Hello,
In a BC17 installation we've implemented the single sign-on with Azure AD, following the steps in https://docs.microsoft.com/en-us/dynamics365/business-central/dev-itpro/administration/authenticating-users-with-azure-active-directory?tabs=singletenant%2Cadmintool.
In BC17 the permissions are set in the Windows Group User.
And the user has no permissions.
Since the user belongs to the Windows Group it should inherit the Windows Group permissions.
However, when the user tries to login it has a "Access Denied" error.
In the MS documentation Windows Groups are not mentioned, so we tried to add the Authentication E-Mail to the Windows Groups, and the following permissions in API Permissions in Azure AD:
- Group.Read.All
- GroupMember.Read.All
- User.Read
But with no success.
Has anyone been through this?
BR.
