How to add WhatsApp to Dynamics 365 Finance and Supply Chain

Microsoft Dynamics 365 Finance and Supply Chain integration surface

• Business events: Finance and Supply Chain can publish business events (for example purchase order confirmed, vendor invoice posted, sales order shipped, plus custom ones built by extending BusinessEventsBase) to Azure Service Bus, Event Grid, Event Hubs, an HTTPS endpoint or Power Automate. Available event catalogue depends on version.
• OData v4 data entities under the /data endpoint (for example PurchaseOrderHeadersV2, PurchaseOrderLinesV2, CustomersV3, VendorsV2). Only entities flagged public are exposed, and field names vary slightly by release.
• Custom services (X++ service classes exposed under /api/services) for actions that are not simple CRUD, such as confirming a PO line with a new date and a reason code.
• Authentication is OAuth 2.0 against Microsoft Entra ID with an app registration whitelisted in the environment (Microsoft Entra ID applications form) and mapped to a dedicated service user with a narrow security role.
• Throttling: the service applies priority-based throttling to OData and custom service calls, so a bulk reminder run should be batched and tolerate HTTP 429 with retry-after.
• On-premises (Local Business Data) deployments cannot use the cloud-only business event destinations in the same way and typically rely on AD FS authentication and your own HTTPS endpoint or polling.

How it works

1. 1

   Choose the WhatsApp access path

   Use the WhatsApp Business Platform Cloud API directly or through a business solution provider. Verify the business in Meta Business Manager, register a number that is not used on a personal app, and decide which legal entities share which sender number.

2. 2

   Register the ERP side

   Create an Entra ID app registration, whitelist it in the environment, and map it to a service user whose role only reads the entities and calls the services you need.

3. 3

   Emit events

   Activate the relevant business events for the legal entity and point an endpoint at your middleware (or Azure Service Bus). For anything without an event, schedule a delta read using a modified-date filter on the entity.

4. 4

   Resolve the recipient

   Middleware looks up the contact's mobile number from party contact information (electronic address records) and checks an opt-in table you maintain. No opt-in record means no message, and the exception is routed to a person.

5. 5

   Send templates

   Use Meta-approved utility templates with variables for PO number, date and amount. Free-form text is only allowed inside the customer service window after the recipient replies.

6. 6

   Handle inbound webhooks

   Receive delivery receipts and replies, verify the signature, find the originating record from a stored message-to-document mapping, and call the ERP service. Unrecognised replies go to a shared inbox.

7. 7

   Log and monitor

   Store message ID, template, document reference and status so a buyer can see in the ERP (a simple custom table or a note on the document) what was sent and answered.

Security checklist

• Use a dedicated service user and Entra ID app with the smallest security role, never an administrator account.
• Verify the X-Hub-Signature-256 header on every webhook and reject unsigned calls.
• Bind a reply to a document with a signed, expiring token, and verify the sender number matches the registered contact before any write.
• Keep opt-in records with timestamp and source, and honour STOP replies immediately.
• Restrict message content so bank details, prices and personal data are not sent in templates unless the business has signed off.