Install the app

How you install AutoFlow depends on where your Business Central environment runs.

Prerequisites

• Business Central version 24 or newer.
• A user with sufficient rights to install extensions (for online environments: an Administrator in the Microsoft 365 tenant; for on-premises: a user with SUPER permissions that is allowed to publish apps on the BC Server instance).
• For Business Central Online and unrestricted on-premises networks, no firewall changes are needed. If you run AutoFlow on-premises behind an outbound proxy or an egress filter, see Network requirements at the bottom of this page.

Business Central Online (SaaS) — from AppSource

1. Sign in to your Business Central environment.
2. Open the Extension Marketplace (search for Extension Marketplace in the Tell Me bar).
3. Search for AutoFlow by mse Software GmbH, or open the listing directly at marketplace.microsoft.com/.../autoflow.
4. Choose Get it now and follow the AppSource dialog. You will be asked to:
   • accept the terms of use,
   • choose the environment in which AutoFlow should be installed.
5. AppSource installs AutoFlow and its required components. The installation runs in the background and can take a few minutes.
6. Once finished, open the target environment and continue with Activate the product.

tip

AutoFlow is installed per environment. If you manage multiple environments (for example a sandbox and a production environment), install it separately in each environment where you want to use it.

Business Central on-premises — from the mse download portal

1. Open the AutoFlow download portal at portal.autoflow365.app/de/downloads and download the latest AutoFlow release matching your Business Central version. The archive contains the .app files for AutoFlow itself and any required dependencies.

2. Copy the .app files to the Business Central server.

3. On the server, open a Business Central Administration Shell (PowerShell) and publish the apps:

   Publish-NAVApp -ServerInstance <YourInstance> -Path "<path>\AutoFlow.app" -PackageType Extension -SkipVerification

   Repeat the step for each .app file in the package. Install the dependencies first, then AutoFlow itself.

4. Synchronise and install the app in every tenant where you want to use it:

   Sync-NAVApp    -ServerInstance <YourInstance> -Name "AutoFlow" -Version <Version> -Tenant <TenantId>
   Install-NAVApp -ServerInstance <YourInstance> -Name "AutoFlow" -Version <Version> -Tenant <TenantId>

5. Continue with Activate the product.

tip

For a single-tenant installation, replace <TenantId> with default.

After installation

After the install completes, AutoFlow is available in the system but not yet active. Opening most role centres shows a notification that asks you to activate the product. The next chapter walks you through that step.

Permission sets

AutoFlow ships two roles for people, plus one for machine callers. In BC they appear by their ID (the Permission Set column below), with the caption shown in brackets:

Permission Set	Who it's for	What it grants
mse365 AF ALL (AutoFlow User)	everyone who works with flows	see every flow, create and edit drafts, start flows manually or on a schedule, and read executions and their logs. Cannot publish a flow or open AutoFlow Setup.
mse365 AF ADMIN (AutoFlow Admin)	the one or two people who own AutoFlow	everything the User role grants, plus publishing and unpublishing flows, AutoFlow Setup, activation and licensing, managing credentials, and publishing to the template gallery
mse365 AF Integr. (AutoFlow Integration (S2S))	Microsoft Entra applications (service-to-service)	everything a flow needs when it is started by a non-interactive caller – see Service-to-service callers below

Open User Permission Sets in BC and assign mse365 AF ALL to the people who build and run flows, and mse365 AF ADMIN to whoever owns AutoFlow in your organisation. Any permission set you already maintain for your finance or IT roles can pull these in via Included Permission Sets, so a single assignment covers everything.

Upgrading from an earlier version

mse365 AF ALL used to be described as the set that every Business Central user needs. That is no longer the case (see below), and the set now grants the full flow-design surface. After upgrading, review who has it and reduce it to the people who actually build flows.

mse365 AF-CO SUB MGT (AutoFlow Subs. Mgt.) is superseded by mse365 AF ADMIN. It keeps working and grants the same rights, so nothing breaks – but assign mse365 AF ADMIN from now on.

