> ## Documentation Index
> Fetch the complete documentation index at: https://docs.lumos.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Microsoft Dynamics 365

## After this article

You'll be able to connect Microsoft Dynamics 365 to Lumos to sync users and their access, and to provision and deprovision accounts.

## Capabilities

| Functionality | Type | Sync | Provision |
| - | - | - | - |
| Users | Account | Yes | Yes |
| Security Roles | Entitlement | Yes | Yes |
| Teams | Entitlement | Yes | Yes |
| Privileges | Entitlement | Yes | No |

## Required plan and roles

* **Dynamics 365 role:** the user who logs in and authorizes the connection must hold the **System Administrator** security role in Dynamics 365.
* **Azure app registration:** register an app in Microsoft Entra ID and add the **Dynamics CRM** delegated permission **`user_impersonation`**, then grant **admin consent** for it. A registration without this permission is the most common reason the connection fails.
* **Client secret:** create a client secret on the app registration and copy its value.
* **Connection values:** you'll supply the **Client ID**, **Client Secret**, **Tenant ID**, and your Dynamics **org subdomain**.

## Read-only access vs provisioning

**Is read-only possible?** No. The connector authenticates through a single Azure app registration permission, the Dynamics CRM delegated `user_impersonation` scope, which acts with the full permissions of the signing-in user. No narrower read-only scope is documented.

**What full provisioning requires.** An Azure app registration with the Dynamics CRM delegated `user_impersonation` permission and admin consent granted, a client secret, and a signing-in user who holds the **System Administrator** role in Dynamics 365. Follow the steps below to register the app and connect.

**Watch out for.** Because `user_impersonation` is the only permission this connector uses, the account that authorizes the connection needs System Administrator in Dynamics 365 even if all you want is read access. Missing admin consent on that permission is the most common reason the connection fails.

## Instructions

**Phase 1: Register an app in Microsoft Entra ID**

1. In the Microsoft Entra admin center, go to **App registrations** and select **New registration**.
2. Open **API permissions**, add a permission for **Dynamics CRM**, choose **Delegated permissions**, and select **`user_impersonation`**.
3. Select **Grant admin consent** for the permission.
4. Go to **Certificates & secrets**, create a new client secret, and copy the secret value right away.
5. From the app's **Overview**, note the **Application (client) ID** and **Directory (tenant) ID**.
6. Confirm the account that will authorize the connection has the **System Administrator** role in Dynamics 365.

**Phase 2: Connect in Lumos**

1. Find the Microsoft Dynamics 365 card in your Lumos integrations.
2. Enter the **Client ID**, **Client Secret**, **Tenant ID**, and your Dynamics **org subdomain**.
3. Click **Connect**.

## Troubleshooting

**Setup is unclear or the connection fails.** The connector needs more than a bare OAuth application. Confirm the Azure app registration has the **Dynamics CRM** delegated **`user_impersonation`** permission with **admin consent** granted, that a valid client secret exists, and that the authorizing user holds the **System Administrator** role. Then supply the Client ID, Client Secret, Tenant ID, and org subdomain.