabled.
- Assign permission sets for the company. Aequo reads vendors, G/L accounts, purchase orders and purchase invoices; creates vendors and draft purchase invoices; and deletes a draft it created if one of its lines is rejected. D365 BUS FULL ACCESS covers this. If your policy requires least privilege, use a permission set limited to those objects.
- Microsoft does not allow the SUPER permission set for applications. You do not need the Grant Consent action here, because consent was granted in Microsoft Entra.
Step 5: Find the environment name and company ID
- Environment name: as shown in the Business Central admin center, for example Production or Sandbox. It is case-sensitive and may contain only letters, digits, hyphens and underscores.
- Company ID: a GUID, not the company name. It is the id field for your company in the API companies list (GET https://api.businesscentral.dynamics.com/v2.0/{tenant ID}/{environment}/api/v2.0/companies). Your Business Central partner can read it for you, or email support and we will walk you through it.
- Local currency: the ISO code of the company’s local currency, for example GBP or EUR. Business Central leaves the currency blank on local-currency documents, and Aequo assumes USD if you leave this empty.
Step 6: Connect in Aequo
- In Aequo, open Settings > Integrations and choose the Accounting tab. Under ERP and industry systems, find Microsoft Dynamics 365 Business Central (marked Early access) and select Connect.
- Enter the Microsoft Entra tenant (directory) ID, environment name, company ID, application (client) ID, client secret and, if it is not USD, the local currency.
- Select Test and connect. Aequo requests a token from Microsoft Entra and reads the company from Business Central. Credentials are saved, encrypted, only when that test passes.
Step 7: Run the first sync
- Select Manage, then run Sync vendors first, Sync chart of accounts next and Sync purchase orders last. Purchase orders whose vendor has not been synced are skipped until it has.
- From then on, a scheduled sync runs every hour: vendors, then G/L accounts, then purchase orders.
- Set vendor coding defaults and approval rules in Aequo before you approve invoices.
Step 8: Check the results
- In Aequo, check that your vendors, posting G/L accounts and purchase orders appear. Purchase orders keep their Business Central number, so invoices that quote it match to it. Draft and in-review orders come in as pending.
- Approve two or three real invoices. Each becomes a draft purchase invoice in Business Central with G/L account lines. Open them in Business Central, check vendor, dates, lines and amounts, then post as usual.
- Manage shows the connection’s last test, last sync and last reconciliation, any invoice writeback that did not complete, and Reconcile now to re-check drafts against Business Central.
Troubleshooting
Most connection failures are a missing admin consent, an app not enabled in Business Central, or a mistyped environment name or company ID. The error shown by Test and connect tells you which.
| What you see | Likely cause | Fix |
|---|---|---|
| Test and connect says the Microsoft Entra token request failed (for example invalid_client) | Wrong tenant ID or client ID, a client secret ID entered instead of the secret value, or an expired secret | Copy the IDs again from the app’s Overview page and create a new client secret, entering its Value. |
| The test reaches Business Central but returns HTTP 401 or 403 | Admin consent for API.ReadWrite.All is missing, or the app is not on the Microsoft Entra Applications page, is not Enabled, or has no permission sets | Grant admin consent in Microsoft Entra, then check the app’s card in Business Central: State Enabled and permission sets assigned. |
| The test returns HTTP 404 | The environment name or company ID does not exist in that tenant | Check the environment name’s exact spelling and case in the Business Central admin center, and that the company ID is the GUID from the companies list, not the company name. |
| Vendors and accounts look like a different company’s | The company ID points at another company in the environment (for example a demo company) | Update credentials in Aequo with the right company ID. One Aequo workspace connects to one company. |
| Drafts appear in the sandbox, not production (or the other way round) | The environment name in Aequo is the sandbox’s | Business Central environments are separate. Update credentials in Aequo with the production environment name once you are happy with the sandbox run, and add the app on the Microsoft Entra Applications page in that environment too. |
| Amounts show the wrong currency | Local currency left empty, so Aequo assumed USD | Update credentials and set the local currency to your company’s ISO code. |
| A purchase order did not come in | Its vendor has not been synced, or a purchase order with the same number was already entered in Aequo by hand | Run Sync vendors, then Sync purchase orders. A number clash is reported and never overwritten; rename one of the orders. |
| An approved invoice did not reach Business Central | A line has no G/L account, the account number is not a posting account, Business Central rejected a line, or another accounting system (QuickBooks Online, Xero, FreshBooks or Zoho Books) is also connected and receives approved invoices | Check the invoice writeback section in Manage for the reason, fix the coding and retry. If a line was rejected, Aequo deletes the partial draft so the retry starts clean. |
Still stuck? Email support@aequoap.com with the message Aequo showed and your environment type. Never include the client secret. See support for what to include.
How to disconnect or revoke access
Disconnect in Aequo stops syncing and writeback; disabling or deleting the app in Microsoft revokes access entirely.
- In Aequo, open Settings > Integrations, select Manage on the Business Central card and choose Disconnect. Aequo stops syncing with Business Central and stops creating draft purchase invoices. History stays readable and you can reconnect later.
- In Business Central, open the Microsoft Entra Applications page, open the Aequo app’s card and set State to Disabled, or delete the card.
- In Microsoft Entra, delete the app’s client secret under Certificates & secrets, or delete the app registration. Either stops Aequo from getting a token.
Drafts that Aequo already created stay in Business Central until you post or delete them.
Frequently asked questions
Which Microsoft permission does the Aequo app need?
The Dynamics 365 Business Central application permission API.ReadWrite.All, with admin consent granted in your Microsoft Entra tenant. Automation.ReadWrite.All is not needed, because Aequo uses only the standard Business Central API.
Who needs to be involved?
A Microsoft Entra administrator who can register apps and grant admin consent, and a Business Central user who can add Microsoft Entra applications and assign permission sets. Often that is the same person or your Business Central partner.
Should I connect a sandbox or production first?
A sandbox if you have one. Environments are separate, so the app must be added on the Microsoft Entra Applications page in each environment you connect, and you switch Aequo to production by updating its environment name and company ID.
What happens when the client secret expires?
Microsoft stops issuing tokens, so syncing and writeback stop. Create a new client secret in Microsoft Entra and enter it with Update credentials on the Business Central card in Aequo.
How do I disconnect Aequo from Business Central?
In Aequo, open Manage on the Business Central card and select Disconnect; syncing and writeback stop and history is kept. To revoke access in Microsoft too, set the app to Disabled on the Microsoft Entra Applications page, delete its client secret, or delete the app registration.
Need a hand with the Microsoft side?
Email support@aequoap.com with your environment type (sandbox or production) and the step you are on, or book a setup call and we will go through it with your administrator.
Related guides and comparisons
Sources
Checked on October 30, 2026. Vendor capabilities and prices change; confirm current details with each vendor.
- Microsoft Learn, Using service-to-service authentication (Business Central) — app registration, API.ReadWrite.All, Microsoft Entra applications page, no SUPER for apps
- Microsoft Learn, Grant tenant-wide admin consent to an application — roles that can grant admin consent
- Microsoft Learn, Business Central API (v2.0) — vendors, accounts, purchase invoices, purchase orders, companies
- Microsoft Learn, purchaseOrder resource type (API v2.0) — status values Draft, In Review, Open
- Microsoft Learn, Review permissions granted to enterprise applications — reviewing and revoking an app’s permissions