Triggering a flow needs no permission set

A flow that reacts to a record – say, one that starts when a purchase invoice is created – runs on behalf of the person who created that record. That person usually has nothing to do with AutoFlow and should not need an AutoFlow permission set to do their job.

They do not. AutoFlow's own tables grant the running flow what it needs, so a colleague in purchasing can create their invoice and the flow starts, with no AutoFlow permission set assigned to them at all.

One exception: the Add Item Tracking step writes reservation entries, which are ordinary Business Central data rather than AutoFlow data. A flow using that step only works for users who may write reservation entries themselves.

Who may publish

Publishing is what makes a flow live, so it is deliberately separated from building one. A user with mse365 AF ALL can create a draft, change it and try it out, but Publish changes stays greyed out; they will be told to ask an AutoFlow administrator. Give mse365 AF ADMIN to the people who should be able to put flows into production.

Make sure at least one person has mse365 AF ADMIN (or the superseded mse365 AF-CO SUB MGT) – otherwise nobody can publish flows or activate the product.

Service-to-service callers

A Microsoft Entra application authenticating service-to-service (OAuth client-credentials) – the typical setup for an external system that calls an AutoFlow webhook – is not a licensed Business Central user, so it needs its own permission set.

For those callers, assign mse365 AF Integr. It carries the flow-runtime access such a caller needs, including the Job Queue entry that runs the flow and the stored credentials a step resolves. Assign it on the Microsoft Entra Applications card for the registered app, the same way you would assign a permission set to a user. See the webhook trigger for the full S2S setup.

Network requirements

This section only applies if you run AutoFlow on-premises behind an outbound proxy or an egress filter. For Business Central Online, Microsoft already allows the relevant hosts; most on-premises customer networks let outbound HTTPS through unrestricted, in which case there is nothing to do here. If your firewall does restrict outbound traffic, it has to allow the hosts below.

Required

On-premises AutoFlow activates from a signed license file and then runs entirely offline – it does not contact any mse host to activate or to run flows. There are no required outbound hosts for on-premises operation. (Activation on Business Central Online is different: there the app registers with the AutoFlow customer portal, which Microsoft already allows. Online, AutoFlow also creates one daily job queue entry per environment – AutoFlow: report license usage to the AutoFlow portal – that keeps your license up to date; leave it running.)

Recommended

Host	Protocol/Port	Purpose	If blocked
statics.autoflow365.app statics.autoflow.mse365.de	HTTPS / TCP 443	Step icons and status badges shown in the Flow Editor	Cosmetic only – flows still run; the Flow Editor falls back to a default icon
docs.autoflow365.app docs.autoflow.mse365.de	HTTPS / TCP 443	In-product Learn more links open this documentation site	The links break, but no functional impact

One-time, during installation

Host	Protocol/Port	Purpose	When
portal.autoflow365.app portal.mse365.de	HTTPS / TCP 443	mse download portal – used to obtain the .app files and the license file	Once, when the admin downloads AutoFlow

Notes

• Two hostnames per service. AutoFlow is moving from mse365.de to autoflow365.app. Both names stay live and serve the same thing, because an installed app version keeps calling whichever name it shipped with. Allow both.
• Allow by hostname, not by fixed IPs. The recommended hosts are on Azure with Azure-managed certificates, and the egress IP set is not stable enough to publish.
• TLS 1.2 minimum. AutoFlow uses Business Central's standard HttpClient, which negotiates TLS with the server.
• Outbound proxy. If the BC Server reaches the internet through a proxy, configure the proxy on the BC Server instance per Microsoft's guidance – AutoFlow uses the system proxy automatically.

Troubleshooting

• Offline license import is rejected – make sure the server / instance / database values you entered in the portal match the ones the activation wizard shows for this installation.
• Flow Editor shows missing step icons – check statics.autoflow365.app. Cosmetic only; flows still run.