Dynamics 365 Finance & Operations Connector
Overview
The Dynamics 365 Finance & Operations (F&O) connector integrates D365 production data with MachineMetrics. The connector runs on a MachineMetrics Edge Device and exchanges data in both directions:
- From D365 → MachineMetrics: Production orders and routing operations are imported, making jobs available for tracking on the shop floor.
- From MachineMetrics → D365: Labor data is written back to D365 as route card journal entries after production activity is recorded.
The connector authenticates to D365 F&O using OAuth 2.0 through an Azure-registered service principal. No interactive user sessions are required.
How It Works
From your Edge Device (or Virtual Edge), the connector makes outbound HTTPS calls to your D365 environment. D365 does not call the connector. Each call is signed in with the app registration from Step 1 using the OAuth 2.0 client credentials flow, and has only the permissions of the service account linked in Step 3.
Reading from D365
The connector reads production orders, route operations, released products, resources, workers, and related production data from the standard OData data entities that Microsoft publishes with D365 F&O. A read-only integration installs nothing inside your D365 environment.
Writing to D365
Writes use one of two paths, depending on the feature.
Standard data entities. Labor is written as route card or job card production journal lines, and material consumption (where used) as picking list journal lines, through the same published OData API used for reads. Nothing is installed in D365 for this path. The connector creates the journal lines, and your existing process in D365 posts them.
MachineMetrics D365 package. Some optional features need D365 business logic that the published data entities do not expose. These features require an X++ package from MachineMetrics:
- Starting production orders
- Posting journals automatically
- Reporting as finished, including put-away work
- Printing license plate labels through your document routing setup
- Recording quality non-conformances
The package adds a custom service that the connector calls over the same authenticated connection. Each service operation runs D365's own standard production, posting, and warehouse logic, the same logic that runs when a user performs the step in D365. The connector and the service both check for an earlier result before acting, so a retried step does not post twice.
| Topic | Details |
|---|---|
| What it adds | One service group and one service with its operations, plus supporting classes, enums, and labels. |
| What it does not change | Standard D365 objects. The package contains new objects only: no overlayering, no extensions to standard tables, forms, or classes, and no new tables or fields. |
| How it is deployed | Your D365 partner deploys it through your normal release process (for example, through Lifecycle Services), to a sandbox environment first and then to production. |
If you do not use these features, the package is not required. Your MachineMetrics Solution Delivery Manager can confirm which features apply to your deployment.
Requirements and Permissions
| Requirement | Details |
|---|---|
| D365 F&O Deployment | Cloud-hosted SaaS deployment only. On-premise Dynamics AX is not supported. |
| D365 Module License | Production Control module (included with the Supply Chain Management license). |
| Azure Access | Azure Portal access with permissions to create app registrations and grant admin consent. |
| D365 Access | System Administrator role in D365 F&O. |
| Edge Device | A MachineMetrics Edge Device (physical or virtual) that can reach the D365 environment URL. |
No additional API licenses are required. OData REST API access is included with all D365 F&O cloud subscriptions.
Setup
Complete the ERP-specific steps below, then follow Setup and Verification for resource mapping, operator mapping, and the go-live checks. The customer enters credentials directly in Edge Services. Never share credentials with MachineMetrics staff.
Complete three configuration steps in Azure and D365, performed in order, before configuring the connector in MachineMetrics.
Step 1: Register the Application in Azure Entra ID
Who does this: Azure AD / Entra ID administrator Where: Azure Portal → Microsoft Entra ID → App Registrations
- Click New registration.
- Enter a name (e.g.,
MachineMetrics Connector). - Set it as a single-tenant application.
- Click Register.
Create a Client Secret
- Go to Certificates & secrets → New client secret.
- Set an expiration period (12–24 months recommended).
- Click Add.
- Copy the secret value immediately. It is only displayed once.
Add API Permissions
- Go to API permissions → Add a permission → APIs my organization uses.
- Search for Dynamics ERP and select it. (Do not select "Dynamics CRM" or "Business Central".)
- Choose Application permissions (rather than Delegated permissions). The connector authenticates as an application using the OAuth 2.0 client credentials flow, with no signed-in user.
- Check
Connector.FullAccess. This is the only application permission the Dynamics ERP API exposes, and it is the correct one. - Click Grant admin consent for [your tenant]. A tenant administrator must perform this step.
- Confirm the permission shows a green checkmark under Status.
