Dynamics Community Forum Thread Details

We have an integration between Microsoft Dynamics 365 Business Central (AL) and SharePoint Online for uploading and accessing files in document libraries.

Current Implementation

App Registration & Permissions

App created using:
/_layouts/15/appregnew.aspx

Permissions granted via:
/_layouts/15/appinv.aspx → “Trust It”

Current permission (overly broad):

this will give all tenant level access i.e. all sharepoint access so pls suggest ?

Authentication (ACS Token)

We generate access tokens using:

POST https://accounts.accesscontrol.windows.net/{tenant-id}/tokens/OAuth/2

SharePoint API Usage

We are using SharePoint REST API:

Upload file:

POST https://<org>.sharepoint.com/sites/<site>/_api/web/GetFolderByServerRelativeUrl('/sites/<site>/Shared Documents')/Files/add(url='file.pdf',overwrite=true)

Download / read files:

GET https://<org>.sharepoint.com/sites/<site>/_api/web/GetFileByServerRelativeUrl('/sites/<site>/Shared Documents')/Files...

Questions

After April 2026, will existing ACS-based integrations completely stop working, or only new registrations will be blocked?

What is the recommended modern approach for this scenario:
- Continue using SharePoint REST API with Azure AD token
- OR migrate fully to Microsoft Graph API
If we switch to Azure AD authentication:
- Can we continue using existing _api/web/... endpoints?
- Or is Graph API mandatory

What is the best way to restrict access to a single SharePoint site (avoid tenant-wide permissions like FullControl)?

For Business Central (AL), is there any recommended approach or pattern for:
- Generating Azure AD tokens (client credentials flow)
- Calling SharePoint / Graph APIs securel