New Payhawk offices in Stockholm and Warsaw | Learn more

Configuring roles and permissions for the Payhawk-D365 Finance integration

Prev Next

Before you connect Payhawk to Microsoft Dynamics 365 Finance, make sure the following access and settings are in place.

What you need

  • Administrator access to Microsoft Lifecycle Services (LCS), to install the Payhawk extension on your Microsoft Dynamics 365 Finance environment. For more information, see installing the Payhawk extension.

  • A Microsoft Dynamics 365 Finance account with administrator access. This account signs in when you connect the two systems. The System administrator role is the simplest option, but a custom role that covers the Payhawk extension also works.

Azure and Microsoft Entra ID

Your IT team doesn't need to create or manage an app registration in your Azure tenant. Payhawk connects through its own Azure application, which Payhawk registers and manages in its own Microsoft Entra tenant.

Your IT team doesn't need to:

  • Create an app registration

  • Generate a client secret or certificate

  • Configure redirect URIs or API permissions

  • Register an application under System administration > Setup > Microsoft Entra applications in Microsoft Dynamics 365 Finance

If your tenant doesn't allow users to consent to third-party apps, Microsoft shows an approval request when the account signs in during the connection. A Microsoft Entra administrator approves it once. No other Azure configuration is needed.

Technical details for your IT team:

  • Application owner - Payhawk, registered and managed in Payhawk's own Microsoft Entra tenant

  • Authority - https://login.microsoftonline.com/common/oauth2/v2.0

  • Grant type - OAuth 2.0 authorization code, delegated (on behalf of the signed-in user)

  • Requested scopes - https://<your environment URL>/.default and offline_access

  • Redirect URI - https://microsoft-dynamics-fo-adapter.payhawk.com/callback

  • Data Payhawk can access - Only your Microsoft Dynamics 365 Finance environment, within the security roles of the account that signs in

  • Credentials stored by Payhawk - OAuth tokens only, no passwords

The integration account

Payhawk works in Microsoft Dynamics 365 Finance as the account that signs in during the connection. Every record Payhawk creates is traceable to that account in the Microsoft Dynamics 365 Finance audit trail.

We recommend a dedicated account, for example payhawk.integration@yourcompany.com, instead of a person's account, so the connection keeps working when people leave or change roles. The account must:

  • Exist in your Microsoft Entra ID.

  • Be enabled in Microsoft Dynamics 365 Finance with access to the legal entity you connect.

  • Be able to complete an interactive sign-in once.

Payhawk uses the account to:

  • Access financial dimensions

  • Access tax rates

  • Access vendors

  • Access GL codes/projects

  • Create journal headers

  • Create journal entries

  • Add attachments

If the account is disabled, its password is reset, or its sessions are revoked, the connection stops. To restore it, a Payhawk administrator reconnects from Settings > Integrations.

After the first sign-in, Payhawk renews its access in the background from its own servers. Conditional Access policies that require repeated MFA, a short sign-in frequency, a compliant device, or a trusted network stop these renewals and break the connection. Exclude the integration account from these policies, or allow the Payhawk application in them.

Settings in Microsoft Dynamics 365 Finance

The journals and posting settings aren't part of the Payhawk connection wizard. You set them on the Payhawk Parameters page in Microsoft Dynamics 365 Finance, which is installed with the extension:

  • Vendor payment journal

  • General and ledger journals

  • Deposit journal

  • Default payment method

  • Fee account

  • Tax group

  • Bank transaction types

You can connect the two systems before you fill them in, but exports to Microsoft Dynamics 365 Finance fail until you do. For more information, see configuring the Payhawk extension.

Before you connect

  • The Payhawk extension is installed, and the Payhawk Parameters page opens and is filled in.

  • The person with Microsoft Dynamics 365 Finance administrator access is available to sign in during the connection.

  • A Payhawk Administrator is available to run the connection. This can be the same person.

  • You have the URL of your Microsoft Dynamics 365 Finance environment. It ends in .dynamics.com, for example contoso.operations.dynamics.com.

  • Your finance team has chosen the financial dimension structure.

For the setup during the connection, you will have to:

  1. Authenticate.

  2. Map accounts.

  3. Do the initial data sync.

Next steps