web
You’re offline. This is a read only version of the page.
close
Skip to main content

Announcements

🚀 Season of Sharing Community Challenge Launch!
Ask A Community Pro
Introducing our New Video Series: Community Spotlight
News and Announcements icon
Community site session details

Community site session details

Session Id :
Dynamics 365 Community / Forums / Small and medium business | Business Central, N... / Azure AD permissions f...
Small and medium business | Business Central, N...
Answered

Azure AD permissions for API: user_impersonation or Financials.ReadWrite.All?

(0) ShareShare
ReportReport
Posted on by Nick22 15

Hi,

We have an Azure AD application that calls the Dynamics Business Central REST API. When setting up delegated permissions in the Azure portal, it seems like there are 2 choices:

  • user_impersonation
  • Financials.ReadWrite.All

Either one seems to work. Is there a difference between these?

Reason for asking is for security: we'd like to choose the least privileged permission that still gets the job done.

Any help would be much appreciated!

I have the same question (0)
  • Suggested answer
    JAngle Profile Picture
    JAngle 159 on at

    Ultimately it is down to the permissions granted within BC. Check this out for more guidance: www.kauffmann.nl/.../

  • Nick22 Profile Picture
    Nick22 15 on at

    Thank you for your reply.

    The link only describes application permissions and not delegated permissions/user_impersonation vs Financials.ReadWrite.All. However, that same blog author also wrote this article regarding delegated permissions: https://www.kauffmann.nl/2022/02/23/configuring-business-central-for-azure-active-directory-authentication-and-oauth-2/

    The author explains how Financials.ReadWrite.All does not apply to on premises BC, and user_impersonation does. I wonder whether that's the only difference between the two.

  • Suggested answer
    Marco Mels Profile Picture
    Marco Mels Microsoft Employee on at

    Hello,

    You can use user_impersonation within yourself created Azure AD App registration. Microsoft created for the cloud version of BC Financials.ReadWriteAll. The user_impersonation will only become available after you expose the API.

    Thank you.

  • Nick22 Profile Picture
    Nick22 15 on at

    Thanks for your reply. I'm not sure I fully understand. We are using the cloud/online version of BC, so the REST API is already exposed. We can choose between user_impersonation and Financials.ReadWrite.All. Perhaps there's just no difference on the cloud version.

  • Verified answer
    Marco Mels Profile Picture
    Marco Mels Microsoft Employee on at

    Hello,

    There may be a difference in how consent is configured between the two:

    docs.microsoft.com/.../configure-user-consent

    In this case I suggest you follow documentation where Financials.ReadWrite.All is needed, you add this permission and where it is not required you add user_impersonation (typically for OnPrem).

    Hope it answers the question.

  • Nick22 Profile Picture
    Nick22 15 on at

    Thanks, that's useful context. I'm still not 100% sure if there is a difference, but we've gone with Financials.ReadWrite.All as that permission applies specifically to the cloud version of BC, which is what we are using. Thank you for your help.

  • Verified answer
    YUN ZHU Profile Picture
    YUN ZHU 101,995 Super User 2026 Season 1 on at

    Hi, just adding some info.

    hope the following helps as well.

    https://docs.microsoft.com/en-us/graph/permissions-reference#financials-permissions

    pastedimage1662442874987v1.png

    Thanks.

    ZHU

  • Nick22 Profile Picture
    Nick22 15 on at

    Thank you for the additional info.

Under review

Thank you for your reply! To ensure a great experience for everyone, your content is awaiting approval by our Community Managers. Please check back later.

Helpful resources

News and Announcements

🚀 Season of Sharing Community Challenge Launch!
Ask A Community Pro
Introducing our New Video Series: Community Spotlight

Quick Links

Season of Sharing Community Challenge Launch!

Jump in, show your community spirit, and win prizes!

Women in Power Builds Momentum

Expanding mentorship, skilling, and AI innovation

Congratulations to the May Top 10 Community Leaders

These are the community rock stars!

Leaderboard > Small and medium business | Business Central, NAV, RMS

#1
OussamaSabbouh Profile Picture

OussamaSabbouh 2,371 Super User 2026 Season 1

#2
YUN ZHU Profile Picture

YUN ZHU 1,806 Super User 2026 Season 1

#3
AndrewThomas81 Profile Picture

AndrewThomas81 1,371

Last 30 days Overall leaderboard

Featured topics

Microsoft Training Manuals

Product updates

Dynamics 365 release plans