--- title: "Business Central integration security: Entra, API, SOC 2" description: "Entra ID, API permissions and SOC 2 for a credit control tool on Business Central: what to grant, what to ask the vendor, and what Paidnice can show." url: https://www.paidnice.com/blog/business-central-ar-integration-security --- # Business Central integration security: Entra, API, SOC 2 Written by Jack Daffron Co-founder of Paidnice Reviewed by Ashley Schroder Co-founder of Paidnice Published Oct 27, 2026 · 10 min read Expert verified ## Summary You can connect an AR tool to Business Central safely if its Entra app has only the permissions it needs, a named owner holds the client secret, and the vendor can show independent assurance. Paidnice is not SOC 2 or ISO 27001 certified; Google Cloud holds ISO 27001 and SOC 1/2/3. - **Entra app:** Typical for any external tool: one app per vendor, the API.ReadWrite.All application permission with admin consent, and a permission set that is not SUPER. Microsoft's D365 AUTOMATION set covers automation API objects, not receivables data, so ask for the object list. - **Secret:** Client secrets expire on a date set in Entra, and a connection that uses one stops when it lapses. Ask the vendor who owns the renewal date. - **Single sign-on is separate:** Paidnice supports Microsoft Entra ID, Okta and Google Workspace sign-in for your team on the Custom plan, with roles. - **Assurance:** Ask for SOC 2 Type II, its scope and your own controls. For Paidnice, ask for the annual penetration test reports: no critical or high findings. Paidnice connects to your ERP on the Custom plan. [Book a demo on your own data](https://www.paidnice.com/book-a-demo), and a specialist sets up the connection. Your Entra admin sees a new app registration asking for API.ReadWrite.All against Business Central. Before they click Grant admin consent, they want to know what the app can read, who owns the secret, and who vouches for the vendor. This page is for the finance director who owns credit control and the debtors ledger, the Business Central partner, and the Entra admin in the loop. It covers what the connection involves, which permissions to give, what to ask any vendor, and what Paidnice can and cannot show. For how the tools compare, see our guide to [credit control software for Business Central](https://www.paidnice.com/blog/credit-control-software-business-central). Free: Payment reminder email templatesCopy the reminder emails for before, on and after the due date. ## What does connecting an AR tool to Business Central involve in Microsoft Entra? A typical external tool connects through an Entra app registration with the Business Central API.ReadWrite.All application permission, admin consent, and an entry on Business Central's Microsoft Entra applications page. Microsoft's [service-to-service authentication guide](https://learn.microsoft.com/en-us/dynamics365/business-central/dev-itpro/administration/automation-apis-using-s2s-authentication) gives the steps. Register the app in the Entra admin centre, create a client secret, add the Dynamics 365 Business Central application permission API.ReadWrite.All, and grant admin consent. Then, in Business Central, open Microsoft Entra applications, add the client ID with a description that names the vendor, set State to Enabled, and assign permission sets. This is the client credentials flow. Microsoft recommends it for unattended tools because delegated flows can require multi-factor authentication, which blocks a sync that runs with nobody at the keyboard. The same fact cuts the other way: client credentials bypass user MFA by design, so the permission set and the secret are the controls that matter. ### The Entra permission card, typical for any external tool Application permissionAPI.ReadWrite.All (Dynamics 365 Business Central) Admin consentGranted by an Entra admin Business Central entryMicrosoft Entra applications, one per vendor, State = Enabled Permission setNot SUPER. Name the set and the objects it reads and writes; D365 AUTOMATION covers automation API objects, not receivables data Client secretA named owner and an expiry date Source: Microsoft's service-to-service authentication page. **Single sign-on is a different Entra job.