Web services security

Path: Integration > Web services > Web services security · tier official · system integration · narrative reviewed (checked by Opus)

Overview

This section explains how to secure access to Business Central web services. The main Web service security page gives best practices and lists the authentication options: basic authentication, OAuth, service-to-service authentication, and certificate-based security. Start there to choose an approach.

Detailed pages follow for each option. The OAuth page covers OAuth 2.0 concepts, user impersonation, service-to-service use, and token lifetimes, and a walkthrough builds a console application that gets tokens through Microsoft Entra ID to call OData. The service-to-service page covers unattended integrations with the client credentials flow. For on-premises, a page covers X.509 certificates and chain trust. Two further pages cover supported cipher suites for outgoing HTTPS calls and the Dynamics365BusinessCentral Azure service tag for firewall and network security group rules.

Key points

• Authentication options include basic authentication, OAuth, service-to-service authentication, and certificate-based security.
• OAuth 2.0 for OData and SOAP supports user impersonation and service-to-service scenarios, with access and refresh token lifetime management.
• Service-to-service authentication uses the OAuth 2.0 client credentials flow for unattended integrations and requires a Microsoft Entra registration.
• S2S permissions named in the docs include API.ReadWrite.All and Automation.ReadWrite.All; the page references versions 17.0, 18.3, 18.11 and 19.5.
• The walkthrough builds a console app using Microsoft Entra ID, Visual Studio, delegated permissions, and the OData V4 endpoint.
• On-premises security certificates use X.509 with chain trust or peer trust, including Server and Client Authentication and SSL for web services.
• The Dynamics365BusinessCentral Azure service tag restricts network access to and from Business Central through firewall and network security group rules.
• A separate page lists the TLS protocols and cipher suites supported for outgoing HTTPS calls to external APIs.

Learn pages

• Supported cipher suites: Lists the cipher suites that are supported for external APIs called from Business Central.
• Use Azure security service tags: List of Azure service tags for Dynamics 365 Business Central
• Using OAuth to authenticate Business Central Web Services: Learn how to set up OAuth for Business Central web services, including OData and SOAP, and secure your integrations.
• Using Security Certificates with Business Central on-premises: Learn how to use security certificates to help secure connections with Business Central.
• Using Service to Service Authentication: Service-to-service authentication enables external services to connect as an application, without impersonating normal users.
• Walkthrough: Creating a console application that use OAuth to Authenticate Business Central Web Services (OData and SOAP): Learn how to use OAuth to authenticate Business Central web services (OData and SOAP) through a step-by-step guide
• Web service security: Get the list of recommendations for how to secure web services in your Business Central solution.

Videos, posts and code changes

Linked by a Haiku matcher with a grounding quote from the item’s summary (link/topics.ts); machine-generated.

• #11171 [Security][Hardening] Validate integration URLs stored in setup tables (code change): “Integration endpoint URLs stored in setup tables are now validated against their expected host”
• #12133 Block file scheme in Web Request Helper (code change): “Web Request Helper now rejects file:// URLs before creating HTTP requests”
• #12194 Harden web request helpers: opt-in default credentials (code change): “disable default credentials by default and require callers to opt in”
• #149 knowledge(web-services): under schema 2.0 an API enum field is a contract by member name, under 1.0 by caption (code change): “API enum fields are published: under schema 2.0 by member name”
• Calling Business Central APIs Without a Client Secret (community post): “Federated credentials enable token exchange between managed identity and app registration”

Source: Microsoft Learn (CC BY 4.0). Descriptions are Learn’s own.