Vault Platform for Dynamics 365 Business Central

Complete integration guide for Business Central consultants and developers. Install, configure, and extend VaultPDF with on-demand PDF generation, SharePoint storage, e-signature workflows, and audit trails.

Overview

Vault Platform extends Microsoft Dynamics 365 Business Central with enterprise-grade document capabilities. Business Central comes pre-configured with ready-to-use templates for common documents (invoices, orders, remittances). All templates are fully customizable - no development required. Installation and system settings are pre-configured for immediate import, so you can generate your first PDF in minutes.

Generate formatted PDFs from any Business Central record, automatically store them in SharePoint, optionally route them through workflow engines for approvals and e-signing, and maintain searchable audit trails of every document lifecycle event.

Pre-built Templates Ready to Go

Business Central ships with professionally-designed, production-ready templates in the VaultPacks library. No custom development needed - import and use immediately, or customize to match your brand.

Key characteristics:

Schema-driven rendering - Templates are JSON definitions that map Business Central data to PDF layouts -- In-tenant processing - All PDF generation runs inside the customer's Azure environment; payloads never leave the customer's Microsoft 365 tenant
SharePoint integration - Documents store natively in SharePoint via Microsoft Graph
Flexible workflows - Sequential or parallel approval and e-signature routing with audit capture
Immutable audit records - Every document event (generation, approval, signature, delivery) logs to an integrity-validated archive

Architecture Overview

The Vault Platform for Business Central uses a single-tenant architecture. Each Business Central environment connects directly to its organization's Vault Dispatcher deployment hosted within the customer's Azure subscription. All document generation, governance workflows, secure delivery, and lifecycle processing occur within infrastructure controlled by the customer.

Microsoft Dynamics 365 Business Central
       ↓
   Vault AL Extension
       ↓
   JWT Token Issuance
   (Entra App Registration)
       ↓
   Function Key + JWT Validation
       ↓
Customer-hosted Vault Dispatcher Function App
       ↓
Vault Platform Services

   ├─ VaultPDF
   │  ├─ Document Generation
   │  ├─ PDF/UA Accessibility
   │  ├─ Structured Annexes
   │  └─ Evidence Packages
   │
   ├─ VaultWorkflow
   │  ├─ Approval Workflows
   │  ├─ Validation Rules
   │  ├─ Exception Reviews
   │  └─ Governance Routing
   │
   ├─ VaultDispatch
   │  ├─ Secure Delivery
   │  ├─ Recipient Verification
   │  ├─ Delivery Tracking
   │  └─ Confirmation Auditing
   │
   ├─ VaultESign
   │  ├─ Signature Requests
   │  ├─ Certificate Validation
   │  ├─ Attestations
   │  └─ Signing Evidence
   │
   └─ VaultLifecycle
    ├─ Activity Tracking
    ├─ Lifecycle Search
    ├─ Audit Evidence
    ├─ Compliance Reporting
    └─ Governance Analytics

Dynamics 365 Business Central remains the authoritative transaction system. Vault Platform provides document lifecycle governance, validation workflows, secure delivery, audit evidence, and compliance services without taking ownership of business transactions.

Capabilities at a Glance

Capability	Description	Use Case
PDF Generation	Render formatted PDFs from any Business Central document using configurable templates	Invoices, orders, reports, agreements
SharePoint Storage	Automatically upload generated PDFs and JSON payloads to SharePoint for centralized document management	Compliance document retention, team collaboration
E-Signature	Route documents to signers sequentially or in parallel through the Vault Platform engine	Contracts, approval forms, purchase agreements
Approval Workflows	Trigger validation workflows with configurable enforcement (validate or block processing)	Purchase requisitions, expense reports, policy updates
Distribution	Send documents to configurable recipient lists with delivery tracking and access logs	Customer statements, vendor remittances, partner communications
Batch Processing	Generate multiple PDFs in a single operation by record, group, or combined array	Monthly statement cycles, remittance runs, bulk document distribution

Prerequisites

Before installation, ensure the following are in place:

Environment Requirements

Business Central version 2024 Wave 1 (v27) or later
Microsoft 365 tenant with Azure AD
Azure subscription for Microsoft Graph API access
SharePoint site with at least one document library for PDF output

Required Credentials and Configuration

Prepare the following before starting installation:

Azure AD App Registration
- Application (client) ID
- Client secret (Certificates & Secrets)
- API permissions: Sites.ReadWrite.All with admin consent
Microsoft Graph Identifiers
- Tenant ID (Azure AD Overview)
- SharePoint site ID (via Microsoft Graph Explorer)
- Drive IDs for output and template libraries
Business Central Setup
- SUPER or VPDF-ADMIN permission set assigned to the setup user
- Deployment of the VaultPDF Dispatcher (Azure Function)

Critical Dependency

The Dispatcher is a separately deployed Azure Function hosted by VaultPDF. It is not included in the Business Central extension and must be provisioned before you can generate PDFs. Contact [email protected] to arrange deployment and receive connection credentials.

