Print-ready: Letter, margins None, Background graphics on.
OnlyBCFans BC Object
Registry
Business Central

Customer guide · Business Central connection

Connect
Business Central

Optional · about 10 minutes

For: the people who look after a Business Central tenant: an org admin in BC Object Registry, and an admin of the tenant's Microsoft Entra ID.

Time: about 10 minutes, with the right people available.

Optional. You don't have to connect anything. You can keep adding and editing environments by hand on the tenant page, as you do today.

The connection in four steps

1Start in BC Object RegistryOrg admin
2Grant admin consentEntra admin
3Authorize in BC admin centerBC admin
4Test & syncOrg admin
ProductBC Object Registry
PublisherOnlyBCFans
Admin center APIv2.29
BC Object Registry · Connect Business Central1
01

What connecting does

Once a tenant is connected, BC Object Registry can read from the Business Central admin center for that tenant.

You getHow
Sync environments: your environments' names and types (Production or Sandbox) come from Business Central, so you don't have to type themWe read the tenant's environment list
Sync installed apps: see which of your registry's apps are installed in which environment, spot installed per-tenant extensions that aren't in the registry yet, and keep a full list of installed PTEs and AppSource apps (with a CSV download)We read the list of installed apps in each environment

You always review a sync before anything changes. A sync never removes an environment or an app from your registry on its own.

02

What we promise

Our commitments to you

Read-only, logged, and yours to revoke

We only read.

BC Object Registry only makes GET requests to the admin center API. We never create, copy, rename, restore or delete environments. We never install, update or uninstall apps, restart sessions, export databases, or change any setting.

We can't see your business data.

The admin center API has no access to companies, customers, items, ledger entries or any other data inside your environments. We don't ask for the permissions that would allow that (API.ReadWrite.All, Automation.ReadWrite.All).

Every call is logged, and you can see the log.

The tenant's Business Central connection page lists each call: when it was made, who or what started it, the method (always GET), the endpoint, the result and how long it took. You can export the log as CSV.

You can cut us off at any time,

from our side or from Microsoft's side (see section 7). Either way takes effect within minutes.

We hold no secret of yours.

You don't create an app registration, a client secret or a certificate. We use our own registered app, and your admin approves it.

BC Object Registry · Connect Business Central2
02

Why the Microsoft permission says "ReadWrite"

Microsoft offers a single permission for the admin center API: AdminCenter.ReadWrite.All. There is no read-only version, so the consent screen will show "ReadWrite". Our safeguards are the ones listed above:

Code

Our code only sends GET requests, and an automated test fails the build if anything else is attempted.

Proof

The call log shows you exactly what we did.

Control

You can remove our access whenever you want.

The calls we make are:

CallUsed for
GET/admin/v2.29/applications/BusinessCentral/environmentsSync environments, and testing the connection
GET/admin/v2.29/applications/BusinessCentral/environments/{name}/appsSync installed apps, and the installed-apps list

If we ever add a call, it will be read-only. It will be listed here and announced before it's used.

03

Who you need

Three different roles take part. One person may hold all three, or you may need two or three people.

Step 1 · Start the connection

Org admin

Where

BC Object Registry

Role needed
  • Org admin in your workspace
Why

Only org admins can connect or disconnect a tenant.

Step 2 · Grant admin consent

Entra admin

Where

Microsoft sign-in page

Role needed (any one), in the tenant's Microsoft Entra ID
  • Cloud Application Administrator
  • Application Administrator
  • Global Administrator
Why

Approving an app for the whole organization needs an admin who manages applications. The Dynamics 365 Administrator role can't grant consent.

Step 3 · Authorize the app

BC admin

Where

BC admin center

Role needed (any one)
  • Dynamics 365 Business Central Administrator least privilege
  • Dynamics 365 Administrator
  • Global Administrator
Why

Business Central needs each app to be authorized explicitly, as well as consented to.

BC Object Registry · Connect Business Central3
03
i

Partners managing a customer's tenant

Your GDAP relationship needs the matching roles. Use Business Central Administrator to authorize, and Cloud Application Administrator or Application Administrator to grant consent. If it doesn't have them, send the consent link (step 2) to the customer's admin, and ask them to do step 3 too.

04

Before you begin

05

Connect, step by step

Each card shows who does the step and where it happens.

1

Start in BC Object Registry

WhoOrg adminWhereBC Object Registry
  1. Open the tenant: Tenants→the customer, or the Dashboard if you have one tenant.
  2. In Business Central connection, select Connect.
  3. Read the summary of what we'll read, then select Continue to Microsoft.
→

If someone else will grant consent, select Copy consent link instead and send it to them. The link only works for this tenant.

