Administrator Guide (Dynamics 365 Customer Engagement) | MicrosoftDocs For Dynamics Engagement

User Manual:

Open the PDF directly: View PDF .
Page Count: 731

Download
Open PDF In Browser	View PDF

Contents
Administer Dynamics 365 Customer Engagement
Release history
Getting started with your subscription
Terminology
Try Dynamics 365 (online)
About Unified Interface
Enable hybrid experience
Onboard your organization and users
Onboarding cheat sheet for admins
Enabling preview features
Move between apps
Sign in to apps
Troubleshoot sign-in problems
What is Office 365?
Office 365 user ID
Manage subscription with Office 365 admin center
Service health
Using Organization Insights solution
Using Organization Insights dashboard (preview feature)
Manage updates
Policies and Communications
Switch from CRM Online to Dynamics 365 (online)
Important information for CRM Online customers
Important information for CRM Online volume license customers
Promo codes: Non-profit Web Direct
Promo codes: Student Web Direct
Promo codes: Faculty Web Direct
Promo codes: Government Web Direct
Promo codes: Commercial Web Direct

Support and billing
Contact technical support
Help and additional resources
Volume licensing FAQ
Billing FAQ
Contact information for billing support
Troubleshoot problems
Requirements/supported configurations
Online requirements
Plan for online deployment and administration
Supported web browsers and mobile devices
Web application requirements
Support for devices
Manage subscriptions, licenses, and user accounts
Reset a user's password
Manage email notifications
Purchase and assign licenses
Manage Microsoft licenses
Manage user account synchronization
Grant users access
Restrict access with trusted IP rules
Invite users with Azure Active Directory B2B collaboration
Administer without a license
Cancel subscription
Use the Service admin role to manage your tenant
Add Partner of Record
For partners: get credit when customers subscribe
For partners: Delegated Administrator
Manage security, users, and teams
Security concepts
Security roles and privileges
Create or edit a security role

Copy a security role
Create an administrative user and prevent privilege elevation
Assign security roles to a form
View user profile
User session and access management
Field-level security
Set permissions for a field
Enable or disable field security
Hierarchy security
Create users and assign security roles
Manage teams
Team templates
Team templates for access rights
Add teams or users to field security profile
Synchronize user information between Dynamics 365 and Active Directory
Add or remove sales territory members
Troubleshooting: Read-write access
Manage instances
What's new with instance management
Sandbox
Add instance
Switch instance
Copy instance
Delete instance
Backup and restore instances
Support instances
Move instance
Common Data Service instances
Edit properties of an instance
Multiple online instances or tenants
Add and edit multiregional instances
Migrate Dynamics 365 (online) to Dynamics 365 (on-premises)

Encryption keys for instance
Troubleshooting: Unblock required URLs
Datacenter regions
Australia
Canada
Germany
India
Japan
Geo to geo migrations
Set up an organization
Regional and other business management settings
Numbers, currencies, times, and dates
Transactions with multiple currencies
Enable languages
Fiscal year
Privacy preferences
Sales territories
Auto-numbering prefixes
Define subjects for cases, products, and articles
Create or edit business unit
Delete business unit
Assign business unit to different parent business
Create or edit a site
Add resources to a site
Enhanced service level agreements
Configure Relevance Search
Manage product catalog configuration
Enable rich text for appointment activities
Performance tuning and optimization
Verify network capacity and throughput for clients
Key preparation and configuration tasks
Data query performance

Manage your data
Add or remove sample data
Import data
Template for data import
Detect duplicate data
Duplicate detection rules
Turn duplicate detection rules on or off
Bulk duplicate detection
Bulk deletions
View and take action on bulk deletion jobs
Monitor and manage system jobs
Audit data and user activity
Data encryption
Remove user personal data
Manage storage
Free storage space
Fixing Add License Wizard and Add Storage Wizard errors
Recover database space by deleting audit logs
Enable change tracking to control data synchronization
Replicate data to Azure SQL Database
What's new with Data Export Service?
Move configuration data
Create a schema to export configuration data
Configure date settings for demo data
Modify a configuration data schema
Import configuration data
Work with templates
Articles
Email
Work with mail merge templates
Campaign
Entitlements

Excel
Word
Create signature for email or queue
Extend Dynamics 365 Customer Engagement
Integrate (synchronize) your email system
Deploy Dynamics 365 App for Outlook
Deploy email for Unified Interface
Server-side sync overview
Supported email service configurations
Set up server-side sync
Connect Dynamics 365 (online) to Exchange Online
Connect Dynamics 365 (online) to Exchange Server (on-premises)
Connect to POP3 or SMTP servers
Migrate settings from the Email Router to server-side synchronization
Troubleshooting
When would I want to use this check box?
Error logging
Best practices
Forward mailboxes or edit mailboxes
Configure Outlook or Exchange folder-level tracking
Use Outlook category to track appointments and emails
Track Outlook email by moving it to a tracked Exchange folder
Set incoming and outgoing email synchronization
Choose records to synchronize with Exchange
Control field synchronization with Outlook
How field security affects synchronization with Outlook
What fields can be synchronized with Outlook?
View the fields synchronized with Outlook
Frequently asked questions about synchronizing records
Set personal options that affect tracking and synchronization
Monitor email processing errors
Why does the email sent have "Pending Send" status?

Email message filtering and correlation
Forward mailbox vs. individual mailboxes
Recover from Exchange Server failure
Extend with integration and solutions
Manage your documents using SharePoint
Software requirements
Server-based SharePoint integration considerations
Set up
Set up Dynamics 365 (online) to use SharePoint Online
Switching from the list component or changing the deployment
Configure server-based authentication with Dynamics 365 (online) and
SharePoint Online
Configure server-based authentication with Dynamics 365 (online) and
SharePoint on-premises
Troubleshooting server-based authentication
Configure SharePoint integration using the list component
Enable SharePoint document management for specific entities
Create or add a document location for the first time
Edit existing SharePoint site records
Create or edit document location records
Permissions required for document management tasks
Validate and fix SharePoint site URLs
Connect to Microsoft Social Engagement
Install the Social Selling Assistant
Control social data
Manage Bing Maps
Enable embedded Flow (Microsoft Flow)
Preview Feature: Live Assist powered by Café X
Deploy packages using Dynamics CRM Package Deployer and Windows PowerShell
Use Power BI with Dynamics 365
Preview feature: Set up Cortana integration
Install, update, or remove a preferred solution
Add Office 365 Online services

Connect Dynamics 365 (online) to Exchange Online
Connect Dynamics 365 (online) to SharePoint Online
Setup Microsoft Teams integration
Skype for Business and Skype integration
Set up Dynamics 365 (online) to use Skype or Skype for Business
Deploy Office 365 Groups
Set up OneNote integration
Enable OneDrive for Business (online)
Enable OneDrive for Business (on-premises)
Enable Office Delve
Connect to Yammer
Preview feature: Microsoft Cognitive Services integration
Preview feature: Automatically suggest knowledge articles
Preview feature: Suggest similar cases for a case
Enable document suggestions
Dynamics 365 Government
Dynamics 365 (online) Government - Feature availability
System Settings Dialog Box Reference
General tab
Calendar tab
Formats tab
Auditing tab
Email tab
Marketing tab
Customization tab
Outlook tab
Reporting tab
Goals tab
Sales tab
Service tab
Synchronization tab
Mobile Client tab

Previews tab
On-off switch for Learning Path (guided help)

Administrator Guide for Dynamics 365 Customer
Engagement
8/24/2018 • 2 minutes to read • Edit Online

Applies to Dynamics 365 (online), version 9.x
Applies to Dynamics 365 (online), version 8.x
NOTE
This content is for Dynamics 365 (online), version 9.0, or later. For documentation for earlier versions, see Administering
Dynamics 365.

Implementers and administrators for Dynamics 365 will find the resources and topics provided in this guide to
help you manage and configure Dynamics 365 Customer Engagement applications and services.

Get started
Getting started
Onboard your organization and users
Onboarding cheat sheet for admins
Create users and assign security roles
Manage your data
Extend Dynamics 365 Customer Engagement

Extend
Integrate your email system
Manage your documents using SharePoint
Add Office 365 Online services
Install or remove a preferred solution

Additional resources
YouTube playlist
Community forum
Contact support

See also
Customization Guide
Developer Guide
Reporting and Analytics Guide

Manage subscriptions
Manage subscriptions, licenses, and user accounts
Purchase and assign licenses
Grant users access
Switch from Dynamics CRM Online
Support and billing

Manage instances
Manage instances
Sandbox instances
Add an instance
Switch an instance

Product updates
What's new in Dynamics 365
Release history
Dynamics 365 Customer Engagement Readme

Release history for Administrator Guide
8/24/2018 • 2 minutes to read • Edit Online

Applies to Dynamics 365 (online), version 9.x
This is the release history page for the Administrator Guide for Dynamics 365 Customer Engagement
documentation. Note that some of the updated and new topics relate to changes made since the last product
release and are not exclusive to Dynamics 365 (online), version 9.0.
Check out the following for more "What's new" and release history information:
What's new in Dynamics 365
TIP
To see the versions that apply to the updates below, see Support: Dynamics 365 (online) releases

Dynamics 365 (online), version 9.0
NEW AND UPDATED TOPICS

DESCRIPTION OF CHANGES

Public Preview: Introducing Live Assist for Dynamics 365
Powered by CaféX

Added new topic.

Configure Relevance Search to improve search results and
performance

Updated topic.

Use Power BI

Updated topic.

Replicate data to Azure SQL Database

Added new topic.

Out-of-band topics
The following are topics for features that were delivered out of band since the prior product release.
NEW AND UPDATED TOPICS

DESCRIPTION OF CHANGES

Purchase and assign Dynamics 365 (online) licenses

Added information about PowerApps licensing.

What's new with instance management

New topic.

Common Data Service instances

New topic.

User Guide (Dynamics 365 for phones and tablets)

Updated topic.

What's supported

Updated topic.

Enable accessible email flow

Added new topic.

NEW AND UPDATED TOPICS

DESCRIPTION OF CHANGES

Contact Technical Support

Updated topic for new ticket process.

Preview feature: Set up Cortana integration

Updated topic.

Use the Organization Insights solution to view metrics about
your instance

Updated topic for version 1.3.0.1

Invite users to Dynamics 365 with Azure Active Directory B2B
collaboration

Added new topic.

About the Microsoft Cloud Germany datacenter

Added new topic.

Switch from Dynamics CRM Online to Dynamics 365 (online)

Updated topic.

Manage Support instances

Added new topic.

Security enhancements: User session and access management

Added new topic.

Getting started
8/24/2018 • 2 minutes to read • Edit Online

Applies to Dynamics 365 (online), version 9.x
Applies to Dynamics 365 (online), version 8.x
As a Dynamics 365 administrator, you’ll find the information that you need here to get your organization started
with Dynamics 365.

Terminology used in the product and documentation
8/24/2018 • 2 minutes to read • Edit Online

Applies to Dynamics 365 (online), version 9.x
Applies to Dynamics 365 (online), version 8.x
The following are terms used throughout the Dynamics 365 (online) product and documentation.
TERM

DEFINITION

Tenant

For Dynamics 365 (online), a tenant is the account you create
in the Microsoft Online Services environment when you sign
up for a Dynamics 365 (online) subscription. A tenant
contains uniquely identified domains, users, security groups,
and subscriptions and can contain multiple Dynamics 365
(online) instances.
The tenant created for you has a domain name of
.onmicrosoft.com. For example,
contoso.onmicrosoft.com.

Instance

When you sign up for a trial or purchase a Dynamics 365
(online) subscription, a Dynamics 365 (online) production
instance is created. Each additional production or nonproduction (Sandbox) Dynamics 365 (online) instance you add
creates a separate and isolated Dynamics 365 organization on
the same tenant.
An instance has the URL format: https://.crm.dynamics.com. For example,
https://contososales.crm.dynamics.com.

Multiregional instance

An instance in a different region than where your Dynamics
365 (online) tenant resides. Local instances can provide
quicker data access for users in that region. More information:
Add and edit multiregional instances

Subscription

A subscription consists of the Dynamics 365 licenses and addons included with the trial or paid service you signed up for in
your Dynamics 365 (online) account. Dynamics 365
subscriptions can vary in license type, price, and end date.
For example, a subscription might be 100 licenses of
Dynamics 365 (online) Professional and 10 licenses of
Dynamics 365 (online) Enterprise.

Identity

The user account used to sign in to Dynamics 365 (online).
You can also use this identity to access other Microsoft Online
services, such as Office 365 or SharePoint Online.
Administrators can decide if they want to federate user
identity management between Dynamics 365 (online) and onpremises Active Directory.

TERM

DEFINITION

User account

A user account assigned by an organization (work, school,
non-profit) to one of their constituents (an employee,
student, customer) that provides sign-in access to one or
more of the organization’s Microsoft cloud service
subscriptions, such as Exchange Online or Dynamics 365
(online). Access to an online service is controlled by the license
assigned to the user account.
User accounts are stored in an organization’s cloud directory
within Azure Active Directory, and are typically deleted when
the user leaves the organization. Organizational accounts
differ from Microsoft accounts in that they are created and
managed by admins in the organization, not by the user.

Security group

See also
Manage Microsoft Dynamics 365 (online) instances

If your company has multiple Dynamics 365 (online)
instances, you can use instance security groups to control
which licensed users can access a particular instance. More
information: Control user access to instances: security groups
and licenses

Try Dynamics 365 (online)
8/24/2018 • 4 minutes to read • Edit Online

Applies to Dynamics 365 (online), version 9.x
Applies to Dynamics 365 (online), version 8.x
We're excited about the release of Dynamics 365 (online), version 9.0 and hope you're eager to try it out. New and
existing customers have different options to take a look at Dynamics 365 (online).