Installation

Install the VaultPDF Extension

Search for Extension Management in the Business Central Tell Me bar (Alt+Q).

Click Manage → Upload Extension and select the VaultPDF extension .app file.

Alternatively, search for VaultPDF on AppSource if available in your region and install directly.

After installation completes, refresh your browser. You will see new VaultPDF actions appear on supported document types: Sales Orders, Purchase Orders, Sales Invoices, Purchase Invoices, and more.

No Page Restart Required

Business Central loads the extension immediately. No server restart is needed. The new action bar items appear instantly after the browser refresh.

Assign Permission Sets

Navigate to Users in Business Central and open each user's record.

In the User Permission Sets section, add the appropriate permission set:

Permission Set	Purpose
`VPDF-USER`	Users who generate documents or open generated PDFs
`VPDF-REVIEWER`	Users who need to trigger workflow status synchronization
`VPDF-ADMIN`	Consultants and administrators managing templates, settings, and system configuration

Assign permissions before the user's first visit to any VaultPDF page. Users without assigned permissions receive a clear error message with remediation steps.

Permission Requirement

Missing permission sets are the most common cause of access errors during initial setup. Verify all users have the required permission set before they access VaultPDF features.

Verify Extension Status

Search for Extension Management and locate the VaultPDF extension by Refract Logic.Confirm its status is Installed.

Search for View Permission Sets to verify that VPDF-USER, VPDF-REVIEWER, and VPDF-ADMIN are all present.

This confirms the extension is correctly registered in the customer's Business Central environment and ready for configuration.

Initial System Setup

All connection settings, credentials, and configuration are managed through the VaultPDF System Settings page. This single page is the customer's control center for the entire Vault Platform integration.

Access System Settings

Search for VaultPDF System Settings in the Tell Me bar. You will see page open with an empty list.

Initialize Default Keys

Click the Initialize Default Keys action in the action bar.

This creates all 15 required setting keys with empty values and displays them on the page, ready to populate.

Safe to Rerun

This action is idempotent. Running it multiple times only inserts missing keys and never overwrites values you have already entered. Use it safely during upgrades or to recover accidentally deleted keys.

Configure Microsoft Graph and SharePoint

For each setting key in the table below, click the row, enter the value in the Setting Value column, and click OK.

Fields marked with Is Secret = Yes are stored in Business Central Isolated Storage and never displayed after saving.

Key	Where to Find It
`VAULTPDF_TENANT_ID`	Azure Portal → Azure Active Directory → Overview → Tenant ID
`VAULTPDF_CLIENT_ID`	Azure Portal → App Registrations → the customer's App → Application (client) ID
`VAULTPDF_CLIENT_SECRET`	Azure Portal → App Registrations → the customer's App → Certificates & Secrets (create if missing) (Is Secret)
`VAULTPDF_GRAPH_SITE_ID`	Microsoft Graph Explorer: `GET /sites/{hostname}:/sites/{siteName}` → copy `id` field
`VAULTPDF_GRAPH_DRIVE_ID`	Microsoft Graph Explorer: `GET /sites/{siteId}/drives` → copy the `id` of the customer's output document library
`VAULTPDF_SITE_URL`	The customer's SharePoint site base URL, e.g. `https://yourorg.sharepoint.com/sites/Finance`
`VAULTPDF_GRAPH_TEMPLATES_DRIVE_ID`	Drive ID of the SharePoint library containing VaultPDF templates
`VAULTPDF_SOURCE_SYSTEM`	Root folder name in the templates drive, e.g. `RefractLogic` or `BusinessCentral`

Azure AD App Permissions

The App Registration must have Sites.ReadWrite.All permission granted in Azure AD and admin-consented by the customer's tenant administrator. Without this consent, SharePoint uploads fail with a 403 Forbidden error.

