17.1 Mobile App Installation, Display Settings, Connection Profiles, and Warehouse Worker Setup

17.1 Mobile App Installation, Display Settings, Connection Profiles, and Warehouse Worker Setup

Quick Answer: The Warehouse Management mobile app in Microsoft Dynamics 365 Supply Chain Management (D365 SCM) operates on a two-tier security model: device connectivity is authenticated via Microsoft Entra ID (using either a client secret or an X.509 certificate linked to a service principal in D365 SCM's Microsoft Entra applications table), while warehouse floor transactions are authorized via a Warehouse Worker User ID and PIN. Warehouse workers must be explicitly linked to an underlying Human Resources worker record and assigned operational permissions—such as Allow override location, Allow pick split, and Allow manual movement—to govern physical exception handling on the warehouse floor.

---

1. Warehouse Management Mobile App Architecture

The Warehouse Management mobile app replaces the legacy browser-based Work User portal (WHSWorkExecute) with a modern, touch-optimized native application built on cross-platform frameworks. It is designed to run reliably across diverse industrial hardware form factors, including rugged handheld radio frequency (RF) barcode scanners, wearable ring scanners, vehicle-mounted forklift terminals, and commercial tablets or smartphones.

Supported Operating Systems

• Windows: Windows 10 (version 1809 or later) and Windows 11, distributed via the Microsoft Store or sideloaded as an MSIX bundle on industrial vehicle-mounted computers.
• Android: Android 8.0 or higher, distributed via Google Play or installed directly via APK on enterprise mobile computers (e.g., Zebra, Honeywell, Datalogic).
• iOS: iOS 13.0 or higher, distributed via the Apple App Store for Apple devices.

┌──────────────────────────────────────────────────────────────────────┐
│                     Two-Tier Authentication Model                    │
└──────────────────────────────────────────────────────────────────────┘

  Tier 1: Device Connectivity Authentication (Environment Level)
  ┌───────────────────────────┐          ┌───────────────────────────┐
  │ Rugged Handheld Scanner   │          │ Microsoft Entra ID        │
  │ Mobile App Profile        │          │ (Azure Active Directory)  │
  │ ───────────────────────── │          │ ───────────────────────── │
  │ • Client (App) ID         │─────────►│ • Validates App Identity  │
  │ • Tenant ID               │  OAuth   │ • Evaluates Cert / Secret │
  │ • X.509 Cert / Secret     │  Token   │ • Issues Bearer Token     │
  └───────────────────────────┘          └─────────────┬─────────────┘
                                                       │
                                                       ▼
                                         ┌───────────────────────────┐
                                         │ D365 SCM Environment      │
                                         │ System administration >   │
                                         │ Microsoft Entra apps      │
                                         │ (Maps Client ID -> User)  │
                                         └─────────────┬─────────────┘
                                                       │
  Tier 2: Operational Worker Authentication (Session Level)    │
  ┌───────────────────────────┐                        │
  │ Warehouse Worker Signs In │                        │
  │ ───────────────────────── │                        │
  │ • Work User ID (e.g. WH01)│◄───────────────────────┘
  │ • Numeric PIN / Password  │ (Authorizes menu hierarchy, default
  │ • Validated vs WHS Worker │  warehouse, and operational rights)
  └───────────────────────────┘

The Two-Tier Authentication Architecture

A fundamental concept for the MB-330 exam is the separation between Device Authentication and User Authentication:

1. Device-Level Authentication (Microsoft Entra ID): Authorizes the physical application instance to establish an encrypted API handshake with the Dynamics 365 Supply Chain Management environment. No warehouse worker can interact with D365 SCM until this connection is established.
2. User-Level Authentication (Warehouse Worker): Once the device connects to the environment, the worker is presented with a login screen requesting a User ID and Password (or numeric PIN). This authenticates against the internal D365 SCM WHSWorkUser table, establishing the worker's operational permissions, language, default warehouse, and available menu hierarchies.