** The app registration above lets the tool talk to Business Central. Single sign-on lets your finance team sign in to the tool with their Microsoft accounts. Paidnice supports Microsoft Entra ID, Okta and Google Workspace sign-in through SAML 2.0 or OIDC on the Custom plan, and it works with roles. One does not give you the other, so ask about both. ![Entra permission card for a Business Central connection: API.ReadWrite.All, a set that is not SUPER, a named secret owner](https://www.paidnice.com/images/blog/business-central-ar-integration-security-card.png) ## What permissions does an AR tool need in Business Central? An AR tool needs a permission set that reads customers, invoices and ledger entries and writes only what it posts; Microsoft's [service-to-service guide](https://learn.microsoft.com/en-us/dynamics365/business-central/dev-itpro/administration/automation-apis-using-s2s-authentication) says applications cannot be assigned the SUPER set. Microsoft's service-to-service guide names two sets for "typical objects used with automation": **D365 AUTOMATION** and **EXTEN. MGT. - ADMIN**. The same guide ties D365 Automation to the automation API route, not to receivables data. An AR tool needs a set built for its own objects, so ask the vendor for the list. The app requests the api.businesscentral.dynamics.com/.default scope and calls the environment by name in the API URL, so one app registration can serve production and each sandbox with its own Business Central entry and permission set. For a collections tool, a least-privilege set would read Customer, Customer Ledger Entry and Sales Invoice Header, and write to the general journal only if the tool posts payments. That set is our reading of the job, not a Microsoft recommendation, so confirm it with your partner and the vendor. Microsoft limits application users the same way as people: 6,000 OData requests in a five-minute window per user, and five concurrent requests. A tool that polls too hard gets HTTP 429 responses and must back off. If the vendor needs more, Microsoft's advice is to spread the load across more than one service principal. Ask the vendor how it stays inside the limit, because a tool that hits it can slow other integrations on the same environment. Secret handling is typical for any external tool. Entra client secrets expire on a date chosen when they are created, and a connection that uses one stops when it lapses. Ask who owns the renewal date and how renewal is tracked. For Paidnice, the expiry date is agreed at implementation and goes in both calendars. If the vendor uses webhooks to hear about changes, note that Business Central webhook subscriptions expire every three days and must be renewed, so ask what happens when a renewal is missed. Paidnice renews its subscriptions inside that window and falls back to its scheduled sync if a renewal is missed. ## What should we ask the vendor before we consent? Ask eight things: which permissions, who owns the secret, where data sits, who the sub-processors are, whether AI trains on your data, which assurance reports exist, how failures are handled, and how access ends. The checklist below is the vendor security form rewritten for a credit control tool on Business Central. Where a Paidnice cell reads "Ask in the security review", the answer is given in the review itself. ### The vendor questionnaire, with Paidnice's answers | Area | Question to ask | A good answer | Paidnice answer | | --- | --- | --- | --- | | Access | Which Entra permissions and Business Central permission sets do you need? | A named set that is not SUPER | A set built for Paidnice's own objects, never SUPER, limited to the records Paidnice reads and writes, including what it needs to post fee invoices when you choose posted. The full object list, with access levels, is shared in the security review | | Access | Which records do you read and write? | Specific entities | Customers, sales invoices, sales credit memos and customer payments sync both ways, with the custom fields you map. Paidnice writes late fee sales invoices, unposted or posted as you choose, each carrying a Paidnice reference in External Document No. | | Authentication | Who owns the client secret and when does it expire? | A named owner and a renewal date | A named owner on each side. The client secret's expiry date is agreed at implementation and goes in both calendars | | Authentication | Do you support Microsoft Entra ID single sign-on for my team? | SAML or OIDC, with roles | Microsoft Entra ID, Okta and Google Workspace through SAML 2.0 or OIDC, with roles, on the Custom plan | | Authentication | Can I limit what each user sees? | Roles and entity limits | Role-based access, including a view-only role that can see accounts and activity but cannot send or change anything. Contacts or whole groups can be assigned to named team members, and a user can be limited to given entities or to their assigned customers. A junior user's sends can go to an approver first | | Data | Where is data stored and who are the sub-processors? | A region and a public list | Region: ask in the security review. Sub-processors: see [sub-processors](https://www.paidnice.com/sub-processors) | | Data | Is data encrypted at rest? | Yes, with the standard named | Ask in the security review | | Data | Do you train AI on my data? | No | Ask in the security review | | Assurance | Do you have SOC 2 Type II or ISO 27001? | A current report, or a plain no | Paidnice is not SOC 2 or ISO 27001 certified; Google Cloud holds ISO 