Partners and Customizers
If you are a partner signing up on behalf of a customer, or are using this trial for development purposes, go to
https://trials.dynamics.com/Dynamics365/Signup/#. You'll have the choice to add your trial to an existing tenant.
You will also need to decide which apps to install when you start your trial. For more information on which
scenario is right for you, see Installation options below.

New Dynamics 365 (online) customers
If you're a new customer, we've made onboarding quick and easy. See the following for information on these
applications available with Dynamics 365 (online).
Dynamics 365 for Sales
Dynamics 365 for Customer Service
Dynamics 365 for Field Service
Dynamics 365 for Project Service Automation
On any of the above pages, scroll down and click Get Started to start a 30-day trial. For more information on
which scenario is right for you, see the Installation options section below.

Current Dynamics 365 (online) customers
If you already have a Dynamics 365 subscription, there are a couple ways to see the latest version in action.
Start a trial
You can start a 30-day trial of Dynamics 365 (online) and try out one or all of the customer engagement
applications. This trial uses the Dynamics 365 Customer Engagement Plan license.
NOTE
You're allowed one trial per tenant. If you've already done a trial of Dynamics CRM Online or Dynamics 365 (online), you
cannot do another trial. However, you can reset a Sandbox instance to the latest version or to one of the previous versions.
See Use a Sandbox instance below.

To start a trial
1. Go to https://trials.dynamics.com/Dynamics365/Signup/

2. Choose an app. You can add more apps later.
3. If you are customer, fill in the information and choose Get Started (#1).
-OR If you are a partner signing up on behalf of a customer, or are using this trial for development purposes,
choose Sign up here (#2).
For more information about the scenario choices, see the Installation options section below.
TIP
Check out the following videos:
Get the most out of your free 30-day Dynamics 365 trial.
How to buy Dynamics 365.

Use a Sandbox instance
If you already have a Dynamics 365 subscription, you can use a Sandbox instance to try the latest version of
Dynamics 365 (online).
Follow these steps to set up a Sandbox instance of Dynamics 365 (online):
1. Browse to the Office 365 admin center and sign in using Office 365 Global administrator credentials.
2. Click Admin centers > Dynamics 365.
3. Choose the Instances tab.
4. Select the Sandbox instance that you want to provision with the latest version of Dynamics 365 (online), and
then click Reset.

5. Select the Target version, and then select Dynamics 365 (online).
Select a scenario. For more information about the scenario choices, see the Installation options section
below.

TIP
Choose the "None" option to have a blank slate for building your own custom application.

6. Click Reset.

Installation options
You can choose to start a trial for all Customer Engagement offerings, a mix of offerings, or none. Each choice
installs a different set of apps, which are displayed in the app switcher.

The following table shows what’s installed for each choice, what you see in the app switcher, and where you can use
it.

INSTALLATION OPTIONS

Sales
See: Sales Overview

APP MODULES
INSTALLED/SHOWN IN APP
SWITCHER

Sales

DESCRIPTION

AVAILABLE FOR

Full-featured desktopoptimized app for sales
scenarios

Web

INSTALLATION OPTIONS

Customer Service
See: Customer Service
Overview

Field Service
See: Field Service Overview

Project Service Automation
See: Project Service Overview

All

APP MODULES
INSTALLED/SHOWN IN APP
SWITCHER

DESCRIPTION

AVAILABLE FOR

Sales Hub

Mobile-optimized app for
sales scenarios (Unified
Interface)

Web and Mobile

Dynamics 365 (online) custom

Full suite of Dynamics 365
(online) Customer
Engagement capabilities,
including administration

Web

Customer Service

Full-featured desktopoptimized app for service
scenarios (does not include
knowledge management
capabilities)

Web

Customer Service Hub

Desktop (recommended for
knowledge management
only) and mobile-optimized
app (recommended for case
management) (Unified
Interface)

Web and Mobile

Dynamics 365 (online) custom

Full suite of Dynamics 365
(online) Customer
Engagement capabilities,
including administration

Web

Field Service

Full-featured desktopoptimized app for field
service scenarios

Web

Field Resource Hub

Mobile-optimized app for
field service scenarios
(Unified Interface)

Web and Mobile

Dynamics 365 (online) custom

Full suite of Dynamics 365
(online) Customer
Engagement capabilities,
including administration

Web

Project Service Automation

Full-featured desktopoptimized app for project
service scenarios

Web

Project Resource Hub

Mobile-optimized app for
project service scenarios
(Unified Interface)

Web and Mobile

Dynamics 365 (online) custom

Full suite of Dynamics 365
(online) Customer
Engagement capabilities,
including administration

Web

All apps shown above

INSTALLATION OPTIONS

None

APP MODULES
INSTALLED/SHOWN IN APP
SWITCHER

DESCRIPTION

AVAILABLE FOR

Dynamics 365 (online) custom

Full suite of Dynamics 365
(online) Customer
Engagement capabilities,
including administration

Web

CRM Hub

Mobile-optimized app that
provides core CRM
functionality, including
accounts, contacts, and
activities (Unified Interface)

Mobile

Dynamics 365 (online) custom

Full suite of Dynamics 365
(online) Customer
Engagement capabilities,
including administration

Web

See also
Onboard your organization and users to Dynamics 365 (online)
Business apps in Dynamics 365
Manage Microsoft Dynamics 365 (online) instances
Manage subscriptions, licenses, and user accounts

About Unified Interface
10/24/2018 • 4 minutes to read • Edit Online

Applies to Dynamics 365 (online), version 9.x
With the release of Dynamics 365 (online), version 9.0, we've introduced a new user experience - Unified Interface
- which uses responsive web design principles to provide an optimal viewing and interaction experience for any
screen size, device, or orientation.
The new Unified Interface brings all the rich experiences to any client that you are using. Whether you are on a
browser, tablet, or phone, you will be able to consume similar experiences. Some examples:
Similar form experiences to update and view your records.
Interactive dashboards across all devices to view your information and drill into it.
Reference Panel is now available to be used with all entities supported in Unified Interface.
We now support right-to-left (RTL ) languages.
All experiences on Unified Interface have accessibility improvements.

Capabilities available in Unified Interface with Dynamics 365, version
9.0
Most of the core functionalities of sales and customer service have moved to the Unified Interface client.
Dashboards and charts
You can access all the system and user dashboards from within your Unified Interface apps. The interactive
dashboards are now available for all record types with richer interactive dashboard capabilities.

Enhanced user experience
If users work on core record types like Activities, Accounts, Contacts, Leads, Opportunities and Cases, you'll be
able to move them to the Unified Interface client.
They will have familiar capabilities on Unified Interface and will also discover productivity enhancements with the
introduction of some enhanced capabilities.
Timeline control - The timeline view helps you collaborate with your team by tracking customer communication
in a record on a single page in an easy to read view. You can see everything from posts and voice attachments, to
emails and notes. It provides a quick way to see the entire communication thread.

Business process enhancement - The business process flow has been improved by the docking mechanism. You
can dock the business process stage on your screen to help you stay focused on the task at hand in your business
process flow. This is especially useful when the stage of the process has complex steps to complete.
Reference panel - Use the reference panel for apps built on Unified Interface like Dynamics 365 for Customer
Service. The reference panel is a great way to get work done without clicking away from the screen you are on. You
can look up other things like knowledge base articles within the context of the record you are viewing.
Navigation - The new menu options let you swiftly navigate the different apps in the system. It provides quick
access to recently viewed records and pinned favorites.
Reflow - The app also scales by reflowing the components on the screen. The responsive design adapts to your
environment based on screen size, so the more available space that you have the more information can be
displayed.

Focused Experience
Unified interface experiences are based on model-driven apps. You can scope the user experience based on the
jobs they need to accomplish. Users can have single or multiple apps based on their requirements and can easily
switch between apps as needed.
Rich controls
Unified interface is a metadata driven experience. All controls experiences are built on the control framework that
is extensible and provides a uniform experience across clients. The app display reflows to the viewport size the
user is working in.

Getting started with Unified Interface experience
When you are provisioning a new Dynamics 365 org, depending on whether you are provisioning for Sales,
Customer service, Field service, Project service automation, all the options, or an org with no customization, you
will see the following Unified Interface apps:
CHOICE WHILE PROVISIONING

UNIFIED INTERFACE APPS

Sales

Sales Hub

Customer service

Customer Service Hub

Field service

Field Resource Hub

Project service automation

Project Resource Hub

CHOICE WHILE PROVISIONING

UNIFIED INTERFACE APPS

None

Dynamics 365 Hub

All

All the above except Dynamics 365 Hub

NOTE
Dynamics 365 for Marketing always uses the Unified Interface and is provisioned separately.

Accessing Unified Interface apps on browsers
Once provisioned, you can access the installed Unified Interface and web apps from multiple interfaces. On
browsers you can see all the apps both Unified Interface and web:
1. In https://home.dynamics.com/

2. In app navigation

3. In My Apps page under Settings

Accessing Unified Interface apps on phone and tablets
Unified interface apps are the only apps supported on phones and tablets for Dynamics 365, version 9.0. When a
user logs into the above org, they will only see the Unified Interface apps on their apps landing page.

On phone

Creating a new Unified Interface app

On tablet

In case you have requirements to create your own experience on Unified Interface, you can create a model-driven
app using the app designer. See Overview of building model-driven apps.

Capabilities not yet on Unified Interface
We released some capabilities of the legacy web client in the Unified Interface that are available in the hybrid
experience. You can enable the hybrid experience to get them in the browser client.
There are certain capabilities that continue to be unavailable in the Unified Interface and we are working to
provide these in future releases:
Audit Trail
Creating personal charts
Custom styling of advanced chart properties (excluding colors and basic formatting)
Reports entity (experiences to create and manage SSRS reports; excludes Run Report)
Third-party search provider (Coveo search)
Composite address control
Letter, Fax, Recurring Appointments
Campaign management – campaigns, campaign activities, marketing list, and quick campaign
Global notifications
Admin experiences
Editable grids on phones
Learning Path

Read-only entities on Unified Interface

There are certain entities that are currently read-only on Unified Interface. Users will not be able to make changes
to these entity records within an Unified Interface app. We are working to make them editable in future releases.
NOTE
Some entities are being deprecated. Check out Important changes (deprecations) coming.

The following are entities that are currently read-only in Unified Interface:
Connection Role
EmailSignature
Entitlement
KnowledgeArticleViews
KnowledgeBaseRecord
Queue
SharePointDocument
SharePointSite
SLA
SLAKPIInstance
SystemUser
Team
Template
See also
Overview of building model-driven apps

Enable the hybrid experience
9/5/2018 • 2 minutes to read • Edit Online

Most of the core functionalities of sales and customer service have moved to the Unified Interface experience.
Some of the features that are not yet on Unified Interface can now be accessed in the Unified Interface client.
The following features are not yet present in the Unified Interface but can be enabled for display as legacy dialogs
in the Unified Interface through the hybrid experience.
Advanced Find
Bulk edit
Merge records
Record sharing
All options under Set Personal Options ( )
These features are enabled through a setting in System Settings.
1. Go to Settings > Administration > System Settings.
2. Select the General tab.
3. Set Enable embedding of certain legacy dialogs in Unified Interface browser client to Yes.

When you enable the hybrid experience, commands appear on the command bar. For example, when you select an
account, Edit, Merge, and Share commands are available.

You can select Share to share this account with another user or team.

If you disable the hybrid experience, these commands are not available in the command bar.

See also
Contact Technical Support

Volume licensing FAQ
8/24/2018 • 4 minutes to read • Edit Online

Applies to Dynamics 365 (online), version 9.x
Applies to Dynamics 365 (online), version 8.x
As of the December 2016 Update for Dynamics 365 (online), Dynamics CRM functionality is now included as a
part of Dynamics 365, a suite of intelligent business applications. Dynamic 365 unifies customer relationship
management (CRM ) and enterprise resource planning (ERP ) capabilities by delivering new applications to help
manage specific business functions.
Do you offer volume discounts to businesses?
Yes. Discounts are available for Microsoft Dynamics enterprise agreement customers (typically 250+ licenses) who
want to purchase through volume licensing. A Microsoft expert can help you explore the purchasing options for
large enterprises and help you determine which is best for you. More information: Enterprise Agreements
Which volume licensing programs apply to Dynamics 365 (online ) Customer Engagement?
Dynamics 365 (online) Customer Engagement is available through the Enterprise Agreement, Enterprise
Subscription Agreement, and Campus and School Agreement volume licensing programs. The agreement you
select will be on the same billing and contract schedule as any existing volume licensing agreements that you
might have.
Can I move existing licenses from a direct purchase subscription to an enterprise agreement?
Yes. If you who purchased Dynamics 365 (online) with a credit card or through invoicing, you can move to an
enterprise agreement by following these steps:
1. Place an order through a Microsoft Licensing Solutions Partner for Dynamics 365 (online) licenses.
IMPORTANT
It is important to order (at minimum) the same number of licenses and add-ons that you currently have to ensure
that you do not lose data. For example, if you have 50 Professional licenses, 3 additional production instances, and 5
GB of storage, be sure to order the same number of licenses and add-ons (or more).