Delegated permissions (Access Dynamics AX Custom Service, Access Dynamics AX data, Access Dynamics AX online as organization users) require an interactive user sign-in and have no effect on this integration. Granting them is not necessary.
The Azure permission alone does not grant access to your data. D365 keeps its own list of trusted applications; Step 3 below (Microsoft Entra ID applications) is what actually authorizes the connector's API calls.
Collect These Values After Step 1
| Item | Where to Find It |
|---|---|
| Tenant ID | Azure Portal → Microsoft Entra ID → Properties → Tenant ID |
| Client ID | App registration → Overview → Application (client) ID |
| Client Secret | Copied during secret creation above |
Step 2: Create a Service Account in D365 F&O
Who does this: D365 System Administrator Where: D365 F&O → System Administration → Users → Users
Create a dedicated user account for the integration. Use a service account (e.g., mm-integration@yourdomain.com) rather than a named user to avoid conflicts with interactive sessions.
Assign Security Roles
Option A: Standard Roles
| Role | Module | What It Grants |
|---|---|---|
| Production supervisor | Production Control | Read: ProductionOrderHeaders, ProductionOrderRouteOperations, OperationsResources, RouteCardProductionJournalEntries |
| Released product maintenance | Product Information Management | Read: ReleasedProductsV2 |
| Human resource assistant | Human Resources | Read: HcmWorkerEntity |
| Production operator | Production Control | Write: RouteCardProductionJournalEntries |
The Production operator role is only needed when Write LTs to D365 is enabled.
Option B: Custom Integration Role (recommended)
Create a role (e.g., MachineMetrics Integration) with explicit Data Services privileges:
| Privilege | Entity | Integration Mode | Grant |
|---|---|---|---|
HcmWorkerEntityView | HcmWorkerEntity | DataServices | Read |
OpResOperationsResourceEntityView | OperationsResources | DataServices | Read |
ProdProductionOrderHeaderEntityView | ProductionOrderHeaders | DataServices | Read |
ProdRouteOperationsEntityView | ProductionOrderRouteOperations | DataServices | Read |
EcoResReleasedProductV2EntityView | ReleasedProductsV2 | DataServices | Read |
ProdRouteCardJournalEntryEntityView | RouteCardProductionJournalEntries | DataServices | Read |
ProdRouteCardJournalEntryEntityMaintain | RouteCardProductionJournalEntries | DataServices | Delete (grants Create + Update + Delete) |
The ProdRouteCardJournalEntryEntityMaintain privilege is only needed when Write LTs to D365 is enabled.
After this step, note the User ID of the service account.
Step 3: Link the App Registration to the Service Account
Who does this: D365 System Administrator
Where: D365 F&O → search for Microsoft Entra → Microsoft Entra ID applications
You can navigate directly using:
https://{your-environment}.operations.dynamics.com/?cmp={company-code}&mi=SysAADClientTable
- Click + New.
- Enter the Client ID from Step 1.
- Enter a name (e.g.,
MachineMetrics). - Enter the User ID from Step 2.
- Click Save.
Configuration Settings
Configure these variables on the Edge Services screen. Variables marked with a lock icon are masked in the UI.
