The VisionScan app can connect directly to Business Central, without the VisionScan website in between. Each user signs in with their own account, and the app reads and saves through the VisionScan API in Business Central. A direct connection also lets the app work offline: it keeps a local copy of items, locations and projects, and sends a save when the connection is back. Photos are stored in a file account that you choose.

You set up the connection once in Business Central. Users then scan a QR code in the app.

Before you start

Requirement Business Central online Business Central on-premises
Version Business Central 2025 release wave 2 (version 27) or later Version 27 or later
Sign-in Microsoft Entra ID Microsoft Entra ID (recommended), or a web service access key per user
Server Nothing to set up API services enabled on the server instance, and the API address reachable from the devices over HTTPS
Photos A file account, if users take photos A file account, if users take photos

Step 1: Let the app sign in with Microsoft Entra ID

By default, the app signs in with the VisionScan app registration, which VisionPeople provides. The app only asks for permission to use Business Central on behalf of the signed-in user, with that user's own permissions.

The first time a user signs in, Microsoft asks for consent. If your organization doesn't allow users to consent to apps, an administrator must grant consent once for everyone. The administrator opens this address in a browser, signs in, and accepts:

https://login.microsoftonline.com/<your tenant ID>/adminconsent?client_id=a5c53ce1-d9c6-445a-808b-05e3e62add14

You don't need to add the app on the Microsoft Entra Applications page in Business Central. That page is only for integrations that run without a user.

Use your own app registration (optional)

If your organization requires its own app registration, create it in the Microsoft Entra admin center:

  1. Go to App registrations, choose New registration, enter a name, for example VisionScan, and choose Accounts in this organizational directory only.
  2. Under Authentication, add the platform Mobile and desktop applications with these redirect URIs, where <client ID> is the application (client) ID of the new registration:
    • msal<client ID>://auth
    • https://login.microsoftonline.com/common/oauth2/nativeclient
  3. Under API permissions, add Dynamics 365 Business Central, choose Delegated permissions, select user_impersonation, and then choose Grant admin consent.
  4. In Business Central, enter the application (client) ID in the App Client ID field on the VisionScan Setup page.

Note

When Microsoft Authenticator or Company Portal is installed on the device, the app signs in through it. That needs two more redirect URIs in your registration: the platform iOS / macOS with the bundle ID dk.visionpeople.visionscan2, and the platform Android with the package name dk.visionpeople.visionscan2 and the signature hash YeApLPxNCkj/zFb439ooKEEhVzg= (the app from Google Play). Without them, the app signs in with its own sign-in window instead, so users can still sign in.

Step 2: Give the users access

Each app user is a user in Business Central and needs:

  • A licence. Either a normal user licence, or a device licence. Device licences are meant for shared warehouse devices: in Business Central online, add the users to the Microsoft Entra security group named exactly Dynamics 365 Business Central Device Users, and don't assign them a user licence. In Business Central on-premises, set License Type to Device Only User on the user card. Check with your Microsoft partner which tasks your licence type covers.
  • The VPE VisionScan Mobile permission set, and the standard permissions for the work they do in the app, for example posting purchase receipts and sales shipments. The app always works with the user's own permissions.
  • A line on the User Setup page with the areas the user can use in the app. To learn more, go to Enabling app users.

Step 3: Set up photo storage

If users take photos in the app, choose where Business Central stores them:

  1. Choose the Search icon, enter VisionScan Setup, then choose the related link.
  2. In the Photos group, turn on Use Photo Documentation, and choose a Photo Size. Small is enough for documentation and uploads fastest.
  3. Choose the Photo File Account action, and assign a file account to the VisionScan Photos scenario. Without an assignment, the default file account is used.

A file account needs an external file storage connector, for example for Azure Blob Storage, Azure File Share, or SharePoint. To learn more, go to Working with photo documentation.

Step 4: Check the app connection

The App Connection group on the VisionScan Setup page holds what the QR code tells the app. In Business Central online, you can usually leave all fields blank.

Field Description
App Authentication On-premises only. Microsoft Entra ID, or Web Service Access Key for servers without Microsoft Entra ID.
App API Base URL On-premises only. Leave it blank to use the API address of the service tier you're signed in to. Fill it in when the devices must use another service tier, or reach the server through another address.
App API Address in QR Code On-premises only. The API address the QR code gives the app. Check that the devices can reach it.
App Tenant ID The Microsoft Entra tenant the app signs in to. Leave it blank to use the tenant of this environment.
App Client ID Leave it blank to use the VisionScan app registration, or enter the client ID of your own registration.
App OAuth Scope Leave it blank in Business Central online. On-premises with Microsoft Entra ID, enter the scope that your server accepts.
App Certificate Thumbprint On-premises only. The SHA-1 thumbprint of the server certificate, when the devices don't trust it, for example a certificate from your own certificate authority. Leave it blank when the certificate is publicly trusted.

Step 5: Connect the app

  1. On the VisionScan Setup page, choose the App Setup QR Code action. The page shows the QR code for this company.
  2. In the app, open Settings. Under Connection, choose Business Central (QR code).
  3. Choose Scan QR code, and scan the code on the screen. On a device without a camera, choose Enter the connection code instead, and paste the text from the Connection Data field on the QR code page.
  4. Choose Test connection, and sign in. The app shows Connected as with the user's name.
  5. Choose Save, and then Login.

The QR code holds no passwords or keys, so you can print it or share it with the users. Each user still signs in with their own account. The code is for one company: to switch company, scan that company's code.

Tip

If you change a field in the App Connection group later, choose Refresh on the QR code page, and let the users scan the code again.

Sign in with a web service access key (on-premises)

For a Business Central server without Microsoft Entra ID, set App Authentication to Web Service Access Key. Each user then needs a web service access key on their user card. After scanning the QR code, the app asks for the Business Central user name and the Web service access key. The app stores the key on the device.

Troubleshooting

Message or problem What to do
Connected, but the user has no VisionScan access Add a line for the user on the User Setup page.
Microsoft says that the app needs approval from an administrator An administrator grants consent, as described in step 1.
Microsoft error AADSTS50011 (redirect URI) Your own app registration is missing a redirect URI. Check step 1.
No connection to Business Central On-premises: check that API services are enabled, and that the device can reach the address in App API Address in QR Code.
A certificate error on-premises Fill in App Certificate Thumbprint, refresh the QR code, and scan it again.