Troubleshoot Business Central authentication issues during expense export

Perk checks your Business Central connection before every expense export runs. If the connection is invalid, the export is blocked immediately with a clear, actionable error message instead of failing silently partway through. This article explains the reasons authentication can fail and how to resolve each one.

Only account admins can perform this task.

When and where Perk shows authentication errors

Perk runs the credential check before the export starts, so the error surfaces immediately, before any documents are sent to Business Central, rather than after a failed attempt.

Manual exports — the error appears as a toast notification at the moment you trigger the export. The notification includes the specific error message so you can act on it right away.
Automatic exports — the error appears directly on the expense itself, since there's no manual trigger moment to attach a toast to. Check the expense record to see the authentication error and next steps.

In both cases, the export is blocked entirely — no partial or silent failures — and the message shown matches one of the causes below. This check validates authentication only. It does not detect:

Incorrect company name, web service name, instance, or base URL.
Errors after successful authentication, such as Azure AD to Business Central API failures.
Master data mapping errors.

These issues surface as failed export documents during the export itself.

Note: All of these issues produce failed export documents in the usual way and are not affected by this change.

Missing credentials

Why it happens: The Client ID or Client Secret for the Business Central connection have never been saved in Perk.

What to do: Go to Settings Integrations Business Central and complete the credentials setup by entering the Client ID and Client Secret.

Missing Azure AD tenant configuration

Why it happens:

Cloud Business Central: the Tenant ID field is empty in the ERP configuration.
On-premises Business Central: the Directory ID is missing from the credentials.

What to do:

Cloud: go to Settings Integrations Business Central [API] and verify the Tenant ID in the integration settings.
On-premises: go to Settings Integrations Business Central [API] and verify the Directory ID in the credentials section.

Credentials rejected by Azure AD

Why it happens: Azure AD rejected the credentials — the Client ID or Client Secret may be wrong or expired, or the app registration in Azure AD may have been deleted. The error message includes the Azure AD error code and description.

What to do:

Review the Azure AD error code shown in the message.
Go to Settings Integrations Business Central and reconnect using valid credentials.
If the app registration has been deleted, create a new one in Azure AD and update the credentials in Perk.

Network or firewall blocking Microsoft's login service

Why it happens: Perk can't reach login.microsoftonline.com — a firewall or DNS configuration is blocking the connection. The error shows the POSIX error code (for example, ECONNREFUSED or ETIMEDOUT) and the blocked endpoint.

What to do: Contact your IT or network administrator and share the error code and endpoint shown in the message. Make sure login.microsoftonline.com is reachable.

Unexpected failure during the credential check

Why it happens: An unexpected error occurred during the check — for example, a configuration parsing error or a runtime exception. The raw error message is shown.

What to do: Note the full error message and contact support. Business Central configuration issues (such as company name or web service name) aren't caught by this check and may surface separately as failed export documents.