27001 and SOC 1/2/3 | | Assurance | Independent penetration tests? | Annual, reports on request | Annual penetration tests, no critical or high findings, reports on request | | Operations | What happens on a 429 or a failed sync? | Back-off and alerting | Paidnice reads only changed records, backs off and retries on HTTP 429, and renews its webhook subscriptions inside the three-day window. A failed write is retried, then flagged in Paidnice and emailed to your team, and the chase on that invoice pauses until it is fixed | | Operations | How do you handle Business Central's April and October releases and sandbox testing? | A named process | The connection is built in your sandbox first, under its own Microsoft Entra applications entry, and connected to production after you sign off. Release testing: ask in the security review | | Exit | How is access revoked? | Disable the Entra application in Business Central and delete the secret | Set the application's State to Disabled on Business Central's Microsoft Entra applications page, then delete the secret in Entra. Both are your steps and cut access at once | | Incident | Incident response and notification terms? | Defined in writing | Ask in the security review | ## Does the vendor have SOC 2? Paidnice is not SOC 2 or ISO 27001 certified; Google Cloud holds ISO 27001 and SOC 1/2/3. Here is what Paidnice can show instead. Annual penetration tests, with no critical or high findings, and the reports are available on request. Two-factor authentication for customer accounts, and role-based permissions for your team. On the Custom plan, your users sign in with Microsoft Entra ID through SAML 2.0 or OIDC, or with Okta or Google Workspace. The full list is on our [security page](https://www.paidnice.com/security). Some credit control tools in this category publish SOC 2 Type II badges; Kolleno's site lists SOC 1 Type II, SOC 2 Type II and ISO 27001. Paidnice offers the penetration test reports and a written security review in their place. When a vendor does hand you a SOC 2 report, read four parts. Type II covers a period; Type I covers one date. The scope says which systems were tested. The exceptions list says where controls failed. The complementary user entity controls say what you must do on your side, such as the permission set and the secret owner above. ## Where is my customers' data stored? Ask where your debtor data is stored, who the sub-processors are and whether a data processing agreement applies. On the Business Central side, the country you pick when the environment is created sets its localisation and its Azure region, per Microsoft's [environment management page](https://learn.microsoft.com/en-us/dynamics365/business-central/dev-itpro/administration/tenant-admin-center-environments). A transfer to another tenant keeps the same region, per Microsoft's [transfer page](https://learn.microsoft.com/en-us/dynamics365/business-central/dev-itpro/administration/tenant-admin-center-environments-move), and the region shows in the Business Central admin centre. The AR tool is a second location for the same customer names, contact details, invoice amounts and payment history, so get its answer in writing too. Paidnice publishes its [sub-processor list](https://www.paidnice.com/sub-processors) and offers a [data processing agreement](https://www.paidnice.com/dpa). The hosting region and encryption detail are answered in the security review. If the tool takes card or bank payments through a portal, ask where those details go. In Paidnice, portal payments run through Stripe. Saved payment methods are set up in a Stripe flow and Paidnice stores only a reference. Ask in the security review how card data is handled on a one-off payment. ## How Paidnice connects to Business Central Paidnice connects to Business Central on the Custom plan. Paidnice follows the integration pattern Microsoft documents for Business Central: a Microsoft Entra app registration signed in with client credentials, an entry on the Microsoft Entra applications page in each environment you connect, and a permission set limited to the records Paidnice reads and writes, all set up in your tenant. An implementation specialist handles setup, including the Entra and permission steps with your partner or admin. The plan is quoted for your setup. Paidnice rechecks the remaining amount on open invoices at each sync, so a payment applied in Business Central stops the chase at the next sync. Every sales invoice Paidnice creates carries a Paidnice reference in External Document No., and it is checked before any retry, so a fee is never posted twice. Once connected, customers, sales invoices, sales credit memos and customer payments sync both ways. Paidnice creates late fees as sales invoices (unposted or posted, as you choose), and [reads each customer reply](https://www.paidnice.com/ai-collections-agent) for a person