D365 Connection
| Label | Required | Description |
|---|---|---|
| D365 Environment Host | Yes | Hostname of the D365 F&O environment, without protocol. Example: contoso.operations.dynamics.com. |
| D365 Tenant Id | Yes | Azure AD tenant ID from the app registration (Step 1). |
| D365 Client Id | Yes | Application (client) ID from the app registration (Step 1). |
| D365 Client Secret | Yes | Client secret from the app registration (Step 1). |
MachineMetrics Platform
| Label | Required | Description |
|---|---|---|
| Mapping Service Token | Yes | Authentication token for this connector instance. Provided by MachineMetrics during deployment. |
| Mapping Service URL | Yes | Base URL for the MachineMetrics ERP mapping service. Provided by MachineMetrics during deployment. |
| Mapping Auth Service URL | Yes | Base URL for the MachineMetrics authentication API. Provided by MachineMetrics during deployment. |
Site and Legal Entity
| Label | Required | Description |
|---|---|---|
| D365 Default Site Id | Yes | D365 site code for the production site. Found in D365 → Warehouse management → Setup → Sites. Example: 110. |
| D365 Default Data Area Id | Yes | D365 dataAreaId (legal entity / company code). Found in D365 → System Administration → Legal entities. Example: usmf. |
Sync Configuration
| Label | Required | Description |
|---|---|---|
D365_ORDER_SOURCE | No | Work order source type. production (default) for discrete manufacturing (reads ProductionOrderHeaders). batch for process manufacturing (reads BatchOrderHeaders). Must match your D365 manufacturing model. |
D365_SCHEDULING_MODE | No | Controls operation enrichment and labor ticket writeback target. operation (default): writeback targets RouteCardProductionJournalEntries. job: enriches operations with job-level data and targets JobCardProductionJournalEntries. Use job if your D365 site uses job scheduling. |
Import LTs to MM (LOAD_LABOR_TICKETS) | No | Import labor tickets from D365. Software default: true; confirm the deployed value in Edge Services. |
| Write LTs to D365 | No | true to write labor tickets from MachineMetrics back to D365. Default: false. |
WRITE_LABOR_TICKETS | No | Enables ShopPulse-Driven mode and writes MachineMetrics labor data back to D365. Set to true to enable. Default: false. Requires the service account to have write access to the journal entity. |
| Job or Operation Journals | No | Whether to use job journals or operation journals when writing to D365. Options: job, operation. |
D365_ROUTE_JOURNAL_NAME | No | The JournalName value used when creating route card journal entries. Default: Route. Set this if your D365 Production Control uses a different journal name (e.g. RC). An incorrect value assigns writeback lines to the wrong journal. Confirm the journal name and posting process with your D365 administrator. |
| D365 Reconciliation Window | No | How far back the reconciliation sweep looks. Accepts values like 1y, 6m, 90d. Default: 1y. |
Scheduler
| Label | Required | Description |
|---|---|---|
FROM_ERP_INTERVAL | No | Inbound interval. Falls back to POLL_INTERVAL, then the SDK default of 5 min. Confirm the deployed value in Edge Services. |
TO_ERP_INTERVAL | No | Outbound interval. SDK default: 5 min. Applies when write-back is enabled. Confirm the deployed value in Edge Services. |
Logging and Diagnostics
| Label | Required | Description |
|---|---|---|
| Log Level | No | Log verbosity. Options: error, warn, info, debug. Default: info. Use debug during initial setup. |
| MM API Retry Attempts | No | Retries for failed MachineMetrics API calls. Default: 3. |
| MM API Timeout Seconds | No | Timeout in seconds for MachineMetrics API calls. Default: 30. |
Sync Behavior
Outbound sync processes closed labor tickets only and requires WRITE_LABOR_TICKETS=true. It writes journal lines to RouteCardProductionJournalEntries, or to JobCardProductionJournalEntries in job scheduling mode. If a job card request returns HTTP 400, the connector falls back to the route card entity.
The current update handler does not PATCH previously written journal lines. Coordinate corrections with your D365 administrator. Confirm how journals are posted in your environment before go-live.
Inbound data follows the configured production or batch order source and site/legal entity settings. Use the Scheduler settings for the configured intervals.
Troubleshooting
| Symptom | Likely Cause | Resolution |
|---|---|---|
| Work orders not appearing | D365 query returns no results | Verify D365 Default Site Id and D365 Default Data Area Id match actual D365 values. Set Log Level to debug for OData query details. |
| 403 errors in logs | Service account missing permissions | Confirm all required Data Services privileges are assigned to the service account. See Option B in Step 2. |
| Authentication failure | Invalid credentials or expired secret | Verify Tenant ID, Client ID, and Client Secret. Regenerate the client secret in Azure if expired. |
| Labor tickets not writing to D365 | Write-back not enabled or missing permissions | Confirm Write LTs to D365 is true and the service account has the Maintain privilege on RouteCardProductionJournalEntries. |
For additional help, contact MachineMetrics Support.
FAQ
Does D365 F&O include API access, or is that a separate license? API access is included with all D365 F&O cloud subscriptions. The OData REST API is a core platform feature.
What if the environment is on-premise? This connector requires cloud-hosted D365 F&O. On-premise Dynamics AX is not supported.
How long does the client secret last? The expiration is set during creation in Azure. 12–24 months is recommended. When a secret expires, create a new one in Azure and update the D365 Client Secret value in the connector configuration.
Can the same app registration be used for sandbox and production? It is possible, but separate registrations are recommended to keep credentials independent and simplify rotation.
Related Guides
Getting Help
Contact your Solution Delivery Manager (SDM) during onboarding or MachineMetrics Support for technical issues after onboarding. For ERP permissions and posting, work with your ERP administrator.