2. Once the order has been invoiced, the Online Service Manager (OSM ) identified on the enterprise
agreement will receive an activation email, which allows the OSM to sign in to the existing Dynamics 365
(online) account and associate the new licenses to it. The new order will pool with your existing licenses, but
does not cancel the direct purchase subscription.
NOTE
If the purchase was made on an enterprise agreement that already includes Microsoft Online Services licenses, for
example Office 365 or Intune, then the Dynamics 365 (online) licenses will automatically attach to that Microsoft
Online Services account and cannot be associated to your existing Dynamics 365 (online) account. If the licenses need
to be separated, this requires a special amendment from your Microsoft Licensing Sales Specialist.

3. To cancel the direct purchase subscription, open a Service Request through the Admin Portal to contact
Billing Support and inform them that you have purchased a license through volume licensing and request
them to cancel the direct purchase subscription. This step is required in order to discontinue the credit card
or invoice billing.

How can I have the activation email resent?
The activation email is sent to the Online Services Manager (OSM ), who is a participant identified on the
enterprise agreement. If the activation email needs to be resent, call Billing Support to make the request. Please be
prepared to provide company information to verify personally identifiable information (PII).
WARNING
The activation email can only be resent to the OSM. If the OSM is unavailable and the email needs to be sent to a different
contact, please contact your Microsoft Licensing Solutions Partner to request that the OSM information be changed. Once
the information is changed, you will need to make a new request to Billing Support to resend the activation email to the new
OSM.

How do I add more licenses or add-ons, such as additional instances or storage when I have purchased through
volume licensing?
Dynamics 365 (online) customers that purchased their subscription through volume licensing have two options to
add more licenses or purchase add-ons:
Add them through the Volume Licensing Service Center using the License Reservation feature, which allows
you to immediately add licenses or add-ons and then pay for them at the agreement anniversary time.
Licenses are accessible within hours.
Place an order through the standard Purchase Order process through the Microsoft Licensing Solutions
Partner. Licenses are accessible in up to 12 hours after the order is processed by Microsoft.
If I accidentally attach the volume licensing licenses by signing in to the wrong account, how can I move the
licenses to the correct account?
To reassign the account to which your volume licensing agreement licenses are attached, contact Billing Support
and request to have your agreement remapped to a new account.
NOTE
The licenses cannot be remapped to a different account if you already own Microsoft Online Services licenses (Office 365 or
Intune) on the same agreement, because all Microsoft Online Services licenses are attached to the same account.

Where do I find support for my Dynamics 365 (online ) volume licensing invoice?
For assistance with a volume licensing invoice, contact your Microsoft Licensing Solutions Partner.
See also
Enterprise Agreements
Frequently Asked Questions About Product Licensing

Billing FAQs for Dynamics 365 (online) Customer
Engagement
8/24/2018 • 5 minutes to read • Edit Online

Applies to Dynamics 365 (online), version 9.x
Applies to Dynamics 365 (online), version 8.x
Billing support agents for Dynamics 365 often hear similar questions from our customers. To help answer your
billing and subscription management questions as quickly as possible, we’ve put together this list of the most
frequently asked questions.

How do I find the correct Dynamics 365 (online) billing and
subscription support team?
Before contacting Dynamics 365 (online) services billing support, you’ll need to determine which platform your
Dynamics 365 (online) account is hosted on because each platform has its own billing and subscription
management support team. The simplest way to do this is to match your Dynamics 365 (online) account sign-in to
one of the formats listed here:
Microsoft online services platform
If you sign in to your Dynamics 365 (online) account with a user name that follows this format,
email@contoso.onmicrosoft.com , you’re on the Microsoft Online Services environment. To find a contact in billing
and subscription support, you can:
Find your local Dynamics 365 (online) billing support number.
Microsoft commerce transaction platform
If you sign in to your Dynamics 365 (online) account with a user name that follows this format, email@live.com ,
you’re on the Microsoft commerce transaction platform. To find a contact in billing and subscription support, you
can submit a query to CRMAOC@microsoft.com.

What billing activities do I need to contact Dynamics 365 (online)
Billing Support to manage?
The instructions in this section apply equally to subscriptions purchased for Dynamics 365 (online), Microsoft
Social Engagement, as well as Office 365.
You can resolve many billing-related issues by yourself, but there are some requests that only billing support can
resolve. Please refer to the Billing support page if you want to do any of the following:
1. Make a change to billing frequency.
2. Make a change to payment method, that is, change from invoicing to credit card payments outside of
subscription renewal. If you want to change your payment method during subscription renewal, see the
next question for more information.
3. Reactivate an expired account.
4. Cancel a subscription or reduce the number of seats on a subscription. This can also be managed in the
Office 365 admin portal, without having to contact Support.

5. Dispute a charge or clarify a subscription discrepancy.
6. Request a service level agreement (SLA) billing credit.
7. Correct or change a Partner of Record attachment. This can also now be self-managed through the Office
365 admin portal.

When I renew my subscription, can I change my payment method?
During subscription renewal, you can move from credit card to invoice payment, but not from invoice to credit
card. Please refer to the Dynamics 365 (online) tab on the Billing support page if you wish to change from
invoice to credit card payments at subscription renewal time.

How do I purchase Dynamics 365 (online) through Volume Licensing?
If you're interested in placing an order for Dynamics 365 (online) through Volume Licensing, you can find more
information on what the best option is for you by reviewing How Volume Licensing Works. For detailed
information, see Microsoft Volume Licensing Service Center.

How do I extend my Dynamics 365 (online) trial?
You can now extend your free trial on a self-serve extension on the Admin portal for a one-time extension of 30
days. Alternatively, you can submit a service request via the portal or call the Billing Support toll free numbers.
Please note that for self-serve extensions you’re required to enter your credit card information, but your credit
card won’t be charged for trial extensions.

How do I migrate from Dynamics 365 (online) to the on-premises
version of Dynamics 365?
If your organization is considering changing from Dynamics 365 (online) to the on-premises (server-based)
version of Dynamics 365, you will need to work with Technical support.

How do I cancel my Dynamics 365 (online) subscription?
The instructions in this section apply to subscriptions made through Dynamics 365 (online) as well as through
Office 365.
You’ll need to contact billing support to cancel your subscription. To contact billing support, please refer to the
Billing support page.
Before you call, have the following information ready:
1. Billing administrator’s Microsoft account and password.
2. Organization URL and name.
3. The day that you want your subscription to Dynamics 365 (online) terminated.
You should have also made the following decisions:
1. Do you want to keep your existing data? If so, you can export it to Office Excel. For more information, see
Export Data to Excel.
2. Do you want to keep any Internet Marketing service campaigns running? If you’re not the person who
signed up for the marketing service, you must work with that person to cancel or maintain it.
In addition, you can now do a self-serve cancellation of your subscription from the Admin portal.

IMPORTANT
If you cancel today, this subscription will remain active until the end of the billing cycle.

How do I reactivate my expired Dynamics 365 (online) account?
The instructions in this section apply to subscriptions made through Dynamics 365 (online) as well as through
Office 365.
To reactivate an expired Dynamics 365 (online) account, you’ll need to contact billing and subscription support.
Please refer to the Billing support page.
If you saved your data to a Office Excel workbook before canceling your Dynamics 365 (online) account, you
should be able to import the saved data.

How do I apply for a credit due to a Dynamics 365 (online) service
outage?
The instructions in this section are common for subscriptions made through Dynamics 365 (online) as well as
through Office 365.
You may be eligible for a billing credit if your online service level falls below 99.9% availability. For complete
details, including a critical list of exclusions, see the Dynamics 365 Service Level Agreement.
Submit a claim by contacting Billing support. To contact billing support, please refer to the Contact information for
billing support page.

How do I apply for non-profit pricing?
Please refer to the Non-profit pricing page for more information on how to apply.

How to change the Bill to country/region
You need to create a new tenant and the desired bill-to-country/region and purchase the desired offer on the new
tenant. You’ll have to manually export data from the old tenant and import into the new tenant. Finally, you’ll
contact Billing Support to cancel your subscription. To contact billing support, please refer to the Billing support
page. If you require assistance with migrating the data, contact Technical support.
See also
Billing support
Find your Dynamics 365 administrator or support person

Contact information for billing support
8/24/2018 • 2 minutes to read • Edit Online

Applies to Dynamics 365 (online), version 9.x
Applies to Dynamics 365 (online), version 8.x
If you're using Dynamics 365 (online) through an Enterprise Agreement (EA) or Campus Agreement/School
Agreement (CASA) and need to contact Microsoft with a billing question, see Contact support for business
products - Admin Help.
IMPORTANT
For transition related questions, dial the number for your region and then select option 2.

Troubleshoot problems
8/24/2018 • 2 minutes to read • Edit Online

Applies to Dynamics 365 (online), version 9.x
Applies to Dynamics 365 (online), version 8.x
We're sorry you're having a problem with Dynamics 365. Use the following list of troubleshooting topics to quickly
find information to solve your issue.

Outlook and email integration
Frequently asked questions about synchronizing records between Dynamics 365 and Outlook
Troubleshooting and monitoring server-side synchronization
Best practices and things to know about server-side synchronization
Monitor email processing errors

SharePoint integration
Troubleshooting server-based authentication

Mobile
Troubleshooting and things to know about Dynamics 365 for phones and tablets

Dynamics 365 (online)
Troubleshoot sign-in problems
How do I check my online service health?
Help and additional resources for Dynamics 365 (online)
Troubleshooting: Unblock URLs required for Dynamics 365 (online)

Billing and licensing
Billing support
Billing FAQs for Dynamics 365 (online)
Volume licensing FAQ for Dynamics 365 (online) Customer Engagement

Security
Troubleshooting: User needs read-write access to the Dynamics 365 organization

Unified Service Desk
Troubleshoot Unified Service Desk

Other
Troubleshoot problems with data not displaying in a report

Requirements and supported configurations
8/24/2018 • 2 minutes to read • Edit Online

Applies to Dynamics 365 (online), version 9.x
Applies to Dynamics 365 (online), version 8.x
This section describes requirements and supported configurations for Microsoft Dynamics 365.

Microsoft Dynamics 365 (online) requirements
8/24/2018 • 2 minutes to read • Edit Online

Applies to Dynamics 365 (online), version 9.x
Applies to Dynamics 365 (online), version 8.x
Dynamics 365 (online) gives you the following options to access Dynamics 365 data:
Web browser. No need to install anything to run Dynamics 365 (online) from a computer running a
supported web browser.
Dynamics 365 App for Outlook. An Outlook add-in that provides you with a complete set of Dynamics 365
capabilities right within Office Outlook.
Dynamics 365 for phones and Dynamics 365 for tablets. Lightweight applications that let you access
Dynamics 365 data on almost any web browser running on a tablet, smartphone, or non-Windows
computer.

Web browser requirements
You use a common web browser, such as Internet Explorer, Mozilla Firefox, Google Chrome or Apple Safari to
view, add, or edit information stored in your organization’s Dynamics 365 (online) database. For more information
about the supported web browsers and hardware requirements, see Web application requirements for Microsoft
Dynamics 365.

Mobile device requirements
Users can work in Dynamics 365 (online) by using a supported browser on a mobile device, or by using Dynamics
365 for phones. For more information about the mobile experience in Dynamics 365 (online), see Set up Dynamics
365 for phones and Dynamics 365 for tablets.

Microsoft Office requirements
Dynamics 365 leverages the capabilities of on-premises versions of Microsoft Office or Office 365 and integrates
with Office Word and Office Excel. For more information about the supported versions of Microsoft Office, see
Supported versions of Office.
For full Office 365 feature integration with Dynamics 365 (online) and Dynamics 365 (on-premises), you'll need
Office 365 Enterprise E3 or later. Skype for Business PSTN calling and conferencing requires Office 365 Enterprise
E5. Other Office 365 plans are not supported. For more information on licensing and pricing, see:
Dynamics 365 pricing
Dynamics 365 Licensing Guide
See also
Get started administering Microsoft Dynamics 365 (online)
Plan for Microsoft Dynamics 365 (online) Deployment and Administration

Plan for deployment and administration
8/24/2018 • 4 minutes to read • Edit Online

Applies to Dynamics 365 (online), version 9.x
Applies to Dynamics 365 (online), version 8.x
Your Dynamics 365 (online) deployment will go more smoothly with some preliminary planning. The following
table lists some of the items to consider before you start the actual deployment process.
ITEM

DESCRIPTION

CONSIDERATIONS

Environment discovery

A detailed description of your
organization’s environment in terms of
number of users, groups or teams, and
the number and type of business units
or divisions. Identify current Dynamics
365 data that you would like to bring
into Dynamics 365 (online), and your
overall data storage requirements.
Include a business requirements
analysis that describes your
organization’s expectation or
requirements for a service level
agreement (SLA). An SLA is an
agreement between two or more
parties describing the deliverables,
support, and communication that each
party will provide to the other. Specify
your policies related to security and
privacy.

Is there enough overlap in customers
and products across business units to
be able to work in the same Dynamics
365 data? What type of security policy
does the organization already have in
place? Are there any special
requirements in this area? Is there a
plan for business growth that could
affect the number of users of Dynamics
365 (online)?

An authentication process that enables
a user to access multiple systems or
services through a single set of sign-on
credentials. For example, implementing
single sign-on for Dynamics 365
(online) in an organization’s network
environment means that after a user
signs in to the network, that user does
not have to enter credentials again
when accessing Dynamics 365 (online).
Note: For Office 365 subscribers,
Dynamics 365 (online) instance must be
in the same tenant as your Office 365
subscription. A user account in Active
Directory can only sync with one
tenant.

There are additional requirements to
implement single sign-on, therefore,
consider how important it is to your
organization.

Single sign-on

Plan for enough time to do this
discovery; information that comes out
of this exercise can affect the way you
implement the service.

