Skip to main content

Notifications

Announcements

No record found.

News and Announcements icon
Dynamics 365 Community / Forums / Small and medium business | Business Central, N... / Business Central SaaS ...
Small and medium business | Business Central, N...
Suggested answer

Business Central SaaS API Identification

(0) ShareShare
ReportReport
Posted on by TESDEveloper 162

We have an secondary (not NAV) system on an on-premise server. It would accept API calls from an old NAV application from our second on-premise server. The secondary application would only accept this as it was restricted by IP. 

If we move to Business Central SaaS, can we still identify the source of an API call coming from Business Central? Does SaaS only send API's from a specific list of IP addresses or FQDN?

Equally, does Business Central reject any calls made to it, or would it be happy to accept calls from anywhere?

Thank you. 

  • Suggested answer
    Stefano Demiliani Profile Picture
    Stefano Demiliani 37,162 Most Valuable Professional on at
    RE: Business Central SaaS API Identification

    These are not valid IPs for BC SaaS. VM clusters of BC have dynamic IPs and it’s absolutely not reliable to add ranges.

  • Suggested answer
    DAnny3211 Profile Picture
    DAnny3211 9,272 Super User 2024 Season 1 on at
    RE: Business Central SaaS API Identification

    hi

    business central as authorisation uses oauth 2.0

    danieleincalza.blogspot.com/.../business-central-bye-bye-basic.html

    regarding ip's i attach this link:

    learn.microsoft.com/.../public-ip-addresses

    DAniele

  • Suggested answer
    Stefano Demiliani Profile Picture
    Stefano Demiliani 37,162 Most Valuable Professional on at
    RE: Business Central SaaS API Identification

    Don’t rely on IP addresses on SaaS, they’re dynamic and can change every time. Why in this case (BC SaaS calling your onprem custom API if I correctly understood the scenario) you don’t rely on something different like request header keys or similar? Caller must pass a request header with key to your API. In this case you can identify callers.

    I think it’s better to implement authentication and just not a simple filter on incoming IPs.

Under review

Thank you for your reply! To ensure a great experience for everyone, your content is awaiting approval by our Community Managers. Please check back later.

Helpful resources

Quick Links

December Spotlight Star - Muhammad Affan

Congratulations to a top community star!

Top 10 leaders for November!

Congratulations to our November super stars!

Tips for Writing Effective Suggested Answers

Best practices for providing successful forum answers ✍️

Leaderboard

#1
André Arnaud de Calavon Profile Picture

André Arnaud de Cal... 291,253 Super User 2024 Season 2

#2
Martin Dráb Profile Picture

Martin Dráb 230,188 Most Valuable Professional

#3
nmaenpaa Profile Picture

nmaenpaa 101,156

Leaderboard

Featured topics

Product updates

Dynamics 365 release plans