Settings and preview profiles

OAuth: connect the preview to Business Central

OAuth lets you sign in through Microsoft Entra ID. AL Report Creator receives a temporary access token to connect the preview and Dataset Viewer to Business Central. You enter your Microsoft password only on Microsoft's sign-in page. This connection is separate from your AL Report Creator account and its API key.

These steps apply to Business Central Online. The target environment needs the Preview Service App; use ALRC: Manage Preview Service to install it. Ask your Entra/Business Central administrator to help with the one-time Microsoft app setup.

Which sign-in should I use?

• Your Microsoft account (oauthInteractive): For everyday work in VS Code. You sign in through the browser and Business Central uses your user permissions.
• An application account (oauthClientCredentials): The connection uses a registered app and client secret instead of your personal sign-in. The app needs its own Business Central permissions.

1. Prepare sign-in with your Microsoft account

1. Your administrator creates an App registration for your organizational directory in the Microsoft Entra admin center. Note the Application (client) ID and Directory (tenant) ID from its overview.
2. Under Authentication → Advanced settings, enable Allow public client flows. This device-code flow needs neither a redirect URI nor a client secret.
3. Under API permissions, add the delegated user_impersonation permission for Dynamics 365 Business Central. Your administrator grants the consent required by your organization.
4. Your BC user needs access to the environment, company and report data, together with the SPO ARC PREVIEW permission set.

2. Configure VS Code

Merge the following object into your existing .vscode/settings.json. BC Cloud Sandbox must exactly match the name of your AL configuration in .vscode/launch.json. Replace the example IDs with your Entra values and Sandbox with your BC environment name.

{
  "al-report-creator.preview.launchOverrides": {
    "BC Cloud Sandbox": {
      "kind": "cloud",
      "tenantId": "11111111-1111-1111-1111-111111111111",
      "environmentName": "Sandbox",
      "clientId": "22222222-2222-2222-2222-222222222222",
      "auth": { "mode": "oauthInteractive" }
    }
  }
}

tenantId identifies your Microsoft directory, not a BC company such as CRONUS. Select the BC company when first connecting, or add its name as company in the profile. Leave tokenUrl and scope unset for this standard setup.

3. Open your first preview

1. Open an AL report and run ALRC: Preview Report.
2. VS Code shows a sign-in code and the Microsoft sign-in entry point. Choose Open Browser, enter the displayed code if requested, and sign in with your BC user. Complete multifactor authentication if prompted.
3. Return to VS Code and select the BC company if requested. The preview then loads.

The access token is stored in VS Code SecretStorage. You must sign in again after it expires. Automatic refresh-token renewal is not implemented, even though the requested default scope includes offline_access.

Alternative: application account with a client secret

Your administrator registers an app, creates a client secret under Certificates & secrets, and grants the Business Central application permission API.ReadWrite.All with admin consent. In BC, enable that client ID under Microsoft Entra applications and assign SPO ARC PREVIEW plus the required report-data permissions. Preview web-service calls do not require Automation.ReadWrite.All.

Use that app's IDs in the example above and change the authentication mode:

"auth": { "mode": "oauthClientCredentials" }

On first use, AL Report Creator asks for the client secret's value (not its ID) and stores it in SecretStorage. Never place it in settings.json or launch.json. This mode has no browser sign-in; the extension requests a token using the stored secret. Keep track of the secret's expiry date.

If sign-in fails

• Application not found: Check that tenantId and clientId belong to the intended registration.
• Consent required or device code blocked: Ask your administrator to check API permissions, public client flows and sign-in policies.
• Signed in but access denied: Check the user or app's BC permissions, the selected company and the installed Preview Service App.
• Invalid client secret: Check that you used the secret value instead of its ID, and that it has not expired.

On-premises requires a suitably configured Entra connection on the BC server; the cloud example alone is insufficient. Further reading: Microsoft: public client flows, Microsoft: Business Central application accounts.