---

2. Microsoft Entra ID Registration and Connection Profiles

To establish the device-level handshake, a system administrator must register an application in the Microsoft Entra admin center and configure the corresponding service principal in D365 SCM.

Step 1: Azure App Registration in Microsoft Entra ID

1. Navigate to the Microsoft Entra admin center > Applications > App registrations.
2. Select New registration, assign a name (e.g., D365-WHS-MobileApp), and select the supported account type (Single tenant).
3. Record the Application (client) ID and the Directory (tenant) ID.
4. Under Certificates & secrets, generate either a Client secret or upload an X.509 public certificate (.cer).
5. Under API permissions, grant the application delegated permissions to access Dynamics ERP (Ax.FullAccess).

Step 2: Configure D365 SCM Microsoft Entra Applications

1. In D365 SCM, navigate to System administration > Setup > Microsoft Entra applications.
2. Create a new record:
   • Client ID: Paste the Application (client) ID generated in Microsoft Entra ID.
   • Name: Enter a descriptive identifier (e.g., WHS Mobile App Service Principal).
   • User ID: Assign a dedicated system user account (e.g., WHS_ServiceAccount). This user must have the Warehouse mobile device user security role and the legal entities assigned where warehouse operations occur.

Client Secret vs. Certificate Authentication

Connection Profiles and QR Code Enrollment

Rather than manually keying complex URLs, tenant IDs, and client IDs into hundreds of ruggedized scanners, administrators generate connection configurations in JSON format:

{
  "ConnectionList": [
    {
      "ActiveDirectoryClientAppId": "00001111-aaaa-2222-bbbb-3333cccc4444",
      "ConnectionName": "USMF Production Warehouse",
      "ActiveDirectoryResource": "https://usmf-prod.operations.dynamics.com",
      "ActiveDirectoryTenant": "https://login.windows.net/tenant-domain.com",
      "Company": "USMF",
      "UseCertificate": true,
      "CertificateThumbprint": "A1B2C3D4E5F6G7H8I9J0K1L2M3N4O5P6Q7R8S9T0"
    }
  ]
}

• QR Code Scanning: The JSON string is converted into a standard 2D QR barcode. Upon launching the app for the first time, a technician taps Scan settings and scans the printed QR code, instantly provisioning the device connection.
• MDM Distribution: Tools such as Microsoft Intune, SOTI MobiControl, or Omnissa Workspace ONE can distribute the connection configuration file directly into the app's sandboxed storage (com.Microsoft.WarehouseManagement), eliminating manual scanning entirely.

---

3. Display Settings, Themes, and Audio/Haptic Feedback

Warehouse environments range from brightly lit retail distribution centers to dimly lit freezers and outdoor lumber yards. The mobile app provides extensive display customization options configured centrally in D365 SCM:

• Navigation: Warehouse management > Setup > Warehouse management parameters (and the Mobile device display settings workspace).

Display Customization Capabilities

1. Themes and Color Schemes:
   • Light theme: Best suited for standard ambient indoor lighting.
   • Dark theme: Reduces eye fatigue in low-light environments and preserves battery life on OLED displays.
   • High-contrast theme: Dramatically enhances readability for outdoor loading docks, cold storage facilities, or workers with visual impairments.
2. Card Layouts and Screen Scaling:
   • Field priorities can be established under Warehouse management > Setup > Mobile device > Warehouse app field names to specify which fields appear prominently in the primary card view versus secondary drill-downs.
   • Supports variable font scaling and full-screen kiosk locking to prevent operators from exiting to the underlying Android/Windows OS.
3. Step Instructions and Visual Images:
   • Administrators can define custom, localized, step-by-step instructions for every warehouse operation (e.g., "Scan the pallet license plate on shelf A-01").
   • Product Images: When enabled, the app displays high-resolution released product images during picking or receiving, allowing operators to visually confirm that the physical item matches the scanned barcode.
4. Audio and Haptic Feedback:
   • Industrial warehouses are loud environments where screen observation can distract forklift operators. The app utilizes distinct audio chimes and physical vibration patterns:
     • Success confirmation: Single pleasant chime and short vibration confirming valid scan.
     • Error / Warning: Harsh low-frequency buzz and double vibration signaling an invalid barcode, location mismatch, or over-pick violation.

