Signing in to D365

DynBrowser signs in with the official Microsoft sign-in (Microsoft Entra ID, OAuth 2.0 with PKCE) and reads D365 on the user's behalf, with that user's own rights. No password and no secret is stored.

You need three details:

Detail What
Tenant ID The ID of your Microsoft Entra tenant (a GUID)
Client ID The Application (client) ID of the app registration below
D365 environment URL The address of your environment, e.g. https://yourcompany.operations.dynamics.com

1. Create an app registration

In the Microsoft Entra admin center, under App registrations → New registration:

  1. Give the registration a name, e.g. DynBrowser.
  2. Choose the platform Mobile and desktop applications and add the redirect URI http://localhost (exactly like that).
  3. Under API permissions, add the delegated permission for Dynamics ERP, and grant admin consent for your organisation if needed.
  4. Write down the Application (client) ID and the Directory (tenant) ID.

When signing in, DynBrowser requests the permissions granted to the registration for your D365 environment. No client secret or certificate is needed: DynBrowser is a public client.

2. Fill in the details

Choose one of these ways:

  • In advance, for everyone: in the D365Auth block of publisher-defaults.json, or in the setup wizard's D365 environments panel. See Installation.
  • Through a shared folder: when a shared folder is set, the sign-in details are stored there and every workstation reads the same ones.
  • On the workstation itself: in Browser Settings → D365 authentication: Tenant ID, Client ID and the D365 environment URL. You can list several environments (production, test).

Locally the details are kept in %LocalAppData%\ERPBrowser\auth.json.

3. Signing in

The user clicks Sign in to D365. Microsoft's sign-in page opens in Windows' default browser. After that DynBrowser remembers the sign-in (encrypted for that Windows user) and renews it by itself.

When the sign-in details change through publisher-defaults.json, users have to sign in once more.

What DynBrowser does in D365

  • DynBrowser reads D365 through the standard OData interface (/data/…), with the rights of the signed-in user. Which D365 security roles are needed depends on the pages someone uses: the same roles as for that data in D365 itself.
  • Writing to D365 happens in two features only, both off by default and enabled separately by DynSolutionZ for your organisation: writing planning back from DynPlanboard, and changes in the OData Explorer. Both only work on environments designated for it.
  • What users keep in DynBrowser itself (notes, templates, calculations) does not end up in D365.

Requiring verified sign-in

Your organisation can require that DynBrowser only works after a sign-in Microsoft has confirmed for your own tenant. Send your Tenant ID and Client ID to DynSolutionZ; we switch the check on. See Licences and users.

Message: "D365 sign-in is not configured"

This message means the Tenant ID, Client ID or environment URL is missing on that workstation. Fill them in as described above.