web
You’re offline. This is a read only version of the page.
close
Skip to main content

Announcements

No record found.

News and Announcements icon
Community site session details

Community site session details

Session Id :
Dynamics 365 Community / Forums / Small and medium business | Business Central, N... / BC Onprem OData with E...
Small and medium business | Business Central, N...
Suggested Answer

BC Onprem OData with Entra login

(6) ShareShare
ReportReport
Posted on by CU23101209-0 16
Struggling a bit with this, hoping someone might have an insight. I've no doubt overlooked something simple...
 
We have Business Central 25.2 running on premise, and we use Entra ID for user authentication, all works great.
 
We want to open up OData API for access from Excel/Power Query and Power BI. I've configured as per  https://learn.microsoft.com/en-us/dynamics365/business-central/dev-itpro/administration/authenticating-users-with-azure-ad-openid-connect?tabs=singletenant%2Cadmintool for single tenant and as far as I can tell all the settings are correct but calls to the OData endpoint are still returning basic authentication as an option, and subsequently we can't authenticate.
 
Curl returns the following snippet:
 
< WWW-Authenticate: Basic realm=""
WWW-Authenticate: Basic realm=""
< WWW-Authenticate: Bearer authorization_uri="api://cxxxxxxx-yyyy-4c2c-aeea-bbbbbbbbbbbb/"
WWW-Authenticate: Bearer authorization_uri="api://cxxxxxxx-yyyy-4c2c-aeea-bbbbbbbbbbbb/"
 
Obviously not what I'm expecting.
 
WSFederationLoginEndpoint is set to "https://login.microsoftonline.com/<tenant-id>/wsfed?wa=wsignin1.0%26wtrealm=api://cxxxxxxx-yyyy-4c2c-aeea-bbbbbbbbbbbb%26wreply=https://fqdn/instance/signin"
 
(redacted)
 
also had the realm as the URL, and also had WSFederationLoginEndpoint set to "https://login.microsoftonline.com/<tenant-id>/wsfed"
AppIdUri = "api://cxxxxxxx-yyyy-4c2c-aeea-bbbbbbbbbbbb"
 
NTLM options are off, OData is all on, v4 on, ssl on. Can't see anything I've missed.
 
Any ideas? TIA
 
Categories:
Dynamics 365 Business Central
I have the same question (0)
  • Suggested answer
    OussamaSabbouh Profile Picture
    OussamaSabbouh 11,606 Super User 2026 Season 1 on at
    Hello,
     
    What you’re seeing is expected behavior on BC on-prem: the OData endpoint often advertises Basic and Bearer authentication at the same time, even when Entra ID (OIDC) is correctly configured. The server isn’t falling back to Basic — the problem is that Excel / Power Query tends to pick Basic first, which breaks OAuth sign-in. There’s usually nothing missing in your server setup; the practical fix is client-side: use the Business Central connector in Power BI / Excel (it handles OAuth properly), or explicitly force Bearer token auth in a custom OData/OAuth flow. Fully suppressing Basic auth on on-prem isn’t reliably possible just via settings.
     
    Regards,
    Oussama Sabbouh

Under review

Thank you for your reply! To ensure a great experience for everyone, your content is awaiting approval by our Community Managers. Please check back later.

Helpful resources

Quick Links

Introducing the 2026 Season 1 community Super Users

Congratulations to our 2026 Super Stars!

Congratulations to our 2025 Community Spotlights

Thanks to all of our 2025 Community Spotlight stars!

Congratulations to the February Top 10 Community Leaders

These are the community rock stars!

Leaderboard > Small and medium business | Business Central, NAV, RMS

#1
OussamaSabbouh Profile Picture

OussamaSabbouh 1,965 Super User 2026 Season 1

#2
YUN ZHU Profile Picture

YUN ZHU 1,125 Super User 2026 Season 1

#3
Dhiren Nagar Profile Picture

Dhiren Nagar 961 Super User 2026 Season 1

Last 30 days Overall leaderboard

Featured topics

Product updates

Dynamics 365 release plans