Install the app

How you install AutoFlow depends on where your Business Central environment runs.

Prerequisites

• Business Central version 26 or newer.
• A user with sufficient rights to install extensions (for online environments: an Administrator in the Microsoft 365 tenant; for on-premises: a user with SUPER permissions that is allowed to publish apps on the BC Server instance).
• For Business Central Online and unrestricted on-premises networks, no firewall changes are needed. If you run AutoFlow on-premises behind an outbound proxy or an egress filter, see Network requirements at the bottom of this page.

Business Central Online (SaaS) — from AppSource

1. Sign in to your Business Central environment.
2. Open the Extension Marketplace (search for Extension Marketplace in the Tell Me bar).
3. Search for AutoFlow by mse Software GmbH, or open the listing directly at marketplace.microsoft.com/.../autoflow.
4. Choose Get it now and follow the AppSource dialog. You will be asked to:
   • accept the terms of use,
   • choose the environment in which AutoFlow should be installed.
5. AppSource installs AutoFlow and its required components. The installation runs in the background and can take a few minutes.
6. Once finished, open the target environment and continue with Activate the product.

tip

AutoFlow is installed per environment. If you manage multiple environments (for example a sandbox and a production environment), install it separately in each environment where you want to use it.

Business Central on-premises — from the mse download portal

1. Open the AutoFlow download portal at support.mse365.de/support/solutions/57000022346 and download the latest AutoFlow release matching your Business Central version. The archive contains the .app files for AutoFlow itself and any required dependencies.

2. Copy the .app files to the Business Central server.

3. On the server, open a Business Central Administration Shell (PowerShell) and publish the apps:

   Publish-NAVApp -ServerInstance <YourInstance> -Path "<path>\AutoFlow.app" -PackageType Extension -SkipVerification

   Repeat the step for each .app file in the package. Install the dependencies first, then AutoFlow itself.

4. Synchronise and install the app in every tenant where you want to use it:

   Sync-NAVApp    -ServerInstance <YourInstance> -Name "AutoFlow" -Version <Version> -Tenant <TenantId>
   Install-NAVApp -ServerInstance <YourInstance> -Name "AutoFlow" -Version <Version> -Tenant <TenantId>

5. Continue with Activate the product.

tip

For a single-tenant installation, replace <TenantId> with default.

After installation

After the install completes, AutoFlow is available in the system but not yet active. Opening most role centres shows a notification that asks you to activate the product. The next chapter walks you through that step.

Permission sets

AutoFlow ships these permission sets. In BC they appear by their ID (the Permission Set column below), with the caption shown in brackets:

Permission Set	Who it's for	What it grants
mse365 AF ALL (AutoFlow Basic)	every interactive AutoFlow user	enough to run flows and see the activation status — minimal by design, no licensing tabledata access of its own
mse365 AF-CO SUB MGT (AutoFlow Subscription Management)	admins / power users	activation wizard, package booking, edit billing info, voucher redemption — the surface needed to manage subscriptions
mse365 AF Integr. (AutoFlow Integration (S2S))	Microsoft Entra applications (service-to-service)	everything a flow needs to run end-to-end when triggered by a non-interactive caller — see Service-to-service callers below

Open User Permission Sets in BC and assign mse365 AF ALL to the users who should be able to run AutoFlow flows. Add mse365 AF-CO SUB MGT on top for the one or two people who manage subscriptions for the tenant. Most permission sets you already have configured for your finance / IT roles can include these via Included Permission Sets so a single assignment covers everything.

Service-to-service callers

A signed-in user runs flows fine with mse365 AF ALL because their Business Central licence implicitly grants access to the underlying application tables. A Microsoft Entra application authenticating service-to-service (OAuth client-credentials) — the typical setup for an external system that calls an AutoFlow webhook — carries no such licence entitlement, so mse365 AF ALL alone is not enough for it to run a flow.

For those callers, assign mse365 AF Integr. instead. It rolls up mse365 AF ALL and adds the flow-runtime table access (execution state, the Job Queue entry that runs the flow, stored credentials a step resolves) that the licence would otherwise have supplied. Assign it on the Microsoft Entra Applications card for the registered app, the same way you would assign a permission set to a user. See the webhook trigger for the full S2S setup.

Network requirements

This section only applies if you run AutoFlow on-premises behind an outbound proxy or an egress filter. For Business Central Online, Microsoft already allows the relevant hosts; most on-premises customer networks let outbound HTTPS through unrestricted, in which case there is nothing to do here. If your firewall does restrict outbound traffic, it has to allow the hosts below.

Required

Host	Protocol/Port	Purpose	When AutoFlow contacts it
licensing.mse365.de	HTTPS / TCP 443	Product activation, tenant registration, package management, licence validation	During activation, on every flow run (cached for a few minutes), and on the periodic background validation

Recommended

Host	Protocol/Port	Purpose	If blocked
statics.autoflow.mse365.de	HTTPS / TCP 443	Step icons and status badges shown in the Flow Editor	Cosmetic only – flows still run; the Flow Editor falls back to a default icon
docs.autoflow.mse365.de	HTTPS / TCP 443	In-product Learn more links open this documentation site	The links break, but no functional impact

One-time, during installation

Host	Protocol/Port	Purpose	When
support.mse365.de	HTTPS / TCP 443	mse download portal – used to fetch the .app files	Once, when the admin downloads AutoFlow

Notes

• Allow by hostname, not by fixed IPs. licensing.mse365.de is hosted on Azure with an Azure-managed certificate, and the egress IP set is not stable enough to publish.
• TLS 1.2 minimum. AutoFlow uses Business Central's standard HttpClient, which negotiates TLS with the server.
• Outbound proxy. If the BC Server reaches the internet through a proxy, configure the proxy on the BC Server instance per Microsoft's guidance – AutoFlow uses the system proxy automatically.

Troubleshooting

• Activation wizard hangs or reports "no licence" – check that the BC Server account can reach licensing.mse365.de.
• Flow Editor shows missing step icons – check statics.autoflow.mse365.de. Cosmetic only; flows still run.