Configure the Dispatcher Connection

The Dispatcher is the remote Azure Function that processes document payloads and renders PDFs. Populate these keys with the credentials provided by Refract Logic:

Key	Description
`VAULTPDF_DISPATCHER_BASE_URL`	Azure Function base URL, e.g. `https://func-vaultpdf.azurewebsites.net/api`
`VAULTPDF_DISPATCHER_CODE`	Azure Function host key (appended as `?code=` in every request)
`VAULTPDF_DISPATCHER_TENANT_ID`	Azure AD Tenant ID for the Dispatcher's OAuth token request
`VAULTPDF_DISPATCHER_CLIENT_ID`	Azure AD Client ID for the Dispatcher's OAuth token
`VAULTPDF_DISPATCHER_CLIENT_SECRET`	Azure AD Client Secret for the Dispatcher's OAuth token (Is Secret)
`VAULTPDF_DISPATCHER_SCOPE`	OAuth scope, e.g. `api://your-dispatcher-app-id/.default`
`VAULTPDF_PORTAL_URL`	Vault Platform Lifecycle Portal URL, e.g. `https://portal.vaultpdf.com`

Test System Connectivity

Click the System Status Check action in the action bar.

Business Central calls the Dispatcher with an empty payload and downloads a VaultPDF_StatusReport.pdf. If the PDF opens successfully, connectivity to the Dispatcher is confirmed and healthy.

If the check fails:

Review the error dialog for the HTTP status code and response body
Verify the VAULTPDF_DISPATCHER_BASE_URL and VAULTPDF_DISPATCHER_CODE are correct
Confirm the VAULTPDF_DISPATCHER_CLIENT_SECRET has not expired
Check that the customer's Azure AD tenant can reach the Dispatcher Azure Function

Run this check after every change to Dispatcher settings to confirm the connection remains healthy.

Validation Best Practice

Make the System Status Check part of your weekly maintenance checklist, especially before running batch operations or critical document generation cycles.

Import Pre-configured Settings

A pre-configured JSON file is included with your deployment package, containing all required system settings. Click Import from JSON and select the file.

This bulk-loads all key/value pairs in a single step, including encrypted secrets. All settings are immediately ready to use - no additional manual configuration required.

Configure Batch Processing (optional)

The following key controls when large batches are automatically offered as background jobs instead of running synchronously in your browser session.

Key	Default	Description
`VAULTPDF_BATCH_ASYNC_THRESHOLD`	`500`	Minimum record count at which VaultPDF prompts the user to run the batch as a background Job Queue entry. Set to a lower value (e.g. `50`) for faster interactivity, or higher (e.g. `2000`) if you prefer synchronous execution for larger sets.

This key is created with a default value of 500 by Initialize Default Keys - you only need to edit it if you want a different threshold. The setting is not a secret and is safe to share.

Template Configuration

Templates are the bridge between Business Central data and PDF output. A template defines which fields map to which PDF regions, how data is formatted, and how the resulting document is routed (e.g., for approval or signature).

Create the customer's first template

Navigate to VaultPDF Templates in Business Central.

Click New to open the Template Card with sections for template identity and line items.

Template Header:

Template ID - Unique identifier, e.g. INV-STANDARD
Description - Human-readable name
Document Type - Maps to the source Business Central table (e.g., Sales Invoice)
Lines - Field mappings between BC and the template schema

Click the Settings action to configure routing, approvals, e-signatures, and distribution.

Template Settings Overview

Template Settings control how the generated PDF is handled after creation. Access settings from the Template Card or Template List.

Default: Template

Value	Purpose
`Template`	Standard PDF generation with no workflow routing. Use for customer invoices, remittance advice, and informational documents
`Workflow`	Triggers a Vault Platform approval or e-signature workflow after PDF generation. Displays additional Workflow configuration options

Change this setting to Workflow only if you need the generated PDF to pass through an approval or e-sign gateway before delivery.

Default: Standard

Dispatch Mode controls whether one PDF is generated or multiple PDFs are created from a batch of records.

Mode	Behavior	Use Case
`Standard`	One PDF for the current record	Individual invoice, order, or report
`Per Group`	One PDF per distinct value of Group By Field (e.g., one remittance per vendor)	Remittance runs, payment grouping by payee
`Per Record`	One PDF per source record in the filtered set	Batch invoicing, individual customer statements
`Single Array`	All records combined into one PDF	Combined quarterly reports, consolidated statements
`Grouped Array`	Records grouped into arrays within one PDF with repeating headers	Multi-vendor purchase order summaries

Group By Field Required

If you select Dispatch Mode = Per Group, you must set the Group By Field ID field, or the Dispatcher fails at runtime with an error. This field specifies which Business Central field determines the grouping boundary.

