Authentication using Azure Managed Identities

[a-gnius]

It would be useful to be able to use Azure Managed Identities for authentication when using ALOpsAdminCenterAPI, ALOpsExtensionAPI, etc.

We already have 25+ BCO customers, and there will be more. It is already a challenge to manage app registration secrets for all those tenants. Let's use managed identities instead. Please consider.

[waldo1001]

Totally makes sense - we'll put it on the list.

[DanielGoehler]

@a-gnius Just to let you know:

Currently, we use a single app registration for all our Business Central (BC) customers. The app registration secret is securely stored in Azure Key Vault, ensuring no employees have direct access to it. However, onboarding a new customer in the Business Central Admin Center still requires the following manual steps:

1. Adding the authorized Microsoft Entra ID app to the Admin Center.
2. Granting the necessary access permissions.

To complete the second step, the Cloud Application Administrator role must be included in the GDAP (Granular Delegated Admin Privileges) request and assigned to an Entra ID security group. The user granting Admin Consent must be a member of this Entra ID security group. If this role is not assigned, the customer’s Global Administrator or Cloud Application Administrator will need to manually grant the required permissions.

Each new customer setup takes approximately 1-2 minutes. Additionally, creating a new secret—done every 6 months, 1 year, or 2 years (depending on the agreed duration for the secret’s validity)—takes only 1-2 minutes as well.