Enabling third-party integration in D365FO using OData Services

 Before the introduction of Dynamics 365, the earlier versions of Dynamics AX consisted of an Application Integration Framework that enabled seamless integration of AX with other applications. The feature – that allowed transfer of data in a SOAP format between applications – has since been deprecated from D365 Finance and Operations (D365FO). Instead, a new type of integration has been introduced in the form of OData Services. OData or Open Data is a standard protocol based on the Representational State Transfer (REST) for creating, reading, updating, deleting, and consuming data. By applying web technologies such as HTTP and JavaScript Object Notation (JSON), OData enables integration across products and provides user access to information from various programs.

OData Authentication

All the new services launched under OData use OAuth 2.0 for authentication. 

There are two approaches for the authentication: 

1) a native client application that requires a user name and password for authentication and authorization

2) a web application confidential client where the authorization server assigns a confidential password to the client application. 

With native application, users will be required to change their password every time it expires, which is not the case with web application; it simply uses an app ID and client secret key which greatly reduces the overhead of maintaining password.

Whenever you enter the credentials for authentication, it goes to the Azure Active Directory server (http://login.windows.net/<tenant>). After verifying the credentials, the Active Directory server authenticates it by providing an access token which has to be passed in the header of the request, as shown below:

Using OData in D365FO

OData service uses data entities that are created in D365FO. Currently, Microsoft offers about 1900+ standard data entities; however, you can also create your own data entity based on your requirement. The important thing to take note of is that the IsPublic property of data entity should be set to ‘Yes’. Only those data entities with IsPublic property ‘Yes’ are exposed in the OData service and can be used for integration purposes.

In order to consume the OData service (web application) and use it for create-read-update-delete or (CRUD operations) in Dynamics 365FO, you will first be required to feed in some details to authenticate the request, which includes creating a new application in your Azure portal. Follow the steps mentioned below to generate an app ID and the client secret key.

Creating an application in Azure

1.  Browse to the Azure portal using https://portal.azure.com link.

2.  Login to portal using admin access.

3.  Navigate to Azure Application → App registration → New application registration.

4.  Enter the below mentioned details on the Create form and click the ‘Create’ button.

     Name: <Your application name>

     Supported account types: You can choose mutiple tenant (any company) or single                                                          tenant(Only your company)

5.  The system will create a new application. Copy the application ID.

6.  Navigate to Settings → Keys and Generate client secret key.

    

7.  The system will create a new key. Copy the value of the client's Secret as shown. Please note that you will not be able to retrieve this later.

Your application is now generated which can be used for authentication. However, since the application doesn’t have access to carry out read/write operations in D365, you need to provide privileges to the application.

Adding permissions to Azure App

1.  On the application page, go to API Permissions and click on Add permission.

2. Select Dynamics ERP API  from Microsoft API's from the list

3. After selecting the API, you need to add permissions. For this, click on ‘Select permissions’. Add all the permissions mentioned under Delegated permissions and then click ‘Select’. After Selecting Permissions, click “Add Permission”.

4. After permission is added we need to grant the permission. Click on the Grant admin consent to organization name(XXXX). You will get a pop-up with Yes or No. Click YES and grant admin consent and the status will change to Granted.