Enable the eSign Enabled toggle to route the generated PDF to signers after creation.

Field	Description
eSign Mode	`Sequential` - signers sign one after another in slot order. `Parallel` - all signers receive simultaneously and can sign in any order
eSign Expiry (minutes)	Duration the signing link remains valid. `0` uses the Dispatcher default (10,080 minutes = 7 days)

Signers table:

Slot Index - Signing order (1, 2, 3...). Used in Sequential mode to enforce order
Role - e.g. Signer, Witness, Approver (informational only in the signing portal)
Email - Signer's email address. Supports field token substitution
Name Prefill - Auto-populates the signer's name in the signing portal

Visible only when Template Type = Workflow.

Enable the Workflow Enabled toggle to activate Vault Platform workflow routing.

Field	Description
Workflow Enforcement Mode	`None` - informational only. `Validate` - warn if conditions unmet. `Block` - prevent processing if conditions unmet
Workflow Message	Message sent to workflow recipients. Supports field token substitution

Workflow Recipients table:

Email - Recipient's email address
Display Name - Name shown in the workflow notification

Default message (auto-filled):

You have been invited to review and approve a document.
Document Reference: [No.] field.
Please complete the required action.
Do not forward or share this invitation.

Configure how the generated PDF is delivered to recipients.

Watermark:

Override Watermark - Print a watermark on all PDFs from this template
Watermark Text - The text to display, e.g. CONFIDENTIAL, DRAFT, APPROVED

Distribution:

Distribution Enabled - Activate document delivery
Distribution Approver Email - Approver email (supports field token substitution)

Delivery Recipients table:

Email - Recipient email address
Display Name - Name shown in delivery notifications

Token Substitution

Field tokens are resolved at dispatch time from the source Business Central record. Use the exact Business Central field name, e.g. No., Sell-to Customer Name, or custom fields like approverEmail.

Unresolvable tokens are left as literal text in the output.

Batch dispatch is triggered the same way - through the Template Gallery - but the selected template must have a non-Standard Dispatch Mode. VaultPDF will iterate over the record set according to the mode:

Per Group - groups records by the configured field, one PDF per unique value
Per Record - one PDF per record in the filtered set
Single Array / Grouped Array - combines records into a single PDF payload

Background Execution (Job Queue)

When the number of records to process meets or exceeds the batch async threshold (default: 500, configurable via VAULTPDF_BATCH_ASYNC_THRESHOLD), VaultPDF prompts:

"This batch contains X records. Run it in the background so you can continue working?"

If you confirm, VaultPDF:

Creates a VaultPDF Batch Job Entry with status Queued, capturing the template, doc number, and calling context.
Enqueues a Job Queue Entry targeting VaultPDF Batch Job Runner.
Displays a confirmation: "Batch job {N} queued. Check progress in the VaultPDF Batch Jobs page."

The Job Queue runner transitions the entry through these statuses:

Status	Meaning
`Queued`	Entry created; waiting for a free Job Queue worker.
`Running`	The batch dispatcher is actively processing records.
`Completed`	All records processed; Blob Path and Correlation ID are stored on the entry.
`Failed`	An unhandled error stopped the run; Status Message contains the error detail.

When the job finishes, BC sends a notification: "VaultPDF batch job {N} ({TemplateCode}) completed successfully." You can also open VaultPDF Batch Jobs from the Tell Me bar at any time to monitor or review past runs.

If you decline the background prompt, the batch runs synchronously in your current browser session. This is fine for smaller sets but may time out for very large record counts.

Batch operations currently show a single success notification regardless of partial failures. Check the Upload Log (System Settings → View Upload Log) to see the status of each generated document.

Batch operations for Single Array and Grouped Array modes are recorded automatically in the VaultPDF Batch Log Entries page (System Settings → View Batch Log). See Batch Render Log below.

Resetting Template Configuration

The Clear Settings action on the Template Settings page resets all fields to defaults and deletes all signers, recipients, and workflow recipients. Use this to start a template's routing configuration from scratch without deleting the template itself.

Processing Documents

Once templates and settings are configured, end users and batch processes generate documents using the VaultPDF actions on standard Business Central pages.