More information: Manage user
account synchronization

ITEM

DESCRIPTION

CONSIDERATIONS

Integration with Office 365 applications

You can significantly enhance your
company’s online, collaborative
experience by integrating Office 365
applications with your Dynamics 365
(online) subscription. This requires a
separate purchase of an Office 365
subscription

More information: What is Office 365
and how does it relate to Dynamics 365
(online)?

You’ll have the best integration
experience if your Office 365
subscription and Dynamics 365 (online)
instance are in the same tenant.
For full Office 365 feature integration
with Dynamics 365 (online) and
Dynamics 365 (on-premises), you'll
need Office 365 Enterprise E3 or later.
Skype for Business PSTN calling and
conferencing requires Office 365
Enterprise E5. Other Office 365 plans
are not supported. For more
information on licensing and pricing,
see:- Dynamics 365 pricing
- Dynamics 365 Licensing Guide
Administrative roles in the Microsoft
Online Services environment

A number of administrative roles are
available to assign to users if you
manage your subscription in the
Microsoft Online Services environment.
Administrative roles define
administrative responsibilities related to
subscription management activities, for
example, billing administration,
password administration, and user
management administration.

Consider the available administrative
roles and the needs of your
environment to identify the roles you
want to use and the users you will
choose for each role. The global
administrator role is the highest level
role, having all the permissions to
manage any part of the subscription
process. We recommend that you
assign this role to more than one
person so that someone is always
available to manage all aspects of the
subscription. Note: Administrative roles
cover all subscription management
functions within the service. These
aren’t the same as the security roles
that you assign to users in Dynamics
365 (online), which are required and
govern access to resources in the
Dynamics 365 (online) service. See
“Security roles in Dynamics 365
(online)” in this table.

Security roles in Dynamics 365 (online)

Dynamics 365 (online) uses role-based
security. The security role assigned to a
user determines the tasks the user is
permitted to perform and the data that
the user is permitted to view.

Every user must be assigned at least
one security role to access Dynamics
365 (online). Note: Security roles aren’t
the same as administrative roles in the
Microsoft Online Services environment,
which cover subscription management
and related activities in the Office 365
admin portal. See: Administrative roles
in the Microsoft Online Services
environment in this table.

ITEM

DESCRIPTION

CONSIDERATIONS

Importing data

Dynamics 365 (online) offers a wizard
to help with importing Dynamics 365
data from other applications and
services.

If you import data from other systems,
consider the way you’ll process the data
to minimize errors. More information:
Import data (all record types)

Product updates

Some Dynamics 365 (online) releases
will include optional product updates
that you can choose to enable.

Product updates may affect existing
customizations in your Dynamics 365
(online) instance. Review the
documentation associated with each
product update before you enable it in
a production environment. Additionally,
some product updates, such as the
sales and service process forms, can’t
be removed or easily reverted to the
previous functionality. Therefore, you
should give careful consideration before
you enable a product update. More
information: Manage product updates
Tip: If you’re unsure whether you want
to enable a product update in a
Dynamics 365 (online) instance used in
production, sign up for a trial
subscription to evaluate the new
functionality. More information: Sign up
for a free trial

See also
Manage your Microsoft Dynamics 365 (online) subscription
Microsoft Dynamics 365 (online) Requirements
Grant users access to Microsoft Dynamics 365 (online) as a Microsoft Online service

Supported web browsers and mobile devices
8/24/2018 • 2 minutes to read • Edit Online

Applies to Dynamics 365 (online), version 9.x
Applies to Dynamics 365 (online), version 8.x
Users can access the Dynamics 365 Web application with the most recent versions of these popular browsers:
Internet Explorer
Microsoft Edge
Firefox
Chrome
Safari
For more detailed information about supported browsers, see Web application requirements for Dynamics 365.
For a mobile device, such as an iPad or smartphone, the following apps are available:
Dynamics 365 for iPad
Dynamics 365 for Windows 8
For more detailed information about supported phones and tablets, see Microsoft Dynamics 365 mobile and tablet
device support.
NOTE
Users who try to view Dynamics 365 on an unsupported browser may be redirected to a mobile experience.
For Dynamics 365 (online), version 9.0 and later, users are redirected to the Unified Interface experience. For more
information see Unified Interface Overview.
For versions earlier than Dynamics 365 (online), version 9.0, users are redirected to CRM for phones express. This
is a basic service that has limited functionality, and isn’t intended to serve as a substitute for the full feature set of
Dynamics 365. We recommend that users choose a supported browser or a Dynamics 365 app specific to the
device.
If you have added content to forms or dashboards in an iFrame, you might have implemented security restrictions around
certain actions in that content, such as external links. Keep in mind that in Firefox, this security restriction code will likely
be unsupported.

Known issues when you run Microsoft Dynamics 365 with certain web
browsers
This section describes the known issues when you run Dynamics 365 in a web browser.
Limited copy and paste support in Firefox and Chrome
Copy and paste functionality by using the clipboard is not yet fully supported on the Firefox and Chrome web
browsers; the Copy a Link button at the top of the page may not function as expected.
You receive an error opening an Excel worksheet when you use Safari
If you export an Office Excel worksheet as a Dynamic Worksheet while using Safari, you may receive an error

when trying to open the file. To remedy this, right-click the file, click Get Info, and, under Open With, select Excel.
See Also
Key preparation and configuration tasks Supported web browsers and mobile devices - earlier versions

Web application requirements
9/8/2018 • 4 minutes to read • Edit Online

Applies to Dynamics 365 (online), version 9.x
Applies to Dynamics 365 (online), version 8.x
This section lists the hardware and software requirements for the Dynamics 365 (on-premises) and Dynamics 365
(online) web and mobile device client applications.

Dynamics 365 web application hardware requirements
The following table lists the minimum and recommended hardware requirements for the Dynamics 365 web
application.
COMPONENT

MINIMUM

RECOMMENDED

Processor

1.9 gigahertz (GHz) x86- or x64-bit
dual core processor with SSE2
instruction set

3.3 gigahertz (GHz) or faster 64-bit
dual core processor with SSE2
instruction set

Memory

2-GB RAM

4-GB RAM or more

Display

Super VGA with a resolution of 1024 x
768

Running Dynamics 365 on a computer that has less than the recommended requirements may result in
inadequate performance. Additionally, satisfactory performance may be experienced running systems that use a
different hardware configuration than those published here—for example, a system with a modern quad-core
processor, lower clock speed, and more RAM.
Network requirements
Dynamics 365 is designed to work best over networks that have the following elements:
Bandwidth greater than 50 KBps (400 kbps)
Latency under 150 ms
Notice that these values are recommendations and don’t guarantee satisfactory performance. The recommended
values are based on systems using out-of-the box forms that aren’t customized. If you significantly customize the
out-of-box forms, we recommend that you test the form response to understand bandwidth needs. More
information: Verify network capacity and throughput for Dynamics 365 clients
Network requirements when you use Dynamics 365 interactive service hub experience
The Dynamics 365 interactive service hub experience is designed to work best over networks that have the
following elements:
Bandwidth greater than 1Megabit per second (125 KBps/Kilobyte per second)
Latency under 150 ms
Notice that the suggested network requirements include the metadata download needed for first run or newly
published customizations. The Dynamics 365 interactive service hub typically requires more bandwidth when
metadata has to be downloaded. These values are recommendations and don’t guarantee satisfactory

performance. The values are based on systems using uncustomized, out-of-the box forms. If you significantly
customize the out-of-box forms, we recommend that you test the form response to understand bandwidth needs.

Supported versions of Internet Explorer and Microsoft Edge
The following table describes the Windows and Internet Explorer or Microsoft Edge versions supported for use
with the Dynamics 365 web application.
WINDOWS VERSION

INTERNET EXPLORER 10

INTERNET EXPLORER 11 3

MICROSOFT EDGE

Windows 10

Not supported 1

Supported

Windows 8.1

Not supported 1

Supported

Not supported

Windows 8

Limited support 2

Not supported 1

Not supported

Windows 7

Limited support 2

Supported

Not supported

1 This version of Windows doesn’t support the version of Internet Explorer. More information:

Internet Explorer 11

– FAQ for IT Pros
2 Supported with the classic web application. Not supported with Unified Interface apps.
3 Check requirements for individual apps, such as Customer Service Hub application requirements.
IMPORTANT
Although you may be able to use Internet Explorer 8, Internet Explorer 9, or an Internet Explorer and Windows combination
that is not supported in the previous table, those web browsers are not recommended and are not supported with this
version of Dynamics 365.
Using plug-ins or other third-party extensions in your browser can increase load times on pages with lists of data.

Supported non-Internet Explorer web browsers
The Dynamics 365 web application can run in any of the following web browsers running on the specified
operating systems:
Mozilla Firefox (latest publicly-released version) running on Windows 10, Windows 8.1, Windows 8, or
Windows 7
Google Chrome
Google Chrome (latest publicly-released version) running on Windows 10, Windows 8.1, Windows 8,
Windows 7, or Google Nexus tablet
Google Chrome (latest publicly-released version) running on Mac OS X 10.8 (Mountain Lion), 10.9
(Mavericks), or 10.10 (Yosemite)
Apple Safari (latest publicly-released version) running on Mac OS X 10.8 (Mountain Lion), 10.9 (Mavericks),
10.10 (Yosemite), or Apple iPad
To find the latest release for these web browsers, visit the software manufacturer’s website.
IMPORTANT
Using plug-ins or other third-party extensions in your browser can increase load times on pages with lists of data.
Mozilla Firefox ESR (Extended Support Release) versions aren’t supported.

Supported versions of Office
To use Dynamics 365 with Microsoft Office integration features, such as Export to Excel and Mail Merge, you must
have one of the following Microsoft Office versions on the computer that is running the Dynamics 365 web
application:
Office 365
Office 2016
Office 2013
Office 2010
For full Office 365 feature integration with Dynamics 365 (online) and Dynamics 365 (on-premises), you'll need
Office 365 Enterprise E3 or later. Skype for Business PSTN calling and conferencing requires Office 365 Enterprise
E5. Other Office 365 plans are not supported. For more information on licensing and pricing, see:
Dynamics 365 pricing
Dynamics 365 Licensing Guide

Printing reports
The Reporting ServicesMicrosoft ActiveX control is required to print reports. If you try to print a report and the
control isn’t installed, you’ll be prompted to install it. The installer package is named RSClientPrint.cab and can
found on the SQL Server Reporting Services server at :\Program files\Microsoft SQL Server\
\Reporting Services\ReportServer\bin.

Transport Layer Security (TLS) requirement
With the Dynamics 365 (online), version 9.0, web browsers and other client applications that only use Transport
Layer Security (TLS ) versions earlier than TLS 1.2 will be unable to connect to their Dynamics 365 (online)
instances and the Dynamics 365 admin center.
For more information, see these blog posts:
Updates coming to Dynamics 365 Customer Engagement connection security
TLS 1.2 support at Microsoft
See also
Supported web browsers and mobile devices

Support for devices
8/24/2018 • 2 minutes to read • Edit Online

Applies to Dynamics 365 (online), version 9.x
For information about Dynamics 365 support for mobile devices, see What's supported in the Phones and Tablets
Administrator Guide.

Manage subscriptions, licenses, and user accounts
8/24/2018 • 2 minutes to read • Edit Online

Applies to Dynamics 365 (online), version 9.x
Applies to Dynamics 365 (online), version 8.x
As a Microsoft Online Services environment administrator, you manage the Dynamics 365 (online) subscription,
including billing and payments, user licenses, accounts and registration. You do these tasks in the Office 365
admin center.
See also
Manage Microsoft Dynamics 365 (online) instances
Terminology used in the product and documentation

Reset a user's password
8/24/2018 • 2 minutes to read • Edit Online

Applies to Dynamics 365 (online), version 9.x
Applies to Dynamics 365 (online), version 8.x
If a user loses a password, you can reset it. To reset a user’s password, you must be a Microsoft Online Services
environment global administrator, user management administrator, or password administrator.
For step-by-step instructions, see Reset a User’s Password.
NOTE
The reset password is temporary. The user must change the temporary password at the next sign in. To help users meet the
requirements for creating a new password in the Microsoft Online Services environment, see Set a user's password expiration
policy.

See also
Manage subscriptions, licenses, and user accounts

Manage email notifications to admins
8/24/2018 • 2 minutes to read • Edit Online

Applies to Dynamics 365 (online), version 9.x
Applies to Dynamics 365 (online), version 8.x
The Dynamics 365 (online) service team regularly sends email notifications to the administrators in your
Dynamics 365 organization. Now, with a simple approach of mailbox rules, you have complete control over who
should receive these email communications. As an administrator, you can set up mailbox rules to automatically
redirect email communications from Dynamics 365 (online) (crmoln@microsoft.com) to additional recipients that
you choose. For example, you can add to the list of recipients:
People outside of your Dynamics 365 organization, such as your partners.
People inside and outside of your company.
All redirected emails retain the original sender context, such as Dynamics 365 (online)
(crmoln@microsoft.com).
You can automatically redirect the email notifications in Exchange Server 2010 or later versions. You can
also set up automatic email redirection in the following deployments:
Microsoft Exchange Server on-premises deployment
Office 365 – Exchange Online service
Hybrid deployment: Exchange Server on-premises and Office 365 subscription with Exchange Online
Email deployments other than Exchange
If you have been added as an additional recipient, and you want to stop receiving email notifications, please
contact your Dynamics 365 admin. If you’re not sure who your Dynamics 365 admin is, see: Find your
Dynamics 365 administrator or support person.
For more information, download the white paper: Create your Mailbox rule

Send email notifications to multiple recipients
By default, Dynamics 365 admins will receive update notifications. You can add others to receive update
notifications.
1. Sign in to https://portal.office.com.
2. On the Office 365 menu bar, click Admin centers > Dynamics 365 > Instances tab.
3. Choose an instance that has notifications you want to change.
4. Click Notifications.

