Calling Business Central Directly from a Managed Identity
Managed identities can be granted Business Central API permissions directly via PowerShell without requiring federated credentials or app registrations. This enables Azure resources to call Business Central APIs securely without creating or storing client secrets.
post James Pearson
"You can assign Business Central (and other) API permissions to managed identities."
Key points
- Assign API permissions directly to managed identities using Microsoft Graph PowerShell module
- Bypass the need for separate app registrations and federated credentials
- Create an Entra Application record in Business Central using the managed identity’s client ID
- View assigned permissions through Azure Portal’s Enterprise applications section or PowerShell
- Eliminates the need to create, store, and rotate client secrets for API access
Quotes
- “You can assign Business Central (and other) API permissions to managed identities.” (Establishes the core capability that managed identities can directly receive BC API permissions without intermediate app registrations)
Context
- Features: API authentication, managed identity integration, Entra Application records, role assignment, app role permissions
Source: James Pearson, community blog. Summary, key points and quotes are derived (CONTENT-NOTICE.md); read the original for the full text.