web
You’re offline. This is a read only version of the page.
close
Skip to main content

Announcements

News and Announcements icon
Community site session details

Community site session details

Session Id :
Small and medium business | Business Central, N...
Suggested Answer

Business Central 3 Tier Installation on 3 Azure VM'S

(0) ShareShare
ReportReport
Posted on by 5

Hi,

I have configured 3 VM's for the installation as below. 

1: DBSERVER 2: APPSERVER 3: WEBSERVER. 

DB Server acting as a Domain Controller and all VM's joined to a Domain.

Created one Domain Admin user and assign required permission on Database. Installed the Components on Respective VM's and Run the Business Central Instance with the Admin user. 

Server is configured with Access Control Service Authentication and using Self Signed Certificate for the testing purpose , created App registration in Azure and fill the required fields in Azure AD Tab on the Instance. 

After Installing Web Components on 3rd VM , i am not able to access the Business Central. IIS is configured and Authentication is enabled on IIS ( Windows , Anonymous). 

After several failed attempt , i have installed the Web Server on the APPSERVER VM itself and everything is working well from there and we are able to access Business Central using ACS Authentication method. 

It will be really helpful if anyone help me to configure the Web Server on 3rd VM because we have to keep this as an Architecture for several reasons , we cannot keep the Web Server on App server VM due to security reasons. 

Followed all possible steps written in Microsoft Blogs like Registering SPN on the APPSERVER because I was facing delegation issues when i was using Windows Authentication. 

Note : 

Using BC 18 CU 03 On- Premise. 

Thanks in Advance. 

Adil

I have the same question (0)
  • Suggested answer
    Marco Mels Profile Picture
    Microsoft Employee on at

    Hello,

    You mention two things:

    1. you are using AccessControlService as authentication type for NST / IIS

    2. you did configure kerberos authentication, when you put the IIS on a separate machine, you need constrained kerberos delegation

    If the scenario fails when connecting to BC from IIS, the following very old article may apply (it is not very well known in the channel as it seems as we continue keeping requests about it):

    docs.microsoft.com/.../accessing-server-locally-with-fqdn-cname-alias-denied

    Usually I use the BackConnectionHostName registry key.

    Best is to use Azure AD authentication, this will make the scenario less complicated.

    Hope it helps.

    Thank you.

Under review

Thank you for your reply! To ensure a great experience for everyone, your content is awaiting approval by our Community Managers. Please check back later.

Helpful resources

Quick Links

Season of Sharing Community Challenge Winners!

Congratulations to our community stars!

Women in Power Builds Momentum

Expanding mentorship, skilling, and AI innovation

Congratulations to the July Top 10 Community Leaders

These are the community rock stars!

Leaderboard > Small and medium business | Business Central, NAV, RMS

#1
OussamaSabbouh Profile Picture

OussamaSabbouh 572 Super User 2026 Season 2

#2
YUN ZHU Profile Picture

YUN ZHU 331 Super User 2026 Season 2

#3
Grigorios Mavrogeorgis Profile Picture

Grigorios Mavrogeorgis 330 Super User 2026 Season 2

Last 30 days Overall leaderboard

Featured topics

Microsoft Training Manuals

Product updates

Dynamics 365 release plans