5. Enter the email addresses of people to receive update notifications for the selected instance and click Save.

See also
Blog: Managing Email notifications in Microsoft Dynamics CRM Online
Blog: Identifying Your Microsoft Dynamics CRM Online Administrator(s)

Purchase and assign Dynamics 365 (online) licenses
8/24/2018 • 2 minutes to read • Edit Online

Applies to Dynamics 365 (online), version 9.x
Applies to Dynamics 365 (online), version 8.x
Dynamics 365 introduces a new licensing model with choices that extend to pricing with Dynamics 365. Get
monthly plans—with apps packaged for savings—or standalone applications. Opt for full or light use. And select
the edition that meets the needs of your large or small business, now and down the road.
TIP
Get started with the following resources:
Important information for CRM Online customers
Download: Dynamics 365 Licensing Guide
Video: How to buy Dynamics 365
Dynamics 365 Pricing
Download: Microsoft Dynamics 365 Licensing Guide

Purchase a Dynamics 365 (online) license
1. Browse to the Office 365 admin center and sign in as a global admin.
2. Click Billing > Purchase Services.

3. Select the subscription that best fits your company's Dynamics 365 needs.
4. Click Buy now and then follow the steps to purchase a new license.

Assign a license to a user
1. Browse to the Office 365 admin center and sign in as a global admin.
2. Click Users > Active users.
3. Select multiple users, and then click Edit product licenses.

4. Click Replace existing product license assignments, and then click Next.
5. Turn on the license for your Dynamics 365 plan.

6. Click Replace, and then click Close twice.
7. Review the license status on the Active users page and make other assignments as needed.

PowerApps licensing
On March 21, 2018, we introduced PowerApps integration with Dynamics 365 for Customer Engagement. See
the blogs PowerApps Spring Update and What’s new in the Dynamics 365 admin center.
Dynamics 365 and PowerApps are now based on the same platform that powers Dynamics 365. PowerApps users
appear as users in Dynamics 365 via Settings > Security > Users. What users can do and the security role
assigned to them is scoped to PowerApps and Flow applications managed by environment administrators. See
Configure environment security.
PowerApps users can be licensed in multiple ways. They can be assigned a license by a Global administrator of
PowerApps, Flow or many of the Office 365 user licenses (almost all Office 365 user license types) that include
PowerApps capabilities. PowerApps users can also be licensed via self-serve sign-up. See Manage licenses in my
org.
TIP
You can use security groups to control which licensed users can be a member of a particular instance by assigning a security
group to your Dynamics 365 (online) instances. See Control user access to instances: security groups and licenses.

See also
Important information for CRM Online customers
Manage Microsoft Dynamics 365 (online) licenses
Manage subscriptions, licenses, and user accounts
Onboard your organization and users to Dynamics 365 (online)
Business apps in Dynamics 365

Manage licenses
8/24/2018 • 2 minutes to read • Edit Online

Applies to Dynamics 365 (online), version 9.x
Applies to Dynamics 365 (online), version 8.x
When you purchase a subscription to Dynamics 365 (online), you receive a set of licenses to assign to users. Only
licensed users are allowed access to the online service. You must assign a license to every user who will use the
service.
A license conflict occurs if your organization has more users than licenses.
TIP
Get started with the following resources:
Important information for CRM Online customers
Download: Dynamics 365 Licensing Guide

Running out of Dynamics 365 (online) licenses?
If you are running out of licenses, you have several options:
Add licenses to your subscription and then assign licenses to users.
For step-by-step instructions for adding licenses to a subscription that is managed through Microsoft
Online Services, see Manage licenses.
Remove licenses from other users. This disables the user account in Dynamics 365 (online) and frees up the
license so that you can re-assign it.
For step-by-step instructions for removing a license that you manage through Microsoft Online Services,
see Manage licenses.
Remove a user account by deleting it. This disables the user account in Dynamics 365 (online) and frees up
the license so that you can re-assign it.
TIP
Delete the user accounts of people who leave your company. This frees up the licenses so that you can re-assign
them.

For step-by-step instructions about deleting a user account that you manage through Microsoft Online
Services, see Delete or restore users.
If a license conflict occurs because your credit card information has become outdated in Microsoft Online
Services, you can renew your subscription by updating the credit card information, for example, by updating
the card’s expiration date, or by adding a new credit card.
For step-by-step instructions for updating credit card information, see Update your credit card information.

IMPORTANT
Signing out of the Office 365 Admin Center doesn't sign you out of Dynamics 365 (online). You must do that separately.

To cancel your subscription to Dynamics 365 (online) for any reason, call Billing Support at the phone number
listed for your country or region here: Billing Support and Phone Numbers.
NOTE
If you don’t have access to a phone, you may submit your cancellation request as a service request. To enter the service
request, sign in to your account, and then, under Support, click or tap Service Requests. In the Problem Description
area, fill out the form for a new service request by choosing Cancel subscription.

IMPORTANT
Save your Dynamics 365 (online) data to a location where you can retrieve it later, if needed.

See also
Important information for CRM Online customers
Manage subscriptions, licenses, and user accounts
Create users and assign Microsoft Dynamics 365 (online) security roles

Manage user account synchronization
8/24/2018 • 2 minutes to read • Edit Online

Applies to Dynamics 365 (online), version 9.x
Applies to Dynamics 365 (online), version 8.x
Because Dynamics 365 (online) user identities are provisioned through Microsoft Online Services, you have
multiple options for managing user synchronization between your online and on-premises environments.

Decide on a user management approach
You can choose from three main identity models in Office 365 when you set up and manage user accounts:
1. Cloud identity. Manage your user accounts in Office 365 only. No on-premises servers are required to
manage users; it's all done in the cloud.
2. Synchronized identity. Synchronize on-premises directory objects with Office 365 and manage your
users on-premises. You can also synchronize passwords so that the users have the same password onpremises and in the cloud, but they will have to sign in again to use Office 365.
3. Federated identity. Synchronize on-premises directory objects with Office 365 and manage your users
on-premises. The users have the same password on-premises and in the cloud, and they do not have to
sign in again to use Office 365. This is often referred to as single sign-on.
It’s important to carefully consider which identity model to use to get up and running. Think about time, existing
complexity, and cost. These factors are different for every organization. Your choice is based largely on the size of
your company and the depth and breadth of your IT resources.
Review the following resources to equip you to make the right decision for your company:
Understanding Office 365 identity and Azure Active Directory
What is Azure AD Connect?
Office 365 integration with on-premises environments

Tip for admins: provide a single sign-on organization URL for your
users
If you’ve deployed synchronization with single sign-on (option 3 above), you can provide a URL to your users that
takes advantage of your company’s Active Directory and simplifies the sign-in experience.
The URL follows this pattern:
https://.crm.dynamics.com?whr=
You can get the by looking at the URL you use to access Dynamics 365 (online).
For example, in https://contoso.crm.dynamics.com, contoso is .

IMPORTANT
The following URLs would be used for subscriptions hosted in these locations.
LATAM/SAM: https://.crm2.dynamics.com?whr=
CAN: https://.crm3.dynamics.com?whr=
EMEA: https://.crm4.dynamics.com?whr=
APAC: https://.crm5.dynamics.com?whr=
OCE: https://.crm6.dynamics.com?whr=
JPN: https://.crm7.dynamics.com?whr=
IND: https://.crm8.dynamics.com?whr=
United States of America Government: https://< yourCRMorganizationname>.crm9.dynamics.com?whr=

UK: https://.crm11.dynamics.com?whr=
DEU: https://.crm.microsoftdynamics.de?whr=

You can get the Federation Service identifier for your organization by using the following steps:
1. On the server that is running AD FS 2.0, click or tap Start > Administrative Tools > AD FS 2.0
Management.
2. In the console tree, right-click or tap AD FS 2.0, and then click or tap Edit Federation Service Properties.
3. Select the General tab.
Make note of your Federation Service identifier. For example: http://sts1.fabrikam.com/adfs/services/trust
Your URL should look like: https://contoso.crm.dynamics.com?
whr=http://sts1.fabrikam.com/adfs/services/trust
Send this URL to your Dynamics 365 (online) users and encourage them to bookmark it.

Grant users access
8/24/2018 • 5 minutes to read • Edit Online

Applies to Dynamics 365 (online), version 9.x
Applies to Dynamics 365 (online), version 8.x
To have users up and running in Dynamics 365 (online), you complete some administrative tasks in the Office
365 Admin Center—which you generally do only once—followed by administrative tasks in Dynamics 365
(online).
Dynamics 365 (online) is an online service subscription. When you signed up for this service, you received a set
of licenses with your subscription, one license for each user. You can purchase additional licenses if you need
them.
As described in step one that follows, in the Office 365 Admin Center, register your users so that they are
recognized in the Microsoft Online Services environment, assign a license to each user, and then assign
administrative roles to the users you choose to fill those roles. More information: Assigning admin roles
In Dynamics 365 (online), populate the service with your organization’s data, including users and their security
roles, business units, and any existing Dynamics 365 data that you want to import from other applications or
services. If your organization uses business units, assign users to the appropriate business unit, and then assign a
security role to each user. Dynamics 365 (online) includes predefined security roles that aggregate a set of user
permissions to simplify user security management. An organization can define additional roles or edit predefined
security roles to meet its unique security needs. For more information about security roles in Dynamics 365
(online), see Security roles and privileges.
IMPORTANT
Users can’t access Dynamics 365 (online) until they’ve been assigned at least one security role. See Step Two: Assign
security roles in Dynamics 365 (online).

Differences between the Microsoft Online services environment
administrative roles and Dynamics 365 (online) security roles
Administrative roles are available to assign to users in the Office 365 admin portal. The administrative roles cover
a set of rights and permissions related to managing the service subscription, such as adding users and assigning
licenses. The global administrator role has rights to control every aspect of the subscription and to add
subscriptions to other online services. The password administrator role has rights to reset a user’s password,
create service requests, and monitor the service.
Security roles are assigned within Dynamics 365 (online) and cover rights and permissions-related aspects, for
example, permission to update records or to publish customizations.
The roles are similar in that both types contain aggregated sets of permissions that allow access to some items
and not to others, and that allow some actions to be taken but not others. The roles are different in that the first
one applies to the management of the subscription but not to the service itself, and the second applies only within
the service.
Using roles is a powerful way to group a set of rights that are common to a job title or business unit. This way, the
administrator can grant a whole set of permissions to users simply by assigning a user or group of users to a
given role.

Step One: Provision users, and assign licenses and administrative roles
in the Office 365 admin center
Your organization’s subscription to Dynamics 365 (online) provides access to the Office 365 Admin Center
through a global administrator account. The global administrator manages every aspect of the subscription and
may add subscriptions to other Microsoft Online Services.
As the global administrator for your organization, one of your first tasks is to create users in the Office 365
Admin Center. This registers users in the system and enables users to be licensed to use services available within
the online service environment. You decide which service you want your users to have by assigning a license for
that service to a user. For instructions about creating users in the Microsoft Online Services environment, see
Create or edit users in Office 365. For instructions about assigning a license to a user, see Assign or remove
licenses, or view a list of unlicensed users.
During your planning phase, you might have identified a set of key administrative roles that you want to fill. More
information: Plan for Microsoft Dynamics 365 (online) deployment and administration. Because the
administrative roles provide coverage for administrative tasks when the global administrator is not available, it’s a
best practice to assign these roles to users, including assigning the global administrator role to a second user.
More information: Assigning admin roles and Permissions in Office 365.
The online service sends an invitation to each user
After you set up a user in the Office 365 Admin Center, that user receives an email invitation with a link and a
password for the Microsoft Online Services environment. The credentials in the invitation provide access to the
portal and to documentation. However, the users who receive these invitations can’t access Dynamics 365
(online) until you complete step two in this process.

Step Two: Assign security roles in Dynamics 365 (online)
Sign in to Dynamics 365 (online) and add business units (if your organization needs more than one business
unit), and assign security roles and business units to users. The users you registered with the online service in
step one are automatically added to Dynamics 365 (online). After you assign at least one security role to a user,
that user can click the link in the email invitation, enter credentials, and begin using Dynamics 365 (online). More
information: Assign a security role to a user.
IMPORTANT
Before you start adding information to Dynamics 365 (online), we recommend that you turn off or disable your browser’s
pop-up blocker. Pop-up blockers can block data-entry dialog boxes in Dynamics 365 (online). For more information about
browser and other settings for improved product performance, see Key preparation and configuration tasks.

You might have Dynamics 365 data located in other systems. In your planning phase, you considered how you’ll
import this data. Before you invite users into Dynamics 365 (online), ensure that you have completed the data
migration process. More information: Import data (all record types).
See also
Get started administering Microsoft Dynamics 365 (online)
Plan for Microsoft Dynamics 365 (online) deployment and administration
Manage subscriptions, licenses, and user accounts
Import data (all record types)

Restrict access with trusted IP rules
8/24/2018 • 2 minutes to read • Edit Online

Applies to Dynamics 365 (online), version 9.x
Applies to Dynamics 365 (online), version 8.x
You can limit access to Dynamics 365 (online) to users with trusted IP addresses to reduce unauthorized access.
When trusted IP address restrictions are set in a user’s profile and the user tries to log in from an untrusted IP
address, access to Dynamics 365 (online) is blocked.
Requirements
A subscription to Azure Active Directory Premium.
A federated or managed Azure Active Directory tenant.
Federated tenants require that multi-factor authentication (MFA) be enabled.

