# Integrating SailPoint with Microsoft Dynamics 365 Customer Relationship Management SaaS

Microsoft Dynamics CRM (Customer Relationship Management) is a customer relationship management software package developed by Microsoft focused on enhancing the customer relationship for any organization. Out of the box, the product focuses mainly on the Sales, Marketing, and Customer Service sectors.

CRM Online is a cloud-based offering of Microsoft Dynamics CRM where all the backend processes (such as application servers, setups, deployments, databases, licensing, and so on) are managed on Microsoft servers. It is a subscription-based offering which is preferred for organizations who may not want to manage all the technicalities involved in a CRM implementation.

Connecting SailPoint to your Dynamics 365 CRM allows you to manage identity and access management use cases related to read and provision various Dynamics 365 CRM Native IAM Objects as follows:

- **Users**: Licensed Users in Dynamics 365 CRM are synchronized from Entra ID. Other types of users such as Application Users and Stub Users can be created in CRM itself.
- **Teams**: Teams provide an easy way to share business objects and let you collaborate with other people across business units. While a team belongs to one business unit, it can include users from other business units. A user can be associated with more than one team.
- **Security Roles**: Security roles define access level on different records. These roles can be assigned to users or teams.

> [!NOTE]
>
> To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the [SaaS Release Notes](<https://community.sailpoint.com/release-notes/saas>) page.

## Supported Features

The Microsoft Dynamics 365 Customer Relationship Management SaaS connector supports the following features:

- Account Management
- Account-Group Management

### Account Management

The following table describes the supported operations on various objects for the Microsoft Dynamics 365 Customer Relationship Management SaaS connector:

| Operations | Licensed User | Application User | Stub User |
| --- | --- | --- | --- |
| Aggregation | Yes | Yes | Yes |
| Get Account | Yes | Yes | Yes |
| Enable/Disable Users | Yes | Yes | N/A |
| Add/Remove Entitlements<br>\- Add/Remove Access Teams<br>\- Add/Remove Owner Teams<br>\- Add/Remove Security Roles | Yes | Yes | N/A |

> [!NOTE]
>
> Licensed Users are synchronized from Entra ID.

### Entitlement Management

| Operations | Owner Team | Access Team | Entra ID Office Group | Entra ID Security Group | Security Role |
| --- | --- | --- | --- | --- | --- |
| Aggregation | Yes | Yes | Yes | Yes | Yes |

## Privilege Classification

SailPoint Privilege Classification helps organizations systematically categorize and manage the privilege levels of entitlements within their sources. By classifying entitlements as high, medium, or low, administrators can better understand the potential risk and impact associated with specific access rights. This allows automatic assignment of privilege levels based on system recommendations, custom-defined criteria, or a same level across all entitlements.

| Privilege Level | Description |
| --- | --- |
| High | Administrative level access to accounts |
| Medium | Administrative level access for a specific role or function |
| Low | Only basic access of data |

> [!NOTE]
>
> To manage Privilege Classification, users must have administrative roles such as Org Admin, Source Admin or Source Sub-Admin.

For more information, refer to [Managing Privilege Classification](<https://documentation.sailpoint.com/saas/help/loading_entitlements/privilege_classification.html>).

> [!NOTE]
>
> **Example**
>
> [![Privilege Classification example](<https://documentation.sailpoint.com/connectors/microsoft/dynamics_365/crm/saas/help/img/privilege_level_example.png>)](<https://documentation.sailpoint.com/connectors/microsoft/dynamics_365/crm/saas/help/img/privilege_level_example.png>)

## Prerequisites

The Microsoft Dynamics 365 Customer Relationship Management SaaS connector supports OAuth 2.0 authentication with the following grant types:

- Client Credentials
- JWT Certificate Credentials

The following sections describe the configurations that must be performed for the above grant types.

### Registering an Application on Entra ID

Registering the application generates the Tenant ID, Client ID, and Client Secret required for authentication. These are required for later processes.

Perform the following:

1. Use either of the following methods to access the Entra Management Portal to perform the configuration:

   - [Microsoft Azure](<https://portal.azure.com/>)
   - [Microsoft Entra admin center](<https://aad.portal.azure.com/>)
2. Select **Entra ID** in the left pane.
3. Select **App registrations**.
4. Select **New** registration.
5. On the **Register an application** page, in the **Name** field, enter the name of the application that you want to set up.
6. Select **Register**. An Application is created. On the Application page the **Application ID** (Client ID) and **Tenant ID** are displayed.
7. On the left-hand panel, select **Certificates &amp; secrets**. On the **Certificates &amp; secrets** page, in the **Client secrets** section, select **New client secret**.
8. On the **Add a client secret** page, enter the **Description** to generate a secret, and select the validity duration in the **Expires** list. Select **Add**.
9. Note the value of the client secret that you have just created.

### Client Credentials

For the default **Client Credentials** grant type based authentication, following are the required configurations:

- Obtain the Tenant ID, Client ID, and Client Secret from Entra ID by registering the application (steps mentioned in [Registering an Application on Entra ID](<#registering-an-application-on-entra-id>)).

### JWT Certificate Credentials

JWT Certificate Credentials supports Authentication based on JWT assertion prepared from Certificate and Private Key.

1. Obtain the Tenant ID and Client ID from Entra ID by registering the application (up to step 6 mentioned in [Registering an Application on Entra ID](<#registering-an-application-on-entra-id>)).
2. To create a self-signed or CA-signed type X.509 certificate and private key, perform the following steps to register the certificate with the Microsoft identity platform:

   > **Important**
   >
   > The private key must be encrypted with the RSA algorithm and registered at the Entra portal.

   1. Log in to the Entra Portal.
   2. Select the client application. In the Entra app registration for the client application, select **Certificates &amp; secrets**.
   3. Select **Upload certificate** and select the certificate file to upload.
   4. Select **Add**.
   5. Obtain values for the following configurations:

      - **Certificate**: Obtain the text file of the same certificate which was uploaded on the Entra portal.
      - **Private Key**: Obtain the private key text file.
      - **Private Key Password**

### Creating an Application User on CRM

Perform the following:

1. Open the Dynamics 365 CRM portal.
2. Select **Settings** on top right and go to **Advanced Settings**. A new tab opens.
3. Go to **Settings** on the new tab, then go to the **Security** option under **System**.
4. In **Features**, select **Users**. From the dropdown menu select **Application Users** and then select **New**. A form to create a new user opens.
5. Select the user type as **Application User** again and provide **User Name** and **Application ID**. The Application ID is the Client ID of the Application registered in Entra ID previously.
6. Save the form.

## Required Permissions

Assign one of the following security roles to the application user based on the operation to be performed:

- Custom Security Role
- System Administrator (built-in)

### Custom Security Role

A Custom Security Role must be created with minimum read privileges (as shown in the following figure) for the following purposes:

- Account Aggregation of Users
- Get Object for Users, Security Roles, and Teams
- Group Aggregation for Roles and Teams

In the **Business Management** section (as shown in the following figure), for the following entities, select the **Read** option:

- Security Role
- Team
- User
- User Settings

[![Required Permissions - Custom Security Role](<https://documentation.sailpoint.com/connectors/microsoft/dynamics_365/crm/saas/help/img/security_role.png>)](<https://documentation.sailpoint.com/connectors/microsoft/dynamics_365/crm/saas/help/img/security_role.png>)

### System Administrator

Assign the System Administrator (built-in) security role for the following purposes:

- Add Security Roles and Teams to Users
- Remove Security Roles and Teams from Users
- Enable/Disable Users

> [!NOTE]
>
> All connector operations can be managed with the System Administrator role.