Calling Business Central APIs Without a Client Secret
Explains how an Azure Function or Static Web App backend can call Business Central APIs without a client secret: the function gets a managed identity token, then exchanges it via a federated credential on the app registration for a token that BC accepts. The author notes this still works but a newer post describes a better way that calls BC directly from a managed identity.
post James Pearson
"We need to exchange the token we've already got for a token issued for the app registration."
Key points
- Managed identities assigned to Azure resources can obtain access tokens without needing client secrets
- Federated credentials enable token exchange between the managed identity token and an app registration token
- An Entra Application must still be created in Business Central with appropriate permission sets
- Token exchange uses JWT bearer assertion to swap a managed identity token for an app registration token
- Establishes trust between managed identity issuer and app registration to authorize the token exchange
Quotes
- “We need to exchange the token we’ve already got for a token issued for the app registration.” (This explains the core mechanism: the managed identity token alone is insufficient; it must be exchanged for an app registration token that has Business Central permissions.)
- “It would be better if we had a solution that didn’t rely on client secrets.” (States the motivation: avoiding secrets eliminates expiration management, key vault dependencies, and credential compromise risks.)
Context
- Features: Managed Identity Authentication, Federated Credentials, Service-to-Service Authentication, Token Exchange, Entra Application Integration
Source: James Pearson, community blog. Summary, key points and quotes are derived (CONTENT-NOTICE.md); read the original for the full text.