Additional security considerations
IP restriction is only enforced during user authentication. This is done by the Azure Active Directory Conditional
Access capability. Dynamics 365 (online) sets a session timeout limit to balance protecting user data and the
number of times users are prompted for their sign-in credentials. Trusted IP restriction for devices (including
laptops) is not applied until the Dynamics 365 (online) session timeout expires.
For example, a trusted IP restriction is setup to only allow access to Dynamics 365 when users are working from a
corporate office. When a Dynamics 365 user signs in into Dynamics 365 using their laptop from their office and
establishes a Dynamics 365 session, the user can continue to access Dynamics 365 after leaving the office until the
Dynamics 365 session timeout expires. This behavior also applies to mobile and offsite connections such as:
Dynamics 365 for phones and tablets, and Dynamics 365 App for Outlook.

Create security group (optional)
You can restrict access to all Users or groups of users. It's more efficient to restrict by a group if only a subset of
your Azure Active Directory (AAD ) users are accessing Dynamics 365 (online).
1. Sign in to your Azure portal.
2. Click Browse > Active Directory, and then select your Dynamics 365 (online) directory.
3. Click Groups > Add Group, and then fill in the settings to create a new group.

4. Click the group you created and add members.

Create a location based access rule
Access restriction is set using Azure Active Directory (AD ) Conditional Access. See Getting started with conditional
access to Azure AD. You control Conditional Access through an access rule.
NOTE
Setting Conditional Access is only available with an Azure Active Directory Premium license. Upgrade your Azure AD to a
Premium license in the Office 365 admin center (https://portal.office.com > Billing > Purchase services).

1. Sign in to your Azure portal.
2. Click Browse > Active Directory, and then select your Dynamics 365 (online) directory.
3. Click Applications, and then click the Dynamics 365 Online web application.

4. Click Configure.

5. Set the following on the Properties page:
a. Set Enable Access Rule to On.
b. Optional: Set Apply to to Groups.
c. Optional: Click Add Group to select a group.
d. Set Rules to Block access when not at work.

e. Click Save > OK.
f. Click Click here to define/edit your work network location.

6. Enter trusted IP addresses (using CIDR notation).

7. Click Save.
See also
How to set Azure Active Directory device-based conditional access policy for access control to Azure Active
Directory connected applications

Invite users with Azure Active Directory B2B
collaboration
8/24/2018 • 4 minutes to read • Edit Online

Applies to Dynamics 365 (online), version 9.x
Applies to Dynamics 365 (online), version 8.x
You can invite other users to access your Dynamics 365 (online) instance. The Office 365 Global admin can do this
through the Azure portal. Invited users can access your Dynamics 365 (online) instance using their own login
credentials once a Dynamics 365 license and a security role are assigned to them. You don’t need to create a new
user account and temporary password for these invited users in your own Office 365 tenant.

Requirements
To send business-to-business (B2B ) user invitations, you must have an Azure Active Directory Global admin
role.
To bulk- invite users, get the latest Azure Active DirectoryPowerShell which can be downloaded from the
PowerShell module's release page.

Incompatibilities
The following Dynamics 365 features are not supported for B2B invited users.
1. Unified Service Desk client
Invited users will not be able to use the Unified Service Desk client to log into the host tenant’s Dynamics
365.
2. Dynamics 365 App for Outlook
Invited users will not be able to use their own tenant email addresses when performing email related
transactions in the host Dynamics 365 instance. Server-side synchronization of invited users’ incoming and
outgoing emails are not supported as there can be complications, especially for invited users who are
already syncing their emails in their own Dynamics 365 tenant.
3. Invited users cannot perform email activity using their own email address. Dynamics 365 (online) only
synchronizes incoming and outgoing emails from Microsoft Exchange Online that is hosted in the same
Office 365 tenant.
4. Office 365 Groups
Office 365 Groups for Dynamics 365 connects a group to Dynamics 365 (online). Data (including new
conversations and documents) are stored in the Exchange and/or SharePoint system. Since invited users
belong to a different Office 365 tenant, the invited users do not have permission to create Office 365
Groups in the invited-to Office 365 tenant. However, they can participate in the Office 365 Groups
conversations as a guest in their Outlook Inbox, but not within Dynamics 365 (online).

Invite a user
You can add users to Dynamics 365 through Azure Active Directory B2B user collaboration. Global admins and
limited admins can use the Azure portal to invite B2B collaboration users to the directory, to any security group, or

to any application.
Admins can use one of the following methods to invite B2B users to their Dynamics 365 instance:
1. Invite users to your Dynamics 365 instance that has a security group.
See Admins adding guest users to a group.
See Control user access to instances: security groups and licenses on how to use security groups for
your Dynamics 365 instances.
2. Invite users to your Dynamics 365 instance that does not have a security group.
See Admins adding guest users to the directory.
3. Bulk-invite guest users using a .csv file.
See PowerShell example.
Your invited user will receive an email invitation to get started with B2B user collaboration.

When your user accepts the invitation by clicking on the Get Started link on the invitation email, they will
be prompted to accept the invitation.

NOTE
Until you add a license to the user account, the user will not have access to Dynamics 365 (online). Follow the steps below to
add a Dynamics 365 license through the Azure portal.

Update user’s name and usage location
To assign a Dynamics 365 (online) license, the invited user’s Usage location must be specified. Admins can
update the invited user’s profile on the Azure portal.

1. Go to Azure Active Directory > Users and groups > All users. If you don't see the newly created user,
refresh the page.
2. Click on the invited user, and then click Profile.

3. Update First name, Last name, and Usage location.

4. Click Save, and then close the Profile blade.

Assign invited users a Dynamics 365 license and security role
Assign your invited users a Dynamics 365 (online) license and security role so the user can use Dynamics 365.
1. Go to Azure Active Directory > Users and groups > All users. If you don't see the newly created user,
refresh the page.
2. Click on the invited user, and then click Licenses.

3. Click Assign.
4. Click Configure required settings.
5. Select the Dynamics 365 product to license.

6. Click Select, and then click Assign.
Next, assign the invited users with appropriate security roles for the Dynamics 365 instance so they can
access it. See Create users and assign Dynamics 365 (online) security roles.

Update invited user’s email address in the invited-to Dynamics 365
instance
If you're using a version prior to Dynamics 365, you need to update the invited user’s email address. In Dynamics
CRM, go to Settings > Security > Users. Select a user, and then update the invited user’s email address.

Approve email or enable mailbox (not supported)
Since server-side synchronization is not supported, Dynamics 365 System admins cannot approve an invited email
address or mailbox since emails cannot be synced from the invited user’s Microsoft Exchange.

Notify your invited users
To complete the user invitation, notify your invited users and provide them with the URL for the instance they are
invited to (for example, https://contoso.crm.dynamics.com).
See also

Azure AD B2B Collaboration is Generally Available!
Azure Active Directory B2B collaboration code and PowerShell samples
Azure Active Directory B2B collaboration frequently-asked questions (FAQ )
Azure Active Directory B2B Collaboration
Azure AD B2B: New updates make cross-business collab easy

Global and Service administrators can administer
without a license
8/24/2018 • 2 minutes to read • Edit Online

Applies to Dynamics 365 (online), version 9.x
Applies to Dynamics 365 (online), version 8.x
By default, all Office 365 Global administrators and Office 365 Service administrators who do not have a
Dynamics 365 (online) license are granted the following two levels of permission in Dynamics 365 (online).
System administrator security role
Administrative access mode
The system administrator security role is typically granted to Dynamics 365 administrators giving them
unrestricted access to the administrative (Settings) areas, which are used for managing and configuring features of
Dynamics 365.
Administrative access mode limits access to those areas of Dynamics 365 used to configure or customize the
system.
To give these administrators access to additional areas, such as the Sales, Marketing, and Service areas, a
Dynamics 365 (online) license must be added to the Office 365 Global administrator or Office 365 Service
administrator user account, by using the Office 365 Admin Center. Note that Administrative access mode cannot
be changed on the user form in the Dynamics 365 (online) application.

Create a Dynamics 365 administrator account
1. Sign in to the Office 365 admin center, and then choose Users > Active Users.
2. Select an existing user in the list. If you want to create a new administrative user, see Create or edit users
and Assigning admin roles.
3. Next to Product licenses, click Edit.
4. Make sure a Dynamics 365 (online) license is not assigned to this user, and then click Save.
IMPORTANT
Unlicensed Office 365 Global and Service administrators have access to the administrative areas of Dynamics 365
(online). However, if the administrator also needs access to additional areas of Dynamics 365 (online) you must select
a Dynamics 365 (online) license for the user.

5. Next to Roles, click Edit and then click either Global administrator or Customized administrator >
Service administrator. For more information about these roles, see Assigning admin roles.
6. Enter an alternate email address, and then click Save.
See also
Manage subscriptions, licenses, and user accounts

Cancel your subscription
8/24/2018 • 3 minutes to read • Edit Online

Applies to Dynamics 365 (online), version 9.x
Applies to Dynamics 365 (online), version 8.x
We are sorry that you are considering canceling your subscription with Dynamics 365. This topic contains
information you’ll need before you cancel your subscription. For additional details, see Section 4 of the Microsoft
Dynamics 365 Online Service Agreement.

Before you call
Before you call, make sure that you have the following information ready:
Billing administrator's Microsoft account and password
Organization URL and name
The day that you want your subscription to Dynamics 365 terminated
You should have also made the following decisions:
Do you want to keep your existing data?
Do you want to keep any Internet Marketing service campaigns running? If you aren’t the person who
signed up for the service, you must work with that person to cancel or maintain it.

Canceling your Dynamics 365 subscription
If you have been using Dynamics 365 for training, demonstrations, or testing and you don’t want to keep any of
your data, you can simply contact billing support with the information in Before you call. On the Billing and
subscription support page select Dynamics 365 (online). If you want to save your data, you need to also do the
following:
If you want to keep the data, you can export the data. For more information, see Export Data to Excel.
If you want to keep your Internet Marketing service campaigns running, don’t delete the activities. Search
engine ads will continue to run. After the Dynamics 365 cancellation, you can cancel or manage the
campaigns from Microsoft Ad Center.
To stop the search engine ads, delete or pause all your current Internet Marketing service campaign
activities. This will also stop the billing from Microsoft Ad Center with Dynamics 365. Sign in to Microsoft
Ad Center with your Microsoft Ad Center credentials to cancel the account.

Canceling your Dynamics 365 (online) subscription as part of your
migration to Dynamics 365 (on-premises)
If you have decided to migrate to Dynamics 365 (on-premises Edition), you first migrate your data and then cancel
your Microsoft Dynamics 365 subscription. To begin the migration process, you will need to work with one of the
following Microsoft support teams.
If you're on the Microsoft Online Services platform for Dynamics 365 (online) (most customers are), contact
Technical support.

If you're on the Microsoft Commerce Transaction Platform, contact Billing support.
Select the Dynamics 365 (online) tab on the Billing and subscription support page for help to determine
which platform you are on.
Dynamics 365 customer service will process your request, transfer your data to a secure site at the requested time,
and notify your IT department that the data is available to be downloaded.
When migration is complete, you then cancel your Microsoft Dynamics 365 subscription. More information: Billing
FAQs for Dynamics 365 (online).

Canceling only the Internet Marketing service
If you’re the billing administrator for an Internet Marketing service campaign used by a Microsoft Dynamics 365
subscription, you can cancel it even if you aren’t the billing administrator of the Dynamics 365 organization. To stop
the search engine ads, delete or pause all your current Internet Marketing service campaign activities. This will also
stop the billing from Microsoft Ad Center with Dynamics 365. Sign in to Microsoft Ad Center with your Microsoft
Ad Center credentials to cancel the account.

Changing your mind
You have 30 days to reverse the cancellation and start using Dynamics 365 again. Contact Billing and subscription
support with the same information you used to cancel your subscription. You can’t re-instate a canceled Internet
Marketing service campaign, but you can sign up again. For more information, see the Service Agreement.
See also

Use the service admin role to manage your tenant
10/19/2018 • 2 minutes to read • Edit Online

Applies to Dynamics 365 (online), version 9.x
Applies to Dynamics 365 (online), version 8.x
To help you administer Dynamics 365 (online), you can assign users to manage Dynamics 365 at the tenant level
without having to assign the more powerful Office 365 global admin privileges.
Users with the Dynamics 365 (online) service admin role can:
Sign in to and manage multiple Dynamics 365 (online) instances. If an instance uses a security group, a
service administrator would need to be added to the security group in order to manage that instance.
Perform admin functions in Dynamics 365 because they have the Dynamics 365 system admin role. The
service admin must be assigned a Dynamics 365 license.
A Dynamics 365 (online) service admin cannot do functions restricted to the Office 365 global admin such as
manage user accounts, manage subscriptions, access settings for Office 365 apps like Exchange or SharePoint.
NOTE
The Dynamics 365 (online) service admin can manage instances of version 8.1 (Dynamics CRM Online 2016 Update 1) or
later.