to approve. Nothing runs until you approve the policy. For roles and approvals inside Paidnice, see [approvals](https://www.paidnice.com/approvals), and for limiting a user to given companies, see [credit control across multiple entities](https://www.paidnice.com/credit-control-multiple-entities). To start the security review, read about [Paidnice for Dynamics 365](https://www.paidnice.com/integrations/dynamics-365) and ask for the penetration test reports when you book the demo. For who does what and how long it takes, see [what the setup plan looks like](https://www.paidnice.com/blog/business-central-ar-automation-setup). For what Business Central does on its own, see our guide to [Business Central reminders](https://www.paidnice.com/blog/business-central-reminders). ## Business Central integration security: common questions **Is it safe to connect a credit control tool to Business Central?** Yes, if the tool's Entra app has only the permissions it needs, a named owner holds the client secret, and the vendor can show independent assurance. Use the questionnaire above. **Does Paidnice have SOC 2?** Paidnice is not SOC 2 or ISO 27001 certified. Google Cloud holds ISO 27001 and SOC 1/2/3. Paidnice has annual penetration tests with no critical or high findings, and shares the reports on request. **Does Paidnice support Microsoft Entra ID single sign-on?** Yes, on the Custom plan, through SAML 2.0 or OIDC, with roles. Okta and Google Workspace work too. **Does Business Central have an API?** Yes. Business Central's API v2.0 uses Microsoft Entra ID OAuth 2.0. Unattended tools use the client credentials flow with admin consent. **How do I add the API permissions?** In the Entra admin centre, add the Dynamics 365 Business Central application permission API.ReadWrite.All to the app and grant admin consent. Then add the app on Business Central's Microsoft Entra applications page and assign a permission set. **Does it work on Business Central Essentials?** The [Dynamics 365 Licensing Guide](https://go.microsoft.com/fwlink/?LinkId=866544) (October 2026, Multiplexing section) says any user who inputs, queries or views Business Central data through another tool needs a Business Central licence; pooled connections use application access in Business Central. Ask your Microsoft partner how that applies to your users. **When the client secret lapses, what stops working?** With any external tool that uses a client secret, the connection stops when it lapses. Ask the vendor who owns the renewal date and how it is renewed. **Do Business Central webhooks cover payments?** Webhook subscriptions cover sales invoices and customer payment journals, and expire every three days. Customer ledger entries are not on Microsoft's [list of webhook-supported resources](https://learn.microsoft.com/en-us/dynamics365/business-central/dev-itpro/api-reference/v2.0/dynamics-subscriptions); salesInvoices and customerPaymentJournals are. Paidnice rechecks the remaining amount on open invoices at each sync, so a payment applied in Business Central stops the chase at the next sync. ## Paidnice features in this article - [**Roles and approvals** Assigns accounts to people or an AI agent and asks for approval before each action.](https://www.paidnice.com/approvals) - [**Credit control for multiple entities** Chases each company in a group in its own name, from its own address.](https://www.paidnice.com/credit-control-multiple-entities) - [**AI collections agent** Answers customer replies and logs the dates customers promise to pay.](https://www.paidnice.com/ai-collections-agent) ## About the editorial team Written by Jack Daffron Co-founder of Paidnice Jack is a co-founder of Paidnice and has built accounting software for more than 10 years. He builds the product that sends reminders, adds late fees and takes payments for businesses on Xero, QuickBooks and ERPs such as NetSuite and Business Central. Reviewed by Ashley Schroder Co-founder of Paidnice Ashley is a co-founder and lead developer of Paidnice and has built accounting software for more than 10 years. He builds the ledger connections that put reminders, late fees and payments into Xero, QuickBooks and ERPs such as NetSuite and Business Central. Before Paidnice he co-founded A2X, ecommerce accounting software for Xero and QuickBooks. ### Try Our Free Accounts Receivable Calculators Optimize your cash flow with our suite of financial tools designed for AR professionals. Calculate DSO, aging analysis, late fees, and more. Explore Calculators ## Start getting paid on time with Paidnice Paidnice is accounts receivable automation that enforces your payment terms. On the Custom plan it connects to your ERP, and a specialist sets it up after a demo. Book a Demo [Rated 5 stars, 160+ reviews](https://www.paidnice.com/reviews) · [App of the Year](https://www.paidnice.com/blog/winner-xero-global-app-awards-2026)