> ## Documentation Index > Fetch the complete documentation index at: https://docs.consile.ai/llms.txt > Use this file to discover all available pages before exploring further. # Connect Business Central > Approve Consile at Microsoft with your work account. Microsoft only offers a consent that covers both reading and writing, so Consile enforces read-only itself. The access is renewed automatically and can be revoked. *[Læs siden på dansk](https://docs.consile.ai/connect/forbind-business-central.md)* You connect Business Central by logging in at Microsoft with your work or school account and approving Consile. Consile stores the resulting access encrypted per customer. Your AI never sees the access itself, only answers to your questions. Business Central is in early access. See [Business Central](https://docs.consile.ai/en/connectors/business-central.md) for what the connector can do today. > [!NOTE] > > You need an active Business Central subscription in the > [portal](https://app.consile.ai), or the system must be included in your plan > ([the free edition](https://docs.consile.ai/en/portal/free-edition.md) or > [the Consile Studio membership](https://docs.consile.ai/en/portal/membership.md)). You must log in with a > Microsoft work or school account that has a Business Central licence and access > to the companies your AI should be able to read. It must be Business Central > online. On-premises is not supported. Your AI > ([Claude](https://docs.consile.ai/en/connect/connect-claude.md) or [ChatGPT](https://docs.consile.ai/en/connect/connect-chatgpt.md)) > can be added before or after. > [!NOTE] > > The connection applies to your whole Consile account. All users with access to > Business Central in Consile read through the Microsoft user that is connected, > and so see the same companies and data, even if a colleague connected it. Anyone > on the team can connect an agreement that is not connected yet. Only an > administrator can reconnect it or disconnect it, because that changes the > connection for everyone. If an administrator reconnects with a different > Microsoft account, it replaces the existing connection. ## Choose the right Business Central user The Microsoft user you log in with decides what your AI can see: the companies and data that user has access to in Business Central. Microsoft does not offer a pure read permission for Business Central, so technically the approval covers both reading and writing. Consile only reads, but we still recommend connecting with a Business Central user that only has read permissions. Then Business Central also limits the access to reading on its own side. Talk to your Business Central administrator if the user's permissions need to change before you connect. ## How to connect **1. Open the connector in the portal** Go to Business Central in the [portal](https://app.consile.ai). Click **Connect now** at the top of the page, or **Connect** next to the agreement on the **Connections** card. The portal calls each connection to the system an agreement. Right after the purchase, the **Connect Business Central** button on the **Subscription activated** page takes you to that page. If you have not accepted Consile's terms yet, you are asked to do so first. **2. Authorise access** In the **Connect Microsoft** step, the portal shows the two permissions Consile asks Microsoft for: `Financials.ReadWrite.All` and `offline_access`. Click **Authorise access**. You are sent to Microsoft's login. **3. Log in with your work account** Log in with the Microsoft work or school account that has access to Business Central. Microsoft refuses a login with a personal Microsoft account. **4. Confirm with Microsoft** Microsoft shows that Consile is asking for access to Business Central on your behalf and to keep that access. Confirm to continue. You are then sent back to the portal. > [!TIP] > > The portal shows **Business Central is connected**, and the agreement shows > as **Connected**. On the connector's page, the agreement is named after the > company and the environment, for example ` (Production)`. If > there are several companies, the environment and the number of companies are > used, for example `Production (3 companies)`. Your AI can now read your > Business Central data. If you have not already added the address > `https://mcp.consile.ai/business-central/mcp` in your AI, do it now. **5. Lock the connection to one company (optional)** The page also shows *The key reaches several companies. Choose the one this connection should be locked to, and every call keeps to it.* If you want your AI to work in only one company on this agreement, click **Choose company**. You choose in two steps: first the environment under *Choose environment*, for example Production or a sandbox environment, and then the company under *Choose company*. Click **Lock to this company**. This requires an administrator. If you do not want to lock, click **Go to connector**. Your AI then chooses the environment and company per question. See [Lock a connection to one company](https://docs.consile.ai/en/portal/company-lock.md). > [!NOTE] > > If your organization has limited which apps users may approve themselves at > Microsoft, Microsoft may require an administrator's approval before you can > continue. In that case, contact your Microsoft administrator, or write to > [support@consile.dk](mailto:support@consile.dk). > [!TIP] > > The connection is shared by the whole company, so colleagues do not have to > connect Business Central again. An administrator gives them access under > **Team**, and each colleague adds the address in their own AI and logs in with > their own Consile login. See [Team](https://docs.consile.ai/en/portal/team.md). ## What exactly am I approving? > **Read-only in Consile** > > Microsoft has no pure read permission for Business Central, so the permission > is called `Financials.ReadWrite.All`. Consile has no write tools for Business > Central and only sends read requests. `offline_access` gives the renewable > access that keeps the connection alive. > **Business Central only** > > The approval applies to Business Central, not to Outlook, Teams or other > Microsoft services. Apart from the access to Business Central and > `offline_access`, Consile only accepts Microsoft's standard login details > (`openid`, `profile`, `email`). If the approval contains other permissions, > the connection is refused. > **Encrypted per customer** > > Consile stores the access encrypted with a key that applies only to your > account, and never logs it. It is renewed automatically in the background. > **Your AI never sees it** > > Your AI is never given the access itself, only answers to your questions. ## The access is renewed, but the connection can stop Consile renews the access automatically, so you do not have to reconnect during normal use. The automatic renewal does not change a lock. > [!WARNING] > > If the