Here's a matrix of what's available with the various Office 365 roles.
OFFICE
365 ROLE
/
FEATURE

Office
365
global
admin

BACKUP
&
RESTORE

Yes

SANDBO
X COPY

CONFIGU
RE NEW
INSTANC
ES

MANAGE
AN
INSTANC
E

ADD
DYNAMI
CS 365
LICENSES

APPROVE
DYNAMI
CS 365
EMAILS 1

ACCESS
SUPPORT
REQUEST
S

ACCESS
SERVICE
HEALTH

ACCESS
MESSAGE
CENTER

Yes

OFFICE
365 ROLE
/
FEATURE

SANDBO
X COPY

CONFIGU
RE NEW
INSTANC
ES

MANAGE
AN
INSTANC
E

ADD
DYNAMI
CS 365
LICENSES

APPROVE
DYNAMI
CS 365
EMAILS

ACCESS
SUPPORT
REQUEST
S

ACCESS
SERVICE
HEALTH

ACCESS
MESSAGE
CENTER

n/a

Yes

Office
365
service
admin

Yes

Office
365 user

Dynamic
s 365
service
admin

Yes

Yes1

Yes

BACKUP
&
RESTORE

Exchang
e admin

1To approve emails for

Dynamics 365 (online), a Dynamics user requires the Approve Email Addresses for Users
or Queues privilege and the Office 365 global admin role or the Dynamics 365 service admin role. The
Dynamics 365 service admin User Principal Name (UPN ) must match the email address in Dynamics 365. If the
email address and the UPN are different then only an Office 365 global admin can approve the email address.
To approve emails for Dynamics 365 (on-premises), a Dynamics user requires the Approve Email Addresses for
Users or Queues privilege. A system admin can assign the Approve Email Addresses for Users or Queues
privilege to any security role and assign the security role to any user.
To manually assign the Approve Email Addresses for Users or Queues privilege to a security role:
1. In Dynamics 365, go to Settings > Security > Security Roles.
2. Select a security role, and then select the Business Management tab.
3. Under Miscellaneous Privileges, set the privilege level for Approve Email Addresses for Users or Queues.
See also
Manage Microsoft Dynamics 365 (online) instances
Manage subscriptions, licenses, and user accounts

Add a Partner of Record (POR) to your subscription
8/24/2018 • 2 minutes to read • Edit Online

Applies to Dynamics 365 (online), version 9.x
Applies to Dynamics 365 (online), version 8.x
You can choose to work with a designated Microsoft partner who can provide the sales and technical expertise you
need to help set up, customize, deploy, and administer your Dynamics 365 instances. You can find a designated
Partner of Record (POR ) on the Microsoft Partner Center site. Once you find a partner, request their Microsoft
Partner ID and designate them in the Office 365 Admin Center.

Add a partner at time of purchase
1. Browse to the Office 365 admin center and sign in using Office 365 Global administrator credentials.
2. Click Billing > Purchase Services.

3. Select a subscription, click Buy now.

4. Fill in the number of users and a promo code, if you have one, then click Next.
5. Under Account, click Add and then fill in the partner information.

Add a partner to an existing subscription
1. Browse to the Office 365 admin center and sign in using Office 365 Global administrator credentials.
2. Go to Billing > Subscriptions and select a subscription.

3. Under Active, click More actions > Add partner of record, and then fill in the partner information.

See also
Add, change, or delete a subscription advisor partner
Purchase and assign Dynamics 365 (online) licenses

For partners -- Get the credit when your customers
subscribe
8/24/2018 • 7 minutes to read • Edit Online

Applies to Dynamics 365 (online), version 9.x
Applies to Dynamics 365 (online), version 8.x
As a Dynamics 365 partner, you can help your customer sign up for a Microsoft Dynamics 365 subscription. You
can customize and set up their organization for them, and reduce their effort to get started. After signing up, you
can designate your company as the customer’s partner of record. As the partner of record, you can help to ensure
that your customer has a great trial experience and start them down the path toward success with Dynamics 365.
This document describes in detail the tasks you must complete to sign up for Dynamics 365 on behalf of your
customer. It also describes the tasks a customer must do to remove your administrative privileges from the
customer's company to ensure that they won’t be charged for your access after the trial is complete.

Sign up for a free trial subscription
Using a Microsoft account, which can be your ID or your customer’s, sign up for a free trial of Dynamics 365. The
free 30-day trial subscription includes 20 user licenses and 5 gigabytes (GB ) of storage. You can activate your
customer’s trial subscription as a paying subscription at any time during the first 30 days. If you sign up for the trial
subscription using your customer's Microsoft account, you won't need to worry about transferring ownership of
the account later on.
IMPORTANT
When signing up for the free trial, note the following:
Make sure to select the correct country/region for your customer. The country/region is important for setting up your
customer's billing.
If the customer doesn’t have a billing address in the country/region you select, their account can’t be activated later.
When you accept the terms of service, you're accepting it on behalf of your customer and representing their
agreement to our terms.

1. Go to Dynamics 365.
– OR If you received an email with the customer’s invitation, click the link.
2. Click Take the TestDrive and then fill in the information to start a TestDrive.
Soon after you complete the sign up, you’ll be notified by email that the Dynamics 365 trial subscription is
ready. You’ll also receive email messages that provide help for new organizations during the first 30 days of
their subscription. Forward these email messages to your customer.

Designate yourself as the partner of record
After completing the trial sign up, designate your company as the partner of record who is responsible for the
customer. As the partner of record, you can help Microsoft provide our partners and customers with the best

service and support. After the trial subscription becomes a paid subscription, your partner company can also claim
the Dynamics 365 Software Advisor (CSA) fee for the subscription. For information about the CSA fee program,
visit the Microsoft Partner Network site.
If your customer has already signed up for a Microsoft Dynamics 365 subscription, or prefers to sign up for the
trial subscription themselves, they can still designate your company as the partner of record.
1. Go to the Partner of Record Designation page in CustomerSource.
2. Sign in with the same Microsoft account that you used to sign up for the trial subscription.
If this Microsoft account is associated with more than one Microsoft Dynamics 365 subscription, select your
customer’s organization.
3. search for your partner company’s account, and then select Dynamics 365 as the product line from the
drop-down list.
TIP
You can search for your partner company by company name, phone number, or their 10-digit partner MBS
authorization number.

4. Select your company from the search results, and then click Associate.

Transfer ownership after completing the trial
After the trial period is complete and your customer is ready to start their subscription, there are a few steps you
need to complete in order to transfer ownership of the Dynamics 365 instance. If you signed up for the Microsoft
Dynamics 365 subscription on behalf of the customer by using a Microsoft account other than your customer’s, call
Dynamics 365 Customer Service and support to request a transfer of ownership of the subscription to your
customer and designate him or her as the billing administrator of the customer’s Dynamics 365 organization. The
billing administrator can take actions that have financial implications to the Microsoft Dynamics 365 subscription,
such as:
Upgrading to a different subscription
Upgrading to a different release
Purchasing additional licenses
Purchasing additional storage
TIP
If you used a Microsoft account that belongs to someone in your customer’s organization, or that can be transferred
to your customer, skip this task. Give the email address and its password to your customer.

To transfer the ownership of the Dynamics 365 trial subscription, you’ll need the following:
The email address of the person from your customer’s organization who will act as a system administrator
and the billing administrator for the subscription.
IMPORTANT
Each organization must have a billing administrator.

The Microsoft account that was used to sign up for the subscription.
The name of the company used to create the trial subscription.
You’ll need this name to identify your customer's company if there is more than one account registered at
the Microsoft Billing and Account Management site.
If the free trial subscription has already been activated to a paying subscription, you’ll also need the credit
card number used to pay for the subscription.
Add a system administrator
1. Sign in to Dynamics 365 using the Microsoft account that you used to sign up for the trial.
2. Follow the steps in Create users and assign Dynamics 365 Online security roles to create a user and assign
the system administrator security role. This user will also function as the billing administrator.
3. Make sure the new billing administrator has successfully signed in to your organization before transferring
ownership.
Add an account delegate
1. Go to the Microsoft Billing and Account Management site.
2. Sign in with the same Microsoft account that you used to sign up your customer for the trial subscription.
3. Under Billing account overview, select the company account where you want to add a delegate.
4. Click View or add account delegates.
5. On the Manage account delegates page:
a. Click Add an account delegate.
b. Enter the Microsoft account of the new billing administrator.
c. Click Add delegate.
Request an ownership transfer
1. Contact Dynamics 365 Customer Service and support.
2. Give the customer service representative the Microsoft account that was used to sign up for the subscription
and the account ID number.
3. Give the customer service representative the Microsoft account of the new billing administrator.
4. Ask the customer service representative to promote the new billing administrator to initial user, and primary
administrator.
IMPORTANT
Make sure that the new billing administrator has accepted the invitation to become a system administrator. The
Microsoft account that was used to sign up for the trial subscription will be demoted to an account delegate.

Remove the partner's administrative privileges
These tasks are optional. After you sign up your customer and register yourself as the partner of record, you will
have access to your customer's subscription and billing account for the subscription. The following tasks are
performed by the customer.

IMPORTANT
If you or your customer do not remove your privileges, the customer will be charged the standard monthly user fee for your
access.

If your customer wants to remove your access to the billing account for the subscription, they must complete the
following steps:
Remove partner access to the billing account
1. Go to the Microsoft Billing and Account Management site.
2. Sign in with the Microsoft account you use for the billing administrator at your company.
3. If the service name displayed under Billing account overview is not Dynamics 365, select the account
from the menu that corresponds to the Microsoft Dynamics 365 subscription.
4. Click View or add account delegates.
5. Next to the names of account delegates you want to remove, click Remove.
6. In the next window, click Yes to confirm the removal.
IMPORTANT
We strongly recommend that at least two people in the organization have access to the Billing and Account
Management site. To add someone, click Add an account delegate, and then follow the online instructions.

TIP
To verify that the information on the personal information page is correct, click Go to Account Information.

If your customer wants to disable your access to the subscription, they must complete the following steps in
Dynamics 365:
Disable partner access to the Microsoft Dynamics 365 subscription
1. Sign in to the Microsoft Dynamics 365 subscription with the Microsoft account you use for the billing
administrator at your company.
2. Follow the steps in Create users and assign Dynamics 365 Online security roles to disable the user from the
partner company.

For partners: the Delegated Administrator
9/17/2018 • 2 minutes to read • Edit Online

Applies to Dynamics 365 (online), version 9.x
Applies to Dynamics 365 (online), version 8.x
Admins for Dynamics 365 (online) can use their Office 365 global administrator role to create and edit users, reset
user passwords, manage user licenses, manage domains, and assign admin permissions to other users in their
organization, among other things. However, if admins want someone else to do these administrative tasks, they can
delegate this role to an authorized Dynamics 365 partner. When admins authorize a partner to take on this role, the
partner is referred to as a delegated admin. A delegated admin can perform routine tasks such as adding users and
resetting passwords, or more complex tasks such as adding a domain. A delegated admin can have access to
multiple tenants, which can simplify and consolidate tenant management.
You can see the new Delegated Admin user in Dynamics 365 (online) revisions 2040 or greater or in Microsoft
Dynamics CRM 2015 Update 0.2. This user won’t appear in standard provided views. You must create a custom
view to see it.
TIP
To determine your revision of Dynamics 365 (online), in the upper-right corner of your Dynamics 365 screen, choose the
Settings gear ( ) > About.
Your revision should be 2040 or above for both numbers highlighted.

To create a simple custom view to see the delegated admin user:
1. Go to Settings > Security > Users.
2. Choose Select a view ( ) and then choose Create Personal View.
3. Verify Users is selected in Look for.
4. Choose User > Contains Data, and then choose Results.

Delegated Admin will appear in the list of users.

How to get authorized as a delegated admin
Dynamics 365 partners can be authorized to be delegated admins for a company in several ways:
1. A partner can offer the customer to become a delegated admin for their account by sending a link to the
delegated admin offer. The customer will need to accept and sign in with their Office 365/Dynamics 365
(online) credentials.
2. A partner can send the customer a purchase offer link with delegated admin selected as part of the offer. The
customer will need to sign up for the offer and accept the delegated admin offer.
3. A partner can create a trial invitation link to Dynamics 365 (online) and invite the customer to the trial via a
link in email or a link on the partner’s website. The trial invitation can include delegated admin if the
prospect chooses to accept.

Related information
Review the following for more information on partners and delegated admins.
Learn how to provide technical support as a delegated admin
Learn how to do common partner tasks
Learn about the Microsoft Cloud Solution Provider (CSP ) program
See also
Introducing the new Office 365 Partner admin center
Partners: Offer delegated administration
Partners: Add or delete a delegated admin

Manage security, users, and teams
8/24/2018 • 2 minutes to read • Edit Online

Applies to Dynamics 365 (online), version 9.x
Applies to Dynamics 365 (online), version 8.x
The following section contains information about users, teams, and security in Dynamics 365.
See also
User Settings Utility

Security concepts
8/24/2018 • 5 minutes to read • Edit Online

Applies to Dynamics 365 (online), version 9.x
Applies to Dynamics 365 (online), version 8.x
You use the security model in Dynamics 365 to protect the data integrity and privacy in a Dynamics 365
organization. The security model also promotes efficient data access and collaboration. The goals of the model are
as follows:
Provide a multi-tiered licensing model for users.
Grant users access that allows only the levels of information required to do their jobs.
Categorize users and teams by security role and restrict access based on those roles.
Support data sharing so that users can be granted access to objects they do not own for a one-time
collaborative effort.
Prevent access to objects a user does not own or share.
You combine business units, role-based security, record-based security, and field-based security to define the
overall access to information that users have in your Dynamics 365 organization.

