Dynamics 365 Business Central: Reporting and data analysis - Use new APIs for getting the PDF of a document report

🚨 The Signal: New read-only APIs in Dynamics 365 Business Central allow external systems, including Copilot agents, to access document PDFs. This expands automation capabilities but introduces new data access points for sensitive business documents.

The Impact

Security teams must assess new API access to sensitive documents, as Copilot agents could expose data if not properly secured.

  • Security teams: New API access points for sensitive documents require review and control.
  • AI governance teams: Copilot agents accessing these APIs need strict identity and access management.
  • Data owners: Document PDFs are now more accessible externally, increasing data exfiltration risk.
  • Compliance officers: Data flow and access policies must be updated to reflect new API capabilities.

The Action

  1. Review existing Dynamics 365 Business Central API access policies for external integrations.
  2. Implement least privilege access for any service principals or identities using these new APIs.
  3. Configure Conditional Access policies for identities accessing Business Central APIs, if applicable.
  4. Audit Copilot Studio agent configurations to ensure secure handling and storage of retrieved PDFs.
  5. Update data classification and handling policies to include external access via these new APIs.

Domain: Agentic-AI · Impact: high · Workload: Other · Essential Eight: Restrict Administrative Privileges · ISM: ISM-0445, ISM-1175, ISM-1380, ISM-1507, ISM-1508, ISM-1509, ISM-1647, ISM-1648, ISM-1650, ISM-1686, ISM-1688, ISM-1689, ISM-1883, ISM-1897, ISM-1898