Microsoft Dynamics GP October 2022 - Modern Authentication in Web Client

With the October 2022 release of Microsoft Dynamics GP Web Client, 18.5, you will have the option to use Modern Authentication for emails. There is some additional setup that is going to be required, both in the App Registration in Azure AD as well as in the Microsoft Dynamics GP client.  Also, you'll want to read through this article to understand important information regarding how Modern Authentication e-mail works differently in the Web Client and the Desktop Client.

***NOTE***

If you use Web Services or Web Client with Dynamics GP and you install the US year end update which includes the 18.5 release, you need to also update each of these products.  
Blogs linked above to upgrade documentation specifically for those products.

App Registration Configuration

1.  First, in order to create the App Registration in Azure AD you'll still want to start with the previously documented steps in the following article: Multi-Factor Authentication - Dynamics GP | Microsoft Learn
2.  Then, within that App Registration go to the "Certificates & secrets" page using the link on the left
   1.  Click +New client secret
   2. Give the client secret a description, choose an expiration date, then click Add
   3. This will be your only opportunity to copy down the Value string. This will be needed for the Dynamics GP setup later. If you forget to save this string you can create another secret to retrieve a valid value.
3.  Next, click on the Authentication link on the left
   1.  Click on +Add a platform
   2. Click on the Web option
   3. Enter a URL in the following format in the Redirect URIs field https://server.domain.com/GP/EmailOAuthRedirect
      1. The beginning of this address should be the URL you're using to access the Dynamics GP Web Client.
   4. Click Configure
4.  
5. Next, click on the API permissions link on the left
   1. You should see a link called "Grant admin consent for %domain%" in the Configuration permissions section. Click that to authorize your application

Dynamics GP Configuration

The configuration on the Dynamics GP side still takes place in the Company E-mail Setup window. There are three new fields on this window specifically for the Web Client Modern Authentication setup.

To access this window, go to the Company E-Mail Settings window at Microsoft Dynamics GP>>Tools>>Setup>>Company>>E-mail Settings.

To properly set this up, you need to perform the following steps:

1. First, log into the Dynamics GP desktop client and navigate to the Company E-Mail Settings window
2. Enter your Application (Client) ID into the Desktop Client Properties section of the window
3. Tab off of that field and log in as a global administrator from your Azure AD tenant.  Make sure you mark the option to consent to allow Dynamics GP to use your app registration
4. Then log into the Dynamics GP Web Client and navigate to the Company E-Mail Settings window
5. Fill out the Web Client Properties section of this window as follows
   1. Application (Client) ID - This is still pulled from the Application (client) ID field on the Overview page in your App registration.
   2. Key - This is the Value string you saved above when setting up the client secret
   3. Redirect URL - This is the Redirect URI (e.g. https://server.domain.com/GP/EmailOAuthRedirect) you added to your App registration

Once you've added these three values click OK to perform the initial authorization.  This is where the behavior between the two clients differs.  The current release of the Web Client for Dynamics GP can e-mail via MSGraph/Modern Authentication, but users will not be prompted for credentials like they are in the Desktop Client.  The user who performs this initial login is going to be the account that all e-mails will be sent from within the Web Client.  Since you already authorized Dynamics GP with the app registration in the Desktop Client this should not need to be a global admin account.  For this reason, you will want to put some thought into what user you are specifying here.  The only way to change what user that will send e-mail out of the Web Client is to create a new app registration, log into the Web Client in an incognito or in-private browser session and perform the initial setup process again, specifying a different "send as" user.

Continue to check back to the Microsoft Dynamics GP October 2022 - Feature Blog Series to review upcoming blog posts related to our new features and other helpful resource links.

For detailed documentation on all the features: Microsoft Dynamics GP Detailed Documentation

Lucas Miller

Microsoft Dynamics GP