Business units
A business unit basically is a group of users. Large organizations with multiple customer bases often use multiple
business units to control data access and define security roles so that users can access records only in their own
business unit. More information: Create business units

Role-based security
You can use role-based security to group sets of privileges together into roles that describe the tasks that can be
performed by a user or team. Dynamics 365 includes a set of predefined security roles, each of which is a set of
privileges aggregated to make security management easier. The bulk of the privileges define the ability to create,
read, write, delete and share records of a specific entity type. Each privilege also defines how broadly the privilege
applies: at the user level, business unit level, the entire business unit hierarchy or across the entire organization.
For example, if you sign in as a user that is assigned the Salesperson role, you have the privileges to read, write
and share accounts for the entire organization, but you can only delete account records that you own. Also, you
have no privileges to perform system administration tasks such as install product updates, or to add users to the
system.
A user that has been assigned the Vice President of Sales role can perform a wider set of tasks (and has a greater
number of privileges) associated with viewing and modifying data and resources than can a user who has been
assigned to the Salesperson role. A user assigned the Vice President of Sales role can, for instance, read and
assign any account to anyone in the system, while a user assigned the Salesperson role cannot.
There are two roles that have very broad privileges: System Administrator and Customizer. To minimize
misconfiguration, the use of these two roles should be limited to a few people in your organization responsible for
administering and customizing Dynamics 365. Organizations can also customize existing roles and create its own
roles to meet their needs. More information: Security roles

User-based access and licensing
By default, when you create a user the user has read and write access to any data for which they have permission.
Also, by default, the user client access license (CAL ) is set to Professional. You can change either of these settings
to further restrict data and feature access.
Access mode. This setting determines the level of access for each user.
Read-Write access. By default, users have Read-Write access that allows them access to data for which they
have appropriate permission set by security roles.
Administrative access. Allows access to areas that the user has appropriate permission set by security roles
but doesn’t allow the user to view or access business data typically found in the Sales, Service, and
Marketing areas, such as accounts, contacts, leads, opportunities, campaigns, and cases. For example,
Administrative access can be used to create Dynamics 365 administrators who can have access to perform
a complete variety of administrative tasks, such as create business units, create users, set duplicate
detection, but cannot view or access any business data. Notice that users who are assigned this access
mode do not consume a CAL.
Read access. Allows access to areas for which the user has appropriate access set by security role but the
user with Read access can only view data and can’t create or change existing data. For example, a user with
the system administrator security role who has read access can view business units, users, and teams but
can’t create or modify those records.
License type. This sets the user CAL and determines what features and areas are available to the user. This
feature and area control is separate from the user’s security role setting. By default, users are created with
Professional CAL for the most feature and area access that they have permission granted.

Teams
Teams provide an easy way to share business objects and let you collaborate with other people across business
units. While a team belongs to one business unit, it can include users from other business units. You can associate
a user with more than one team. More information: Manage teams

Record-based security
You can use record-based security to control user and team rights to perform actions on individual records. This
applies to instances of entities (records) and is provided by access rights. The owner of a record can share, or
grant access to a record to another user or team. When this is done, they must choose which rights they are
granting. For example, the owner of an account record can grant read access to that account information, but not
grant write access.
Access rights apply only after privileges have taken effect. For example, if a user does not have the privileges to
view (read) account records, they will be unable to view any account, regardless of the access rights another user
might grant them to a specific account through sharing.

Hierarchy security
You can use the hierarchy security model for accessing hierarchical data. With this additional security, you gain a
more granular access to records, allowing managers to access the records of their reports for approval or do work
on reports’ behalf. More information: Hierarchy security

Field-based security
You can use field-level security to restrict access to specific high business impact fields in an entity only to

specified users or teams. Like record-based security, this applies after privileges have taken affect. For example, a
user may have privileges to read an account, but can be restricted from seeing specific fields in all accounts. More
information: Field level security

Security Modeling with Dynamics 365
For detailed information about and best practices for designing the security model in Dynamics 365, read the
Scalable Security Modeling with Microsoft Dynamics CRM white paper available from the Microsoft Download
Center.
See also
Field level security
Hierarchy security
Control data access
Create or edit a security role
Copy a security role
Manage users
Manage teams
Add teams or users to a field security profile
Manage security, users and teams

Security roles and privileges
9/13/2018 • 5 minutes to read • Edit Online

Applies to PowerApps and Dynamics 365 (online), version 9.x
Applies to Dynamics 365 (online), version 8.x
To control data access, you must set up an organizational structure that both protects sensitive data and enables
collaboration. You do this by setting up business units, security roles, and field security profiles.
TIP
Check out the following video: How to set up security roles in Dynamics 365.

Security roles
A security role defines how different users, such as salespeople, access different types of records. To control
access to data, you can modify existing security roles, create new security roles, or change which security roles are
assigned to each user. Each user can have multiple security roles.
Security role privileges are cumulative: having more than one security role gives a user every privilege available
in every role.
Each security role consists of record-level privileges and task-based privileges.
Record -level privileges define which tasks a user with access to the record can do, such as Read, Create, Delete,
Write, Assign, Share, Append, and Append To. Append means to attach another record, such as an activity or
note, to a record. Append to means to be attached to a record. More information: Record-level privileges
Task-based privileges, at the bottom of the form, give a user privileges to perform specific tasks, such as publish
articles.
The colored circles on the security role settings page define the access level for that privilege. Access levels
determine how deep or high in the organizational business unit hierarchy the user can perform the specified
privilege. The following table lists the levels of access in the app, starting with the level that gives users the most
access.

Global. This access level gives a user access to all records in
the organization, regardless of the business unit hierarchical
level that the instance or the user belongs to. Users who
have Global access automatically have Deep, Local, and Basic
access, also.
Because this access level gives access to information
throughout the organization, it should be restricted to match
the organization's data security plan. This level of access is
usually reserved for managers with authority over the
organization.
The application refers to this access level as Organization.

Deep. This access level gives a user access to records in the
user's business unit and all business units subordinate to the
user's business unit.
Users who have Deep access automatically have Local and
Basic access, also.
Because this access level gives access to information
throughout the business unit and subordinate business units,
it should be restricted to match the organization's data
security plan. This level of access is usually reserved for
managers with authority over the business units.
The application refers to this access level as Parent: Child
Business Units.
Local. This access level gives a user access to records in the
user's business unit.
Users who have Local access automatically have Basic access,
also.
Because this access level gives access to information
throughout the business unit, it should be restricted to
match the organization's data security plan. This level of
access is usually reserved for managers with authority over
the business unit.
The application refers to this access level as Business Unit.
Basic.
This access level gives a user access to records that the user
owns, objects that are shared with the user, and objects that
are shared with a team that the user is a member of.
This is the typical level of access for sales and service
representatives.
The application refers to this access level as User.
None. No access is allowed.

IMPORTANT
To ensure that users can view and access all areas of the web application, such as entity forms, the nav bar, or the
command bar, all security roles in the organization must include the Read privilege on the Web Resource entity. For
example, without read permissions, a user won’t be able to open a form that contains a web resource and will see an error
message similar to this: “Missing prvReadWebResource privilege.” More information: Create or edit a security role

Record-level privileges
PowerApps and Dynamics 365 use eight different record-level privileges that determine the level of access a user
has to a specific record or record type.
PRIVILEGE

DESCRIPTION

PRIVILEGE

DESCRIPTION

Create

Required to make a new record. The records that can be
created depends on the access level of the permission defined
in your security role.

Read

Required to open a record to view the contents. The records
that can be read depends on the access level of the
permission defined in your security role.

Write

Required to make changes to a record. The records that can
be changed depends on the access level of the permission
defined in your security role.

Delete

Required to permanently remove a record. The records that
can be deleted depends on the access level of the permission
defined in your security role.

Append

Required to associate a record with the current record. For
example, if a user has Append rights on an opportunity, the
user can add a note to an opportunity. The records that can
be appended depends on the access level of the permission
defined in your security role.

Append To

Required to associate the current record with another record.
For example, a note can be attached to an opportunity if the
user has Append To rights on the note. The records that can
be appended to depends on the access level of the
permission defined in your security role.

Assign

Required to give ownership of a record to another user. The
records that can be assigned depends on the access level of
the permission defined in your security role.

Required to give access to a record to another user while
keeping your own access. The records that can be shared
depends on the access level of the permission defined in your
security role.

Overriding security roles
The owner of a record or a person who has the Share privilege on a record can share a record with other users or
teams. Sharing can add Read, Write, Delete, Append, Assign, and Share privileges for specific records.
Teams are used primarily for sharing records that team members ordinarily couldn't access. More information:
Manage security, users and teams
It’s not possible to remove access for a particular record. Any change to a security role privilege applies to all
records of that record type.
See also
Security concepts for Microsoft Dynamics 365
Manage security, users and teams
Create or edit a security role

Create or edit a security role to manage access
10/29/2018 • 10 minutes to read • Edit Online

Applies to Dynamics 365 (online), version 9.x
Applies to Dynamics 365 (online), version 8.x
You can create new security roles to accommodate changes in your business requirements or you can edit the
privileges associated with an existing security role.
If you need to back up your security role changes, or export security roles for use in a different implementation of
Dynamics 365, you can export them as part of exporting customizations. More information: Export your
customizations as a solution

Create a security role
1. Make sure that you have the System Administrator or System Customizer security role or equivalent
permissions.
Check your security role
Follow the steps in View your user profile.
Don’t have the correct permissions? Contact your system administrator.
2. Go to Settings > Security.
3. Click Security Roles.
4. On the Actions toolbar, click New.
5. Set the privileges on each tab.
To change the access level for a privilege, click the symbol until you see the symbol you want. The possible
access levels depend on whether the record type is organization-owned or user-owned.
TIP
To cycle through the access levels, you can also click the privilege column heading, or click the record type multiple
times.
There are a set of minimum privileges that are required in order for the new security role to be used - see below
Minimum Privileges for common tasks.

6. When you have finished configuring the security role, on the toolbar, click or tap Save and Close.

Create a security role by Copy Role
1. Make sure that you have the System Administrator or System Customizer security role or equivalent
permissions.
Check your security role
Follow the steps in View your user profile.
Don’t have the correct permissions? Contact your system administrator.

2. Go to Settings > Security.
3. Click Security Roles.
4. Click on the Security role you want to copy from.
5. On the Actions toolbar, click Copy Role.
6. Enter the New Role Name, and check the box for Open the new security role when copying is
complete.
7. Click the OK button.
8. When Copying Role is complete, navigate to each tab, ie Core Records, Business Management,
Customization, etc.
9. Set the privileges on each tab.
TIP
To cycle through the access levels, you can also click the privilege column heading, or click the record type multiple times.
There are a set of minimum privileges that are required in order for the new security role to be used - see below Minimum
Privileges for common tasks.

Edit a security role
Before you edit an existing security role, make sure that you understand the principles of data access. More
information: Controlling Data Access
NOTE
You can’t edit the System Administrator security role. To create a security role similar to the System Administrator security
role, copy the System Administrator security role, and make changes to the new role.

1. Make sure that you have the System Administrator or System Customizer security role or equivalent
permissions.
Check your security role
Follow the steps in View your user profile.
Don’t have the correct permissions? Contact your system administrator.
2. Go to Settings > Security.
3. Click Security Roles.
4. In the list of security roles, double-click or tap a name to open the page associated with that security role.
5. Set the privileges on each tab.
To change the access level for a privilege, click the symbol until you see the symbol you want. The possible
access levels depend on whether the record type is organization-owned or user-owned.

TIP
To cycle through the access levels, you can also click the privilege column heading, or click the record type multiple
times.
There are a set of minimum privileges that are required in order for the new security role to be used - see below
Minimum Privileges for common tasks.

6. When you have finished configuring the security role, on the toolbar, click or tap Save and Close.

Minimum privileges for common tasks
It's helpful to keep in mind the minimum privileges that are needed for some common tasks. We've created a
solution you can import that provides a security role with the required minimum privileges.
Start by downloading the solution from the Download Center: CDS for Apps minimum privilege security role.
Then, follow the directions to import the solution: Import, update, and export solutions.
When you import the solution, it creates the min prv apps use role which you can copy (see: Create a security
role by Copy Role). When Copying Role is complete, navigate to each tab - Core Records, Business Management,
Customization, etc - and set the appropriate privileges.
IMPORTANT
You should try out the solution in a development environment before importing into a production environment.

When logging in to Dynamics 365:
Assign the min prv apps use security role or a copy of this security role to your user.
To render an entity grid (that is, to view lists of records and other data), assign the following
privileges on the Core Records tab: Read privilege on the entity, Read Saved View,
Create/Read/Write User Entity UI Settings and assign the following privilege on the Business
Management tab: Read User
When logging in to Dynamics 365 for Outlook:
To render navigation for Dynamics 365 and all Dynamics 365 buttons: assign the min prv apps use
security role or a copy of this security role to your user
To render an entity grid: assign Read privilege on the entity
To render entities: assign Read privilege on the entity

Privacy notices
Licensed Dynamics 365 Online users with specific Security Roles (CEO – Business Manager, Sales Manager,
Salesperson, System Administrator, System Customizer, and Vice President of Sales) are automatically authorized
to access the service by using Dynamics 365 for phones, as well as other clients.
An administrator has full control (at the user security role or entity level) over the ability to access and the level of
authorized access associated with the phone client. Users can then access Dynamics 365 (online) by using
Dynamics 365 for phones, and Customer Data will be cached on the device running the specific client.
Based on the specific settings at the user security and entity levels, the types of Customer Data that can be
exported from Dynamics 365 (online) and cached on an end user’s device include record data, record metadata,
entity data, entity metadata, and business logic.

The Dynamics 365 for tablets and phones, and Project Finder for Project Finder for Dynamics 365 (the "App")
enables users to access their Microsoft Dynamics CRM or Dynamics 365 instance from their tablet and phone
device. In order to provide this service, the App processes and stores information, such as user's credentials and
the data the user processes in Microsoft Dynamics CRM or Dynamics 365. The App is provided for use only by
end users of Microsoft customers who are authorized users of Microsoft Dynamics CRM or Dynamics 365. The
App processes user's information on behalf of the applicable Microsