Connect Microsoft Business Central to TrustBill

Sign in to the Azure portal with an account that can register apps in your Microsoft tenant. Then create a new App Registration — TrustBill will use it to read invoices from Business Central.

1a. Create the App Registration

1. Open Azure Portal → App registrations and click New registration.
2. Name it TrustBill Connector.
3. Under Supported account types, pick Accounts in this organizational directory only.
4. Leave Redirect URI blank on this page — we add it in sub-step 1c below.
5. Click Register. You'll land on the Overview page.
6. Copy the Directory (tenant) ID and Application (client) ID from the Overview page — you'll paste them into TrustBill at the end.

1b. Create a Client Secret — read this carefully

1. In the left menu of your app, click Certificates & secrets → + New client secret.
2. Description: TrustBill sync. Expiry: 24 months. Click Add.
3. The page reloads showing a table with four columns: Description · Expires · Value · Secret ID.
4. Copy the Value column immediately — before you click anywhere else. The Value is a long opaque string that contains tildes ~, dots ., hyphens - and underscores _ (about 40 characters). This is what TrustBill needs.

1c. Add a Redirect URI for Business Central consent

TrustBill itself uses the client-credentials flow (no redirect needed), but Business Central's "Grant Consent" button requires one. Without it, you'll hit error AADSTS500113: No reply address is registered in Step 3.

1. In the left menu of your app, click Authentication.
2. Click + Add a platform → choose Web.
3. In the Redirect URIs box, paste exactly:https://businesscentral.dynamics.com/OAuthLanding.htm
4. Leave both checkboxes (Access tokens and ID tokens) unchecked.
5. Click Configure at the bottom.

Now tell Microsoft that this app is allowed to read Business Central data on your organisation's behalf.

1. Still in the app you just created, open API permissions.
2. Click Add a permission → APIs my organization uses. Search for Dynamics 365 Business Central and pick it.
3. Choose Application permissions, tick app_access, and add it.
4. Back on the permissions list, click Grant admin consent for {your tenant}. A green tick should appear next to app_access.

Microsoft has now allowed the app at the tenant level. Business Central also needs to know it should trust this app — a separate step inside BC itself. The order of the clicks below matters — do them exactly as written or BC will reject the app at run time with a 401 error that is hard to recover from.

3a. Open the Microsoft Entra Applications page

1. Open Business Central as a BC admin.
2. Press Alt + Q (or click the magnifier icon) and type Microsoft Entra Applications. Click the result under Pages and tasks.
3. On older BC releases this page is called Azure Active Directory Applications. Same page, older name.

3b. Create the record (keep State = Disabled for now)

1. Click + New. An empty row appears.
2. In the Client ID column, paste the Application (client) ID you copied in Step 1.
3. In Description, type TrustBill Connector.
4. Leave State = Disabled. (BC only lets you edit permission sets while the record is Disabled — if you enable it now, the "New Line" button in the next sub-step will be greyed out.)
5. Click the row to open the card view.

3c. Attach a permission set (now, while State = Disabled)

1. On the card, scroll to the User Permission Sets section at the bottom.
2. Click + New Line.
3. Permission Set: type D365 BUS FULL ACCESS and pick it from the dropdown. On BC v23 and newer the equivalent may be called D365 BUS PREMIUM — if D365 BUS FULL ACCESS is not in the dropdown, use Premium instead.
4. Company: leave blank (applies to all companies).
5. Extension Name auto-fills — don't touch it.
6. Tab out of the row so BC saves it. You should see one row listed. If "New Line" is greyed out, go back to 3b and make sure State is set to Disabled.

3d. NOW set State = Enabled

1. Go back to the top of the card.
2. Change State from Disabled to Enabled.
3. BC may ask "Do you want to grant consent for this app?" — click Yes.

3e. LAST — click Grant Consent in the ribbon

1. At the top of the card you'll see a Grant Consent action (gear-with-sparkle icon). Click it.
2. A Microsoft sign-in popup opens. Sign in with your Global Admin account and click Accept.
3. You should see the message "Consent was given successfully."

TrustBill needs to know which BC environment to talk to (most SMEs have just one; some have a sandbox alongside production).

1. Inside Business Central, go to Help & Support → Troubleshooting.
2. The environment name appears at the top — usually production for the live tenant. Copy that word exactly (lower case).

Microsoft's admin center environments guide also lists all your environments if you can't find it in-app.

You should now have four values on your scratch pad. Open TrustBill and paste them into the wizard.

1. In TrustBill, open Settings → Business Central and click Get started.
2. Paste the four values. The Connect screen now shows a 5-stage checklist (Form validation → Entra token → BC authentication → BC authorization → Save connection) — a red ✗ tells you exactly which stage failed and how to fix it.
3. Pick the BC Company to sync (you can add more later).
4. Click Start sync. Sales invoices posted in BC will start flowing within a few minutes.