---

4. Warehouse Worker Setup

A Warehouse Worker in D365 SCM represents the operational persona used by a material handler to interact with the mobile app.

• Navigation: Warehouse management > Setup > Worker.

┌────────────────────────────────────────────────────────┐
│            Human Resources Worker (HCMWorker)          │
│               (e.g., John Doe - Emp #1042)             │
└───────────────────────────┬────────────────────────────┘
                            │ (Mandatory 1:1 Linkage)
                            ▼
┌────────────────────────────────────────────────────────┐
│            Warehouse Work User (WHSWorkUser)           │
│ ────────────────────────────────────────────────────── │
│ • User ID:           WH-JDOE                           │
│ • User Name:         John Doe                          │
│ • Default Warehouse: 24 (Distribution Center)          │
│ • Default Menu:      MAIN (Warehouse Root Menu)        │
│ • Password / PIN:    ••••                              │
│ • Allowed Warehouses:24, 25                            │
└───────────────────────────┬────────────────────────────┘
                            │ (Governs Execution)
                            ▼
┌────────────────────────────────────────────────────────┐
│          Assigned Work Permissions & Limits            │
│ ────────────────────────────────────────────────────── │
│ • Allow override location:       Yes                   │
│ • Allow pick split:               Yes                   │
│ • Allow manual movement:          No                    │
│ • Maximum pick quantity:          500 EA                │
└────────────────────────────────────────────────────────┘

Step-by-Step Setup Procedure

1. Link to Human Resources Worker: When creating a new warehouse worker, the system prompts for a Worker from the global HR repository (HcmWorker). A warehouse work user cannot exist without an associated HR worker record.
2. Define User Credentials:
   • User ID: A short alphanumeric string (e.g., WH01 or JDOE) used to log in at the terminal.
   • User Name: Display name of the operator.
   • Password: Numeric PIN or alphanumeric password. Administrators can reset passwords directly from this form.
3. Assign Default Context:
   • Default warehouse: The warehouse automatically loaded upon login.
   • Default menu: The top-level menu node (e.g., MAIN) presented upon successful authentication.
4. Assign Allowed Warehouses: Under the Warehouses FastTab, add every warehouse facility the user is permitted to transact in. If a user is not added to a warehouse's allowed list, they cannot select or transact within that facility.

---

5. Work User Operational Parameters

The Work user record contains critical boolean toggles and threshold parameters that dictate what operational exceptions a worker is permitted to resolve independently:

---

6. Implementation Scenarios and Exam Traps

[!IMPORTANT] Exam Tip — Two Separate User Concepts: Do not confuse a D365 SCM System User (System administration > Users) with a Warehouse Worker User (Warehouse management > Setup > Worker). System users log into the web browser client using Entra ID credentials. Warehouse workers log into the mobile scanner using a short User ID and PIN. The only bridge between the two is the service account assigned under Microsoft Entra applications that authenticates the mobile app itself.

[!WARNING] Exam Trap — Login Failure Due to Default Warehouse: A common exam scenario describes a worker who can log into the scanner hardware and successfully authenticate to the Entra ID service, but receives the error "User is not authorized for warehouse" when entering their PIN. This occurs when the administrator failed to assign a Default warehouse on the worker profile or neglected to add the warehouse to the Allowed warehouses FastTab.

[!TIP] Best Practice — Certificate Deployment via MDM: In enterprise environments with hundreds of scanners across multiple shifts, never deploy client secrets. When a secret expires, every terminal across the global supply chain fails simultaneously. Deploy X.509 device certificates managed through automated PKI profiles in Microsoft Intune or SOTI MobiControl.