Give Customers Self-Service Access to Business Central Data
Setting up a Business Central customer portal should take a few days, not weeks. If it's taken longer, or failed after launch, the breakdown usually happened before the portal was installed. And if customers went live only to start calling about wrong order statuses or missing invoices, that's the same problem showing up later.
67% of B2B buyers now prefer a rep-free buying experience, and Forrester projects that more than half of large B2B purchases will move through digital self-serve channels by the end of 2025. The infrastructure exists. For Business Central users, it's been there for years. What most portal how-to guides skip entirely is the part that comes before any portal gets installed: three Business Central prerequisites that determine whether a portal actually works. Data readiness, external identity configuration, and role boundary scoping. Get any one wrong and it goes live broken. None require a developer to fix. All three require knowing exactly where to look first.
Business Central's permission model draws a hard line between internal users (staff with BC licenses who navigate the full product UI) and external portal users, who connect through an OAuth 2.0 app registration in Microsoft Entra ID and shouldn't ever touch internal BC menus, general ledger, or purchasing. Most portal guides treat both user types as equivalent, which is why portals go live with overly permissive access or failed SSO flows that no one saw coming. This guide starts where the real work begins: in Business Central, before any portal is involved.
Stat | Source |
67% of B2B buyers prefer a rep-free buying experience | |
50%+ of large B2B purchases will be processed via digital self-serve channels |
What You Need Before You Start
Before you touch a portal installer or an Azure console, confirm these are in place:
Business Central admin access: System Administrator role in Business Central Online. You need access to Permission Sets, Customer records, and the Business Central Admin Center.
Microsoft Entra ID / Azure AD tenant admin access: Required to register an OAuth 2.0 application in App Registrations. Without this, Step 2 can't proceed.
A portal vendor account: Either a trial or a licensed Business Central customer portal. CRMJetty's Business Central Customer Portal is configured directly from an admin panel and doesn't require developer involvement.
At least one complete test customer record: A BC customer record with Name, Email, at least one Sales Order, and at least one Posted Invoice. This is the account you'll use to verify every step.
An SSL-secured domain: The portal domain needs a valid SSL certificate before any OAuth authentication will work.
Step 1 — Audit Your Business Central Data Before Connecting Anything
Action: Before the portal connects to Business Central, run a field completeness check on the customer records and transaction tables you plan to expose.
Open the Customers list in Business Central. Export to Excel. Filter for any customer record where Email is blank, Phone is blank, or the Shipping Address fields are incomplete. Do the same for the Sales Orders and Posted Invoices tables: check that Order Status and Invoice Status fields are consistently populated across your live records.
Why this matters: A Business Central Portal surfaces exactly what's in Business Central at the moment of sync. There's no cleanup layer between your ERP data and what the customer sees. If 20% of your customer records have blank email fields, those customers can't receive portal credentials. If Sales Order Status is inconsistently populated (some records using "Released," others left blank), customers see confusing or missing order data and call your team anyway. The portal adds cost without reducing support workload.
Every portal guide in the market jumps from "choose your portal platform" to "here are the features." None addresses the fact that portal reliability is downstream of data quality, not portal selection. Fixing data issues after go-live, under customer pressure, is significantly harder than addressing them in the audit phase.
Verification: Your audit is complete when:
Every customer record you plan to onboard has a populated email address
Sales Order Status and Invoice Status fields are consistently populated across all records
You've documented which BC tables and fields you plan to expose (you'll need this list in Step 3)
Time: 30 minutes to 2 hours depending on data volume.
Step 2 — Register an OAuth App in Entra ID for External Portal Users
Action: In the Azure Portal, navigate to Microsoft Entra ID, then App Registrations, then New Registration. Set the Redirect URI to your portal domain (e.g., https://portal.yourdomain.com/auth/callback). After registration, note the Application (Client) ID and Directory (Tenant) ID. Go to Certificates and Secrets, click New Client Secret, set an expiry of 12 or 24 months, and copy the secret value immediately (it's not shown again).
Why this matters: Business Central will only accept authenticated connections from registered OAuth 2.0 applications. The Client ID, Tenant ID, and Client Secret from this registration are the three credentials your portal configuration requires. These three values replace the alternative of using a BC admin user's credentials, which exposes your internal admin account to any third-party service connecting on its behalf. OAuth app registration is a 20-minute task that eliminates that risk permanently.
A common configuration error at this step is mismatching the Redirect URI. The URI you register in Entra ID must exactly match the callback URL your portal is configured to use, including protocol (https://) and path. A single character difference produces an authentication failure that looks like a portal connectivity error but is actually an Entra ID mismatch.
Verification: The application appears in Entra ID App Registrations. Under API Permissions, confirm that "Dynamics 365 Business Central" is listed with the appropriate delegated scope. Note the Client Secret expiry date and set a calendar reminder to rotate it at least 30 days before expiry.
Note your three credentials securely: Client ID, Tenant ID, Client Secret. You'll enter them in Step 4.