Manual Document Processing

Open any supported Business Central document (Sales Order, Purchase Invoice, Sales Invoice, etc.)

In the action bar, locate the VaultPDF action group and click Process Document

The Template Gallery modal opens. Select the template you want to use and click Generate

VaultPDF exports the Business Central record as JSON, uploads it to SharePoint, calls the Dispatcher, and returns a success notification or error message

Click Open Document in the VaultPDF action group to download and open the generated PDF in your browser

For documents in an active workflow, use the Sync Workflow Status action to refresh the workflow state from the Vault Platform engine. This action requires the VPDF-REVIEWER permission set or higher.

Batch Document Operations

Batch processing is triggered the same way as manual processing, but you must first configure a non-Standard Dispatch Mode on your template.

VaultPDF iterates over the record set according to the mode:

Per Group - Groups records by the configured field and generates one PDF per unique group value
Per Record - Generates one PDF per record in the filtered set
Single Array/Grouped Array - Combines all records into a single PDF payload

When the record count meets or exceeds the batch async threshold (default: 500), VaultPDF offers to run the batch as a background Job Queue entry so you can continue working while it processes. See the Batch Operations tab in Template Configuration above for full details on background execution, job statuses, and monitoring.

Batch Delivery Tracking

Batch operations show a single success notification regardless of individual operation outcomes. To review the detailed status of each generated document (success, failure, retry history), open System Settings and click View Upload Log.

Batch Render Log

The VaultPDF Batch Log Entries page records every successful batch PDF render for Single Array and Grouped Array dispatch modes. It gives finance and ops teams a permanent, searchable audit trail of what was generated, when, and by whom — without needing to open the Job Queue or Batch Jobs pages.

Access it via VaultPDF System Settings → View Batch Log, or search for VaultPDF Batch Log Entries in Tell Me.

What gets logged

A new entry is inserted automatically each time a batch render completes successfully. Only Single Array and Grouped Array dispatch modes write to this log — these are the modes that combine multiple records into a single array payload and dispatch it as one batch render request to the Vault Platform engine.

Per Group and Per Record modes are not logged here. Each render in those modes is a discrete, single-document request and is already traceable through standard Record Links on the source document.

Field	Description
Log Date/Time	When the batch render completed
Template Code	The VaultPDF template code used (e.g. `PAYMNT_ADV`)
Journal Template Name	The BC journal template name from the batch context (e.g. `PAYMENT`, `CASHRCPT`). Blank for non-journal batch types such as Customer Statements.
Batch Name	The journal batch name or document identifier passed when the batch was triggered (e.g. `DEFAULT`, `MARCH`)
User ID	For synchronous runs: the BC user who clicked Generate. For background (Job Queue) runs: the user who originally submitted the job — not the Job Queue service account.
Vault Lifecycle Workspace	Clickable link that opens the Vault Platform Lifecycle portal filtered to this batch. Only shown when `VAULTPDF_PORTAL_URL` is configured and the dispatcher returned a `Batch ID`.

Additional fields — Correlation ID, Batch ID, Blob Path, and Dispatch Mode — are stored in the underlying table (VaultPDF Batch Log Entry) for use by extensions or custom reports. They are intentionally hidden from the default page view to keep the list focused.

Vault Lifecycle Workspace link

When the VAULTPDF_PORTAL_URL system setting is populated, each log entry shows a Vault Lifecycle Workspace link. Clicking it opens:

{VAULTPDF_PORTAL_URL}?batchId={Batch ID}

This navigates directly to the batch's document set in the Vault Platform portal — useful for reviewing render status, downloading PDFs, or checking workflow state for the entire batch in one view.

The link is computed at display time from the stored Batch ID and the current VAULTPDF_PORTAL_URL setting. If the portal URL is not configured, the column is blank for that row.

Synchronous vs. background logging

The log entry is inserted in both execution paths:

Execution path	When the entry is written
Synchronous (inline)	Immediately after the batch render succeeds, while the Template Gallery is still open
Background (Job Queue)	After the Job Queue runner marks the Batch Job Entry as `Completed`

In both cases, User ID reflects the person who triggered the batch, not any background service account.

Next Steps

Pre-built Templates & VaultPacks - Browse professionally-designed templates ready to import
Developer Guide - Extend VaultPDF with custom AL code, events, and enums (advanced)
Troubleshooting Guide - Common issues and solutions

Vault Platform for Dynamics 365 Business Central

On this page