Edit

Application access management for the Embed App

In this article, you'll learn how you can control which customers can create online environments based on your Embed App application family, by enabling your resellers (VARS) to use the Application Management API.

Overview

Both Business Central and Embed Apps are distributed by Cloud Solution Provider (CSP) resellers. Embed Apps use standard Business Central licenses—the same licenses used for Business Central. So any reseller who sells Business Central can also create online environments that run on your Embed App by default.

As an Embed App owner, you'll want to control which customers and which resellers can create online environments based on your Embed App application. You'd also like to allow these resellers to control whether customers have access to both Business Central and your Embed App or only to the Embed App.

To support these capabilities, two features are available, depending on your role:

Role What you can do
Embed App ISV Enable application access management for all environments in your LCS project.

Register VARs to give them access to the Application Access Management API.
VAR Once you've been registered by the Embed App ISV, you can allow or block access to the Embed App or Business Central app for specific customers.

Embed App ISV: Enable application access management and register VARs

Follow these steps to provide your VARs with access to the Application Access Management API. Once they have access, they can use the API to enable or disable the creation of online environments based on your Embed App application.

Preparation

  • Prepare the VAR for the change

    Once you enable application access management in your LCS project, any existing customers already using your Embed App will be blocked from access to their Embed App environments and will be unable to create new Embed App environments if the Embed App hasn't already been enabled on their tenant. Make sure to coordinate enabling the Embed App on customer tenants with your VARs before you enable the application access management setting in your LCS project.

  • Get the VAR's CSP organizational ID (Microsoft ID). You'll need this ID for registration.

    The VAR can find their Microsoft ID in Partner Center, on the Account Settings > Organizational profile page.

Enable application access management and register VARs

  1. Go to Lifecycle Services and open your project.

  2. Select the Manage VARs tile.

  3. On the Manage VARs access page, specify if VARs must be able to approve customers.

    Important

    This step enables application access management. Once you have allowed VARs to approve customers, it won't take effect until you save the change. Be aware that once you save, any existing VAR customers already using your Embed App without previously enabling this on their tenant and any new customers will be blocked from access by default, until the VAR explicitly enables the app for them. We recommend that you enable your Embed App on your customer tenants before you enable application access management in LCS.

  4. Now you start to register VARs. Select +Add.

  5. On the Register new VAR Tenant, enter the VAR's Microsoft ID in the Tenant ID box.

  6. Enter a description in the Description box to make it easier for you to identify the VAR.

  7. Select Add.

  8. Select Save when done.

Once a VAR is registered, they can start to enable and disable the Embed App for their customers using the Application Management API.

Disabling and enabling application access management

In your LCS project, you can specify that VARs can or can't approve customers without having to remove VARs from the list. This capability is useful if you need to temporarily allow access to all VARs and all customers. For example, suppose a VAR is registered but they're not ready to use the API yet.

Important

If you specify that VARs cannot approve customers, even if the VARs are still listed on the Manage VARs access page, the environment access settings made by VARs for their customers will be ignored. The existing access settings will be enforced again once you allow the VARs to approve customers again and save the changes.

VAR: Manage customer access to the Embed App environments

As a VAR, once you've been registered by your ISV, you must explicitly give every customer access to create Embed App environments. Access is given by using the application access management API. The required steps are outlined in the sections that follow.

Prerequisite: Register an application for in your Microsoft Entra tenant

You only have to do this step once. In your Microsoft Entra tenant, register an application that has delegated permission to the Dynamics 365 Business Central API. You'll use this application to call the Business Central Administration Center API for each customer that you want to onboard.

Apart from registering an application, you'll also need an access token. For more information, see Setting up Microsoft Entra ID based authentication and Getting an access token.

Onboarding customers

With application access management enabled, the typical process for getting customers up and running on a Embed App environment is as follows:

  1. Connect with the customer using Partner Center:

    1. Establish reseller relationship with the customer
    2. Add necessary Business Central subscriptions
    3. Assign Business Central licenses to the customer users.

    For more information, see Connect with customers.

  2. Control access to Embed App and Business Central application using the application access management API:

    1. Enable the customer to create environments based on the Embed App
    2. Block the customer from creating environments based on the Business Central application.

    For more information, see Application Access Management API. The article explains the API calls that you can make to get the list of the available Embed Apps and enable or disable a specific Embed App for the customer.

    This work is done using your Microsoft Entra application and delegated admin access and credentials.

  3. Create the first Embed App environment for the customer by signing in to it for the first time, using the branded Embed App URL:

    https://[application family].bc.dynamics.com/[Customer Microsoft Entra tenant ID]/Production

Application Access Management API
Using Application Family
Managing an Business Central Embed App in Microsoft Lifecycle Services

  • Last updated on