BC Object Registry · Connect Business Central4
05
2

Grant admin consent

WhoEntra adminWhereMicrosoft sign-in
  1. Sign in with an account from this tenant that holds one of the consent roles in section 3.
  2. Check the screen:
    • The app is named BC Object Registry, published by OnlyBCFans, with a verified publisher badge.
    • It asks for Dynamics 365 Business Central: AdminCenter.ReadWrite.All (see section 2 for why), and nothing else.
  3. Select Accept.

You come back to BC Object Registry, which shows Consent granted. If it shows Consent declined or Wrong tenant, see section 8.

⇄

You can do steps 2 and 3 the other way round. Consent can also be granted from the Business Central admin center's Authorized Microsoft Entra apps page, after you authorize the app there.

BC Object Registry · Connect Business Central5
3

Authorize the app in the Business Central admin center

WhoBC adminWhereBC admin center
  1. Open the admin center for the tenant. The tenant page in BC Object Registry has a link, or go to https://businesscentral.dynamics.com/<Tenant ID>/admin.
  2. Select Authorized Microsoft Entra apps.
  3. Select Authorize Microsoft Entra app, paste the Application (client) ID from the connection panel, and confirm.
  4. The app appears in the list. Its consent status should read Granted. It can take a minute to show, so refresh if needed.

You don't need to assign any permission sets inside your environments. None of the calls we make require them.

4

Test the connection

WhoOrg adminWhereBC Object Registry

Back on the Business Central connection panel, select Test connection. You should see Connected · found N environments. The call appears in the log.

5

Sync environments

WhoOrg adminWhereBC Object Registry
  1. Select Sync environments.
  2. Review the comparison:
    New in Business Central

    Environments not in the registry yet. Ticked to add.

    Matched

    Same name. The type is updated if it changed.

    Only in the registry

    Environments Business Central didn't return. They're kept, and you can remove them yourself if they're gone.

  3. Select Apply. The change is recorded in your audit log.

You can sync again whenever you like.

BC Object Registry · Connect Business Central6
06

What we store

Stored

  • That the tenant is connected, when, and by whom
  • When consent was granted and when the last sync ran
  • The call log (kept 12 months)

Not stored

  • Any secret, password or certificate of yours
  • Access tokens (they last about an hour, are fetched when needed and are kept only in memory)
  • Anything from inside your environments

Connection details belong to your workspace and sit behind the same privacy wall as your registry. The BC Object Registry operator can't see them.

07

Disconnect or revoke access

Any of these stops us. Use whichever suits you; the last two work at Microsoft's side, with no need to trust us.

1

In BC Object Registry

Business Central connection→Disconnect

Org admin

We stop calling at once. The call log is kept.

Our side
2

In the Business Central admin center

Authorized Microsoft Entra apps→select BC Object Registry→Remove

Our calls are refused from then on.

Microsoft's side
3

In the Microsoft Entra admin center

Enterprise applications→BC Object Registry

Either set Enabled for users to sign in? to No under Properties, or Delete the app. Deleting withdraws the consent completely; to connect again later, start from step 1.

Microsoft's side
BC Object Registry · Connect Business Central7
08

Troubleshooting

You seeWhat it meansWhat to do
Need admin approval on the Microsoft screenYour account can't grant consent for the organizationSend the consent link to someone with a consent role (section 3)
Wrong tenant after consentConsent was granted in a different Entra tenant than this tenant's Tenant IDSign in with an account from the right tenant, or correct the Tenant ID on the tenant page
Consent declinedCancel was selected, or your organization blocks the appTry again, or ask your Entra admin whether app consent policies block it
Not authorized in Business Central when testingStep 3 isn't done, or hasn't taken effect yetDo step 3, wait a minute or two, and test again
Consent missing when testingThe app was authorized, but consent wasn't granted or was removedGrant consent from the connection panel, or from Authorized Microsoft Entra apps
A test that worked now failsSomeone removed our access (section 7), or the tenant movedCheck both admin centers. Reconnect if it was removed by mistake
09

Questions

Q

Do we need this to use BC Object Registry?

No. It's optional. Manual environments work exactly as before.

Q

Does this let you install or remove our apps?

No. We only read (section 2), and the log proves it.

Q

Can we limit it to some environments?

Not with Microsoft's permission model: consent covers the tenant's admin center. We only read environment and installed-app lists.

Q

We have several tenants.

Connect each one separately, from its own tenant page.

OnlyBCFans BC Object Registry

Questions or problems? Email info@onlybcfans.com.

BC Object Registry by OnlyBCFans.

Not affiliated with Microsoft. Microsoft, Dynamics 365 and Business Central are trademarks of the Microsoft group of companies.

Based on Microsoft's Business Central administration center API documentation (API v2.29, October 2026).

learn.microsoft.com/dynamics365/business-central/dev-itpro/administration/administration-center-api

BC Object Registry · Connect Business Central8