renewal fails, or Microsoft refuses the access (for example because > Consile has been removed in your Microsoft organization), your AI is told that > the connection must be set up again from the Consile portal. The portal can > still show **Connected**, because the stored access is still there. How an administrator reconnects: * If the agreement says **Access revoked**, click **Reconnect**, and follow the steps above. * Otherwise: click the menu (the three dots) next to the agreement on the **Connections** card, choose **Disconnect**, and confirm with **Disconnect**. Then click **Connect**, and follow the steps above. * You can also ask your AI for a new connection link. Ask in the connector that belongs to the agreement (for example `business-central-2`), so the link connects exactly that agreement. > [!NOTE] > > If the agreement was locked to one company, the environment and company must be > chosen again after you have reconnected. After **Reconnect** or a link from your > AI, Consile refuses all calls on the agreement until an administrator has chosen > them. If you disconnected first, the lock is gone, and your AI can reach all of > the user's companies until the company has been chosen again. See > [After a new connection](https://docs.consile.ai/en/portal/company-lock.md#after-a-new-connection). > [!NOTE] > > If your AI is instead told that Business Central answered 403, the connected > user is missing a licence, a permission set or access to the company or the > environment. Reconnecting does not help. Ask a Business Central administrator to > give the user access. ## If the connection fails If the approval does not succeed, the portal shows **Connection was not completed** and a technical reason. The most common ones: * `token_exchange_failed`: Microsoft did not send back a valid approval, typically because you cancelled at Microsoft. Try again, and approve the access. * `unexpected_scope`: Microsoft did not grant access to Business Central, or the approval contained permissions other than the ones Consile asks for. Try again. * `no_refresh_token`: Microsoft did not return renewable access. Try again. * `state_expired`, `invalid_state` or `state_unknown_or_consumed`: more than 10 minutes passed, or the same approval was used twice (for example with the browser's back button). Start over in the portal. Click **Try again** to get back to the connector's page, and start over with **Connect now** or **Connect**. If that does not help, write to [support@consile.dk](mailto:support@consile.dk) and include the technical reason. ## Multiple Microsoft tenants and companies One agreement covers all the environments and companies in your Microsoft tenant (your organization at Microsoft) that the connected user has access to. There are two reasons to add another agreement: * **Another Microsoft tenant.** Connect the new agreement with a work account in the other tenant. * **One company per agreement.** Connect the new agreement with the same or another user in your tenant, and lock each agreement to its own company. Then each company has its own address in your AI, and your AI only reaches the company the agreement is locked to. A company can only be locked on one agreement at a time. **1. Add an agreement** Open Business Central in the portal. On the **Connections** card, an administrator clicks **Add agreement (224.50 kr/mo.)**. The agreement is added to the existing subscription and charged pro rata for the rest of the period. **2. Connect the agreement** When the new agreement is ready (typically after a few seconds), click **Connect** next to it and complete the steps above. If the agreement should apply to one company, lock it afterwards. **3. Add the address in your AI** Each agreement has its own address, for example `https://mcp.consile.ai/business-central-2/mcp`. Copy it from the card, and add it as an extra connector in your AI. If you connect an agreement in a tenant that another agreement is already connected to, both agreements keep their connection. The page after the connection says *Note: The same account is already connected as another portal, and that portal is confined to one company, so we left it alone. This portal is connected and works, but stays unnamed in the list because the two portals share an account.* The word portal here means agreement, and the message also appears when the other agreement is not locked. The new agreement shows as, for example, **Agreement 2**. Lock each agreement to its own company, and the company appears under the name as *Locked to \*. Under [the Consile Studio membership](https://docs.consile.ai/en/portal/membership.md#one-more-agreement-in-a-system) there is no button to add an agreement. Instead the card says *The membership covers this system. One more company costs full price under the membership, and we will set it up for you if you write to us.* An administrator removes an agreement with the menu next to it: choose **Remove the agreement**, and confirm with **Remove agreement**. If you remove an agreement that is not the last one, the last agreement moves up into the free slot and takes its address (for example `https://mcp.consile.ai/business-central-2/mcp` instead of `https://mcp.consile.ai/business-central-3/mcp`). You must update the address in your AI. Without a lock, the agreement keeps working. If it was locked, the environment and company must be chosen again before it answers. You remove the last agreement by cancelling the subscription under **Subscription**. ## Revoke access You can remove the access again at any time: * **In the portal:** an administrator clicks the menu (the three dots) next to the agreement on the **Connections** card, chooses **Disconnect** and confirms with **Disconnect**. The stored access is deleted at Consile right away, and any lock disappears. The subscription continues until an administrator cancels it under **Subscription**. If you have several agreements, an administrator can also remove an agreement entirely with **Remove the agreement**. Its access is then deleted too. * **At Microsoft:** the approval stays in your Microsoft organization until you remove it yourselves. If you also want to remove it, an administrator does so under **Enterprise apps** in the Microsoft Entra admin center. Shortly after, the connector stops working, but the portal can still show it as **Connected** until you disconnect it in the portal. * **When the subscription ends:** if you cancel Business Central under **Subscription**, Consile automatically deletes the stored access when the subscription ends. If a payment is only late, the tools do not work in the meantime, but the stored access is kept, so the connection works again without a new approval once the payment is in place. More about data processing in [Security & data](https://docs.consile.ai/en/essentials/security-and-data.md). This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.