See how CRMJetty's Business Central Customer Portal accepts these credentials directly in the no-code admin panel — no developer configuration required.
Time: 20–30 minutes.
Step 3 — Scope External User Permissions in Business Central
Action: In Business Central, go to Permission Sets and create a new permission set named "Portal External User." Add the following permissions: Customer (Table 18) read; Sales Header (Table 36) read; Sales Invoice Header (Table 112) read; Value Entry (Table 5802) read. Add any additional tables from the field list you documented in Step 1. Don't assign Insert, Modify, or Delete permissions to any transaction table.
Why this matters: Internal Business Central users have licensed access to the full BC product UI, including purchasing, general ledger, manufacturing, and HR modules depending on your configuration. An external portal user connects through the OAuth app from Step 2 and should only reach the tables their customer-facing role requires. Assigning a broad permission set (SUPER or a standard D365 role) to portal users gives them traversal access to data they have no business accessing.
The "Portal External User" permission set is the boundary between what Business Central data your customers can see and everything else in your ERP.
A decision-maker question worth answering here: Can I reuse an existing Business Central permission set for portal users? No. Standard BC permission sets are designed for internal licensed users navigating the full product UI. They carry menu access, report access, and write permissions that external portal users don't need and shouldn't have. Creating a dedicated portal permission set takes 30 minutes and eliminates the access risk entirely.
Verification: Assign the "Portal External User" permission set to a Business Central sandbox user. Log in as that user. Confirm they can't navigate to the Purchasing, General Ledger, or any module outside the tables you scoped. The verification is complete when the sandbox user's accessible data matches exactly what you documented in your Step 1 field list.
Time: 1–2 hours.
Step 4 — Connect the Portal to Business Central
Action: In CRMJetty's Business Central Customer Portal admin panel, go to Settings, then Business Central Connection. Enter the Client ID, Client Secret, Tenant ID, and Environment name from Step 2. Select your environment type (Live or Sandbox). Click Test Connection.
Why this matters: The portal uses your OAuth credentials to authenticate against Business Central through the app registration from Step 2. A successful test connection returns a live data sample from Business Central, and you'll see your customer records populate in the portal admin data preview. If the connection fails, check three things in order: the Client Secret hasn't expired, the Environment name is entered exactly as it appears in the Business Central Admin Center (it's case-sensitive), and the Redirect URI in Entra ID matches the portal callback URL character for character.
Verification: Test Connection returns a green status. At least one Business Central entity (Customers or Sales Orders) appears in the portal admin data preview with live BC records.
Expert Tip — test with Sandbox first: Set up the portal connection pointing at a BC Sandbox environment before connecting to Live. Run every step (data sync, user authentication, RBAC isolation) in Sandbox. Once everything verifies, switch the environment connection to Live. Rolling back a misconfigured Live portal is significantly harder than catching the issue in Sandbox.
Time: 30–60 minutes.
Step 5 — Configure Which Business Central Data Customers Can Access
Action: In the portal admin panel, go to Modules. Enable Sales Orders, Posted Invoices, Quotations, and Payment History. Assign each module to the "Customer" role. Set field visibility for each module: transaction records (orders, invoices, payments) as read-only; profile fields (shipping address, contact email, phone) as editable.
Why this matters: Each portal module maps to a Business Central table. Sales Orders maps to Sales Header (Table 36). Posted Invoices maps to Sales Invoice Header (Table 112). The field visibility settings you configure here determine exactly what a logged-in customer sees in their portal session. Read-only for all transaction data is the right default. Customers can track orders and view invoices without the ability to alter records in Business Central. Editable profile fields let customers keep their own contact information current without requiring an internal ticket.
Set role-based access so the "Customer" role only has visibility into records where the Customer No. field matches the logged-in user's account. That's the data isolation boundary. One customer can't see another customer's orders or invoices.
Verification: Log into the Business Central Portal with your test customer account from the prerequisites section. Confirm: only that customer's own Sales Orders appear, Posted Invoices show correct amounts and statuses from Business Central, and no BC internal navigation, purchasing menus, or general ledger elements are visible anywhere in the portal session.
Time: 1–2 hours.
Step 6 — Run These Checks Before Opening Portal Access to Customers
Work through the following checklist before issuing portal credentials to any customer. Each item corresponds to a specific failure mode from the steps above.
Go-Live Readiness Checklist:
Data audit complete: No blank email or critical fields on any customer record you plan to onboard
OAuth app registered in Entra ID: Client Secret has a documented expiry date with a rotation reminder set
External permission set verified: Sandbox test confirmed portal user can't access GL, purchasing, or any out-of-scope BC module
Test customer login verified: Only that customer's own orders and invoices appear, no other customers' data visible
Mobile portal tested: Orders and invoices render correctly on a mobile browser
Portal domain is SSL-secured: Confirmed with a browser padlock check
Customer welcome email drafted: Includes portal URL, login instructions, and who to contact if access fails
CRMJetty's Business Central Customer Portal includes a guided setup checklist in the admin panel, with each item linking directly to the relevant configuration screen.
