Episode Details

You’ve got D365 running, and management drops the classic: “Integrate it with that tool over there.” Sounds simple, right? Except misconfigured permissions create compliance headaches, and using the wrong entity can grind processes to a halt. That’s why today’s survival guide is blunt and step‑by‑step. Here’s the roadmap: one, how to authenticate with Azure AD and actually get a token. Two, how to query F&O data cleanly with OData endpoints. Three, when to lean on custom services—and how to guard them so they don’t blow up on you later. We’ll register an app, grab a token, make a call, and set guardrails you can defend to both your CISO and your sanity. Integration doesn’t need duct tape—it needs the right handshake. And that’s where we start.Meet the F&O API: The 'Secret Handshake'Meet the Finance and Operations API: the so‑called “secret handshake.” It isn’t black magic, and you don’t need to sacrifice a weekend to make it work. Think of it less like wizardry and more like knowing the right knock to get through the right door. The point is simple: F&O won’t let you crawl in through the windows, but it will let you through the official entrance if you know the rules.A lot of admins still imagine Finance and Operations as some fortress with thick walls and scary guards. Fine, sure—but the real story is simpler. Inside that fortress, Microsoft already built you a proper door: the REST API. It’s not a hidden side alley or a developer toy. It’s the documented, supported way in. Finance and Operations exposes business data through OData/REST endpoints—customers, vendors, invoices, purchase orders—the bread and butter of your ERP. That’s the integration path Microsoft wants you to take, and it’s the safest one you’ve got.Where do things go wrong? It usually happens when teams try to skip the API. You’ve seen it: production‑pointed SQL scripts hammered straight at the database, screen scraping tools chewing through UI clicks at robot speed, or shadow integrations that run without anyone in IT admitting they exist. Those shortcuts might get you quick results once or twice, but they’re fragile. They break the second Microsoft pushes a hotfix, and when they break, the fallout usually hits compliance, audit, or finance all at once. In contrast, the API endpoints give you a structured, predictable interface that stays supported through updates.Here’s the mindset shift: Microsoft didn’t build the F&O API as a “bonus” feature. This API is the playbook. If you call it, you’re supported, documented, and when issues come up, Microsoft support will help you. If you bypass it, you’re basically duct‑taping integrations together with no safety net. And when that duct tape peels off—as it always does—you’re left explaining missing transactions to your boss at month‑end close. Nobody wants that.Now, let’s get into what the API actually looks like. It’s RESTful, so you’ll be working with standard HTTP verbs: GET, POST, PATCH, DELETE. The structure underneath is OData, which basically means you’re querying structured endpoints in a consistent way. Every major business entity you care about—customers, vendors, invoices—has its shelf. You don’t rummage through piles of exports or scrape whatever the UI happens to show that day. You call “/Customers” and you get structured data back. Predictable. Repeatable. No surprises.Think of OData like a menu in a diner. It’s not about sneaking into the kitchen and stirring random pots. The menu lists every dish, the ingredients are standardized, and when you order “Invoice Lines,” you get exactly that—every single time. That consistency is what makes automation and integration even possible. You’re not gambling on screen layouts or guessing which Excel column still holds the vendor ID. You’re just asking the system the right way, and it answers the right way.But OData isn’t your only option. Sometimes, you need more than an entity list—you need business logic or steps that OData doesn’t expose directly. That’s whe