In a standard Microsoft Dynamics 365 Business Central Online environment (version 28.2) with the E-Document Connector – Microsoft 365 extension (version 28.2.50931.51529), the SharePoint service integration cannot be configured. Clicking "Set up service integration" on the E-Document Service card triggers an OAuth consent flow against the application "Business Central – Graph Integration" (Application ID 21ca0e34-f076-4570-9900-caaaefd1062b). The consent process fails with AADSTS7000119, and no service principal is created in the target tenant.
Reproducibility
The issue has been reproduced in two fully independent Business Central Online tenants:
- Tenant A — cross-tenant configuration (BC and SharePoint in separate Microsoft 365 tenants)
- Tenant B — single-tenant configuration (BC and SharePoint in the same Microsoft 365 tenant)
Both tenants use standard Business Central without customizations related to this integration. Same error code, same client application ID, different tenant architectures. This rules out tenant-specific misconfiguration and cross-tenant setup as root causes.
Diagnostics performed
Standard consent flow via "Set up service integration" → AADSTS7000119: "Client application '...' is not allowed to be used by tenant '...'"
Manually constructed admin consent URL following the guidance in KB AADSTS650056, Solution 3 → AADSTS7000118: "Resource application '...' is not allowed to be used by tenant '...'"
No service principal for App ID 21ca0e34-f076-4570-9900-caaaefd1062b is created in either tenant — consistent with the consent flow being blocked before provisioning.
Working hypothesis
According to the Microsoft Entra error code reference and independent technical sources, AADSTS7000119 and AADSTS7000118 are the expected error codes when an app registration is configured with signInAudienceRestrictions.allowedTenantsAudience and the requesting tenant is not on the allowedTenantIds list.
Because the behavior is identical across two independent tenants, it appears the app registration 21ca0e34-f076-4570-9900-caaaefd1062b has such an allowlist configured on the Microsoft side, and regular BC customer tenants are not included.
Questions
- Is "Business Central – Graph Integration" (App ID 21ca0e34-f076-4570-9900-caaaefd1062b) a Microsoft first-party application used by the E-Document Connector – Microsoft 365?
- Does this app registration have a tenant allowlist (signInAudienceRestrictions.allowedTenantsAudience) that prevents provisioning in customer tenants? If so, what is the intended process for BC customers to enable the SharePoint service integration?
- Is the SharePoint service integration in E-Document Connector – Microsoft 365 (version 28.2.50931.51529) generally available, or is it a preview with limited rollout?
- Is this a known issue or regression in Business Central 28.2 or in this connector version?
- Is there a recommended workaround until a resolution is available?
Anyone else running into this? Would love to hear if this is reproducible in your environments as well.
- Tenant A — cross-tenant configuration (BC and SharePoint in separate Microsoft 365 tenants)
- Tenant B — single-tenant configuration (BC and SharePoint in the same Microsoft 365 tenant)