Time: 1–2 hours.
Common Mistakes to Avoid
Launching before the data audit. The symptom is customers calling in about wrong or missing order statuses the week after go-live. The cause is almost always incomplete BC records: blank statuses, missing email addresses, or transaction data that was never consistently populated. Customers experiencing a broken portal lose confidence faster than customers who never had one. Run the audit in Step 1 before anything else.
Using a broad BC permission set for portal users. Assigning SUPER, or any standard internal BC permission set, to an external portal user account gives that account traversal access to Business Central data it has no reason to access. Build a dedicated "Portal External User" permission set scoped to exactly the tables from your Step 1 field list. It's a 30-minute task that eliminates the risk entirely.
Skipping the Entra ID app registration. Some teams shortcut this by using a shared Business Central admin account as the portal integration credential. That exposes the admin account to every system using it. OAuth 2.0 app registration in Entra ID takes 20 minutes and is the correct architecture for external-facing integrations. Don't skip it.
Not modeling Power Pages per-user cost before committing. Microsoft Power Pages charges $200 per 100 authenticated users per site per month. A 500-customer portal costs $1,000 per month before Dataverse storage costs or professional services for ongoing Power Platform maintenance. For most SMBs running Business Central, flat-fee third-party portals like CRMJetty's Business Central Customer Portal cost a fraction of that and don't require Power Platform expertise to maintain.
Not verifying cross-customer data isolation before go-live. A permission scoping error in Step 5 can cause one customer's portal session to display another customer's invoices or orders. This isn't a cosmetic error. It's a data privacy incident. Always test with at least two separate customer accounts before issuing any credentials.
Conclusion
A Business Central customer portal that works is one where the data is accurate, the identity configuration is clean, and the role boundaries hold. Those three conditions don't come from the portal itself. They come from Business Central, and they have to be right before the portal connects. The steps above give your team a repeatable sequence: audit the data, register the OAuth app, scope the external permissions, connect the portal, configure what customers can see, and verify the isolation holds before any credentials go out.
CRMJetty's Business Central Customer Portal handles the portal layer once Business Central is ready. The no-code admin panel, the Entra ID OAuth connection, and the table-level role configuration all work together to map your BC data to a clean customer-facing view, without requiring Power Platform expertise or per-user licensing.
FAQ
What data can customers access through a Business Central customer portal?
It depends on which BC tables you expose during portal configuration. Most implementations start with Sales Orders, Posted Invoices, Quotations, Payment History, and the customer's own account and contact details. You can also expose custom BC tables if your implementation includes them. The portal only surfaces records matching the logged-in customer's account, not other customers' data.
Does setting up a Business Central customer portal require a developer?
Not if you choose a no-code portal solution. CRMJetty's Business Central Customer Portal is configured entirely through an admin panel. Modules, roles, field visibility, and the BC OAuth connection are all set through point-and-click interfaces. The Entra ID app registration in Step 2 requires Azure Portal access, but not development skills. The only step that benefits from technical familiarity is the BC Permission Set configuration in Step 3, which a BC admin can handle without developer involvement.
How does role-based access control work for external portal users in Business Central?
External portal users connect through an OAuth 2.0 app registered in Entra ID. In Business Central, you assign a scoped permission set ("Portal External User") that limits their data access to specific tables (Customer, Sales Orders, Invoices). Inside the portal, role-based access further controls which modules each user type can see and whether their access is read-only or editable. The combination of BC permission scoping and portal-level RBAC is what ensures each customer sees only their own data.
What is the difference between Power Pages and a third-party Business Central portal?
Power Pages is Microsoft's native low-code portal builder built on the Power Platform. It connects to Business Central via Dataverse and is priced per authenticated user ($200 per 100 users per site per month). It requires Power Platform expertise for ongoing customization and maintenance. Third-party portals like CRMJetty's Business Central Customer Portal connect directly to Business Central via OAuth 2.0, use a no-code admin panel for configuration, and are priced at a flat fee regardless of user count. For SMBs with predictable customer volumes and without internal Power Platform teams, third-party portals typically offer lower total cost of ownership and faster time to deployment.
How long does it take to go live with a Business Central customer portal?
With clean BC data and the prerequisites in place, most implementations go live in 2–4 weeks. The breakdown: 2–3 days for the data audit and record cleanup, half a day for the Entra ID app registration and permission set setup, 1–2 days for portal configuration and module setup, and 1–2 days for testing and go-live readiness checks. Organizations with larger customer databases or more complex data models should budget an additional week for the audit and cleanup phase.
Related Reading
Sources
Gartner Sales Survey — 67% of B2B Buyers Prefer a Rep-Free Experience, March 2026: gartner.com
Forrester B2B Marketing & Sales Predictions 2025 — More Than Half of Large B2B Purchases Will Be Processed Through Digital Self-Serve Channels: forrester.com
Microsoft Power Pages Pricing 2026: mtccrm.com
Comments