# Microsoft Dynamics 365 Microsoft Dynamics 365 is a cloud-based business applications platform that combines CRM and ERP capabilities. Integrate with Dynamics 365 to sync sales, customer, and operational data with Suger. --- ## Overview ### Org-Level vs User-Level There are **two separate configurations**, and they authenticate in different ways: | | **Org-Level** | **User-Level** | |---|---|---| | **Auth flow** | Azure AD **client credentials** (app-only) | OAuth 2.0 **authorization code** (delegated) | | **Acts as** | The application user you create in Dynamics 365 — not a person | The signed-in person | | **Sees** | Whatever the application user's security roles allow, across the organization | Only the Dynamics 365 data that person can already see | | **Best for** | Backend integrations, scheduled syncs, and automated workflows | Individual users working with their own records | **Both** configurations require you to supply two values before the connection can start: - **Tenant ID** — your Azure AD (Microsoft Entra ID) directory ID. - **Instance URL** — your Dynamics 365 environment, e.g. `https://{your-org}.crm.dynamics.com`. These cannot be discovered automatically, so the connect flow shows a short **pre-start form** asking for them before it hands you off to Microsoft. They are used to build the correct authority and API endpoints for your environment, and are validated against the same schema on both levels. ![The Connect Microsoft Dynamics 365 dialog — Suger starts a secure Nango connect session, then shows the authorization step](images/dynamics365-connect.png) :::tip Find your **Tenant ID** in the Azure portal under **Microsoft Entra ID → Overview**. Find your **Instance URL** in the Power Platform Admin Center under **Environments** — it is the environment URL, and Suger expects the bare `*.crm.dynamics.com` host without an API path appended. ::: --- ## Create Integration (Org-Level) Org-level integration uses Azure AD client credentials for application-level access. This is suitable for backend integrations that need to access data across the organization. ### Prerequisites - Dynamics 365 instance URL (e.g., `https://yourorg.crm.dynamics.com`) - Tenant ID from Azure AD - **Application User in Dynamics 365**: Create an [application user](https://learn.microsoft.com/en-us/power-platform/admin/system-application-users) in Dynamics 365 linked to your Azure AD app registration. This application user will be used by Suger to access Dynamics 365 data via the Web API. ### Create Application User in Dynamics 365 1. In Dynamics 365, go to **Settings** > **Security** > **Users** 2. Change the view to **Application Users** 3. Click **New** and fill in the details: - **User Name**: Enter a name (e.g., `Suger Integration`) - **Application ID**: Enter `1a00a839-496c-488d-a97a-4cdb171b747f` - **Display Name**: Enter a display name (e.g., `Suger Integration`) - **Email**: Enter an email address (can be any valid email) 4. Click **Save** 5. After saving, assign the appropriate security roles to the application user ### Grant Security Roles via Power Platform Admin Center 1. Visit [Power Platform Admin Center](https://admin.powerplatform.microsoft.com/environments) 2. Select the environment you are connecting — its URL looks like `https://{your-org}.crm.dynamics.com` 3. Navigate to **Settings** → **Users + permissions** → **Application users** 4. Click **+ New app user** 5. Add an app: select the Application (client) ID created during Azure integration setup 6. **Business unit**: select the default one (named after your environment, `{your-org}.crm.dynamics.com`) 7. **Security roles**: grant **System Administrator** :::warning If this step is not completed, Suger will not be able to read CRM data. ::: ### Authenticate 1. Navigate to **Settings** > **Integrations** 2. Click **Connect Dynamics 365** 3. Enter your **Tenant ID** and **Instance URL** 4. Click **Verify** to test the connection 5. Once verified, click **Connect** --- ## Create User Integration User-level integration uses OAuth2.0 authorization code flow. Each user authenticates via Microsoft OAuth to access their own Dynamics 365 data. ### Prerequisites - Azure AD **Tenant ID** (provided before OAuth authorization) - Dynamics 365 **Instance URL** (provided before OAuth authorization) ### Before OAuth Authorization Before initiating the OAuth flow, you must provide your Azure AD tenant ID and your Dynamics 365 instance URL on the pre-start form. Both are required to construct the correct OAuth authority, scopes, and API endpoints for your environment. ### Authenticate 1. Click `Connect Now` button in the User Integrations section 2. Enter your **Tenant ID** and **Dynamics 365 Instance URL** when prompted 3. You will be redirected to Microsoft for authentication 4. Sign in with your Microsoft credentials 5. Click **Accept** to grant Suger permission to access your Dynamics 365 data 6. After authorization, you will be redirected back to Suger 7. Verify the integration by clicking the **Verify** button --- ## Edit Integration For security purposes, editing an existing Microsoft Dynamics 365 integration is not allowed. The practical way is to delete it and then recreate it from the beginning. --- ## Delete Integration The Microsoft Dynamics 365 integration can be deleted like all other integrations. Once the deletion is triggered, all integration info including the credentials and access tokens will be deleted immediately and permanently from Suger. :::warning - **Org-Level**: To completely delete the integration, please also delete the application user from Dynamics 365 and consider revoking the application permissions from Azure Active Directory. - **User-Level**: Deleting the integration in Suger does not automatically revoke permissions granted in Microsoft. To fully disable access, the user must also revoke the application's permissions. **Steps to revoke Microsoft Dynamics 365 permissions (User-Level):** 1. Go to Microsoft Account → Privacy 2. Select Apps and services 3. Locate the Suger application that was granted Dynamics 365 access 4. Click Remove these permissions ::: --- ## Supported Operations | Operation | Org-Level | User-Level | |-----------|-----------|------------| | Read Data | ✓ | ✓ | | Write Data | ✓ | ✓ | | Sync Data | ✓ (opportunities) | - | | Webhooks | - | - | ### Opportunity Sync Suger syncs **opportunities** from your Dynamics 365 environment. This runs on the **org-level** connection — it uses the application user's credentials, so it is not tied to any one person staying connected, and its visibility is exactly what you granted that application user's security roles. Opportunity sync is what lets Suger: - Read the opportunities in your environment so they can be turned into co-sell referrals. - Open a specific opportunity from Suger when someone starts a co-sell from a Dynamics 365 record. - Select opportunities automatically against conditions you configure, rather than one at a time. :::info If opportunities are not appearing, it is almost always the application user's permissions. Confirm you completed [Grant Security Roles via Power Platform Admin Center](#grant-security-roles-via-power-platform-admin-center) — without it Suger cannot read CRM data at all. ::: > **Note**: Webhooks are not supported at this time. Dynamics 365 data reaches Suger through the opportunity sync described above rather than by Dynamics 365 pushing change notifications to Suger.