Skip to main content

​
After this article

You’ll be able to connect Microsoft Dynamics 365 to Lumos to sync users and their access, and to provision and deprovision accounts.

​
Capabilities

​
Required plan and roles

  • Dynamics 365 role: the user who logs in and authorizes the connection must hold the System Administrator security role in Dynamics 365.
  • Azure app registration: register an app in Microsoft Entra ID and add the Dynamics CRM delegated permission user_impersonation, then grant admin consent for it. A registration without this permission is the most common reason the connection fails.
  • Client secret: create a client secret on the app registration and copy its value.
  • Connection values: you’ll supply the Client ID, Client Secret, Tenant ID, and your Dynamics org subdomain.

​
Read-only access vs provisioning

Is read-only possible? No. The connector authenticates through a single Azure app registration permission, the Dynamics CRM delegated user_impersonation scope, which acts with the full permissions of the signing-in user. No narrower read-only scope is documented. What full provisioning requires. An Azure app registration with the Dynamics CRM delegated user_impersonation permission and admin consent granted, a client secret, and a signing-in user who holds the System Administrator role in Dynamics 365. Follow the steps below to register the app and connect. Watch out for. Because user_impersonation is the only permission this connector uses, the account that authorizes the connection needs System Administrator in Dynamics 365 even if all you want is read access. Missing admin consent on that permission is the most common reason the connection fails.

​
Instructions

Phase 1: Register an app in Microsoft Entra ID
  1. In the Microsoft Entra admin center, go to App registrations and select New registration.
  2. Open API permissions, add a permission for Dynamics CRM, choose Delegated permissions, and select user_impersonation.
  3. Select Grant admin consent for the permission.
  4. Go to Certificates & secrets, create a new client secret, and copy the secret value right away.
  5. From the app’s Overview, note the Application (client) ID and Directory (tenant) ID.
  6. Confirm the account that will authorize the connection has the System Administrator role in Dynamics 365.
Phase 2: Connect in Lumos
  1. Find the Microsoft Dynamics 365 card in your Lumos integrations.
  2. Enter the Client ID, Client Secret, Tenant ID, and your Dynamics org subdomain.
  3. Click Connect.

​
Troubleshooting

Setup is unclear or the connection fails. The connector needs more than a bare OAuth application. Confirm the Azure app registration has the Dynamics CRM delegated user_impersonation permission with admin consent granted, that a valid client secret exists, and that the authorizing user holds the System Administrator role. Then supply the Client ID, Client Secret, Tenant ID, and org subdomain.