Connect Business Central to Itogix

A guide for the person who administers your Microsoft 365 and Business Central. It takes about 15 minutes. Nothing needs to be installed and nobody needs a password for Itogix.

Itogix reads your general ledger from Business Central every night through Microsoft's official API and turns it into a management dashboard: P&L, balance sheet, cash flow, the status of each month and the points that need attention. Before a month is shown, Itogix checks it against your Business Central trial balance to the cent. You can see what it looks like in the open demo.

What Itogix gets, and what it does not

• An application, not a user. Itogix connects as the Microsoft Entra application “Itogix BC connector” (service-to-service authentication). Microsoft issues it a token for your tenant only after your administrator has given consent, and Business Central lets it in only for the environment where you added it.
• Read-only in practice. Microsoft offers a single API permission for Business Central apps, API.ReadWrite.All. What the app can actually do is limited by the permission set you assign in Business Central: D365 READ is read-only. With it the app cannot post, change or delete anything.
• What it reads: the chart of accounts, G/L entries (date, account, amount, document number, description), the trial balance and income statement, General Ledger Setup (the Allow Posting From / To dates), accounting periods, unposted sales and purchase invoices and credit memos (number, date, amount — so that the dashboard can say what a month is still missing; the customer or vendor name comes with them but is not stored), and open general journal lines.
• What it does not request: customer, vendor and item cards, bank accounts, employees, payroll. G/L entry descriptions can still contain names (for example a supplier's name); such data is processed under our data processing agreement.
• Where the data goes: to the Itogix server in Nuremberg, Germany (Hetzner Online GmbH). Raw extracts are deleted once they have been accepted; the calculated figures are kept in your company's own Itogix environment. A data processing agreement (DPA) under Art. 28 GDPR is part of the contract.
• You stay in control: access can be revoked at any time in one click (see the end of this page).

Before you start

You need two people, often the same person:

• a Microsoft Entra administrator who may grant tenant-wide admin consent — a Global Administrator, or a Privileged Role Administrator, Cloud Application Administrator or Application Administrator;
• a Business Central user allowed to manage Microsoft Entra applications in the environment you connect (for example with the SUPER permission set).

Step 1. Add the Itogix application in Business Central · 5 minutes

1. In Business Central, search (Alt+Q) for Microsoft Entra Applications and open the page. Choose New.
2. Client ID: a08f5cdd-9b3a-47fd-bc70-4ffb9ce0b4f2. Description: Itogix (read-only).
3. Leave State on Disabled for now: Business Central lets you change the permission sets of an application only while it is disabled.
4. Under User Permission Sets, add D365 READ. Leave Company empty to cover all companies of the environment, or choose the company you are connecting.
5. Set State to Enabled. Business Central creates a technical user for the application; confirm the prompt. Keep the card open for step 2.

Step 2. Give consent · 2 minutes, Entra administrator

On the same card choose Grant Consent, sign in as the Entra administrator and accept. The consent screen shows the application Itogix BC connector from itogix.com and the permission Dynamics 365 Business Central — API.ReadWrite.All; the permission set from step 1 keeps the application read-only.

If the Business Central user is not an Entra administrator, the administrator can give consent with this link instead (replace the first part with your domain, for example contoso.onmicrosoft.com, or with your tenant ID):

https://login.microsoftonline.com/your-domain-or-tenant-id/adminconsent?client_id=a08f5cdd-9b3a-47fd-bc70-4ffb9ce0b4f2&redirect_uri=https://businesscentral.dynamics.com/OAuthLanding.htm

After accepting you land on a Business Central page — that is expected.

Step 3. Send us four things

These are not secrets; send them to hello@itogix.com.

1. Tenant ID — Microsoft Entra admin center → Overview → Tenant ID (your primary domain, such as contoso.onmicrosoft.com, works too).
2. Environment name — Business Central admin center → Environments, for example Production. It is also visible in the address: businesscentral.dynamics.com/<tenant>/<environment>.
3. Company name exactly as Business Central shows it on the Companies page.
4. The e-mail address of the first dashboard administrator (usually the CFO or controller). They can invite colleagues themselves later.

What happens next

• We connect your company and run the first extract — usually a few minutes. Every month is checked against your trial balance before it is shown.
• You receive the address of your dashboard, https://<your-company>.eu.itogix.com. To sign in, enter your e-mail address; a one-time code arrives by e-mail. There are no passwords.
• Every night (around 05:30 Central European time) Itogix reads the changes. Months that are still open for posting are shown as preliminary; a month becomes final once posting into it is locked (General Ledger Setup → Allow Posting From later than the month end).
• The Management tab shows when the last sync ran and, if it failed, why.

If the Management tab reports a problem

If an access error names a particular table, add the permission set D365 BASIC next to D365 READ on the application card (disable the card, add the set, enable it again).

Revoking access

• Business Central: Microsoft Entra Applications → Itogix → set State to Disabled, or delete the card. Itogix cannot read anything from that moment on.
• Microsoft Entra: Enterprise applications → Itogix BC connector → Properties → Delete removes the consent for the whole tenant.
• Your data at Itogix: ask us to delete your environment; we delete it as set out in the data processing agreement.

Security summary for your IT review

• Authentication: OAuth 2.0 client credentials with Microsoft Entra. The application secret is kept only on the Itogix server, in a file that only the nightly sync job can read; the dashboard processes cannot see it.
• Scope: one environment, the permission set you assign (D365 READ), revocable by you at any time.
• Transport: TLS to the Microsoft APIs and to the dashboard (HTTPS with HSTS).
• Hosting: Hetzner Online GmbH, data centre in Nuremberg, Germany. Each customer has a separate environment (its own folder and process). The web front end keeps no visitors' IP addresses in its logs.
• Data minimisation: ledger-level data only; extracts are deleted after processing.
• Dashboard access: sign-in with one-time e-mail codes (valid 15 minutes, rate-limited), roles administrator / operator / viewer managed by your own administrator, secure HTTP-only session cookies; sign-ins and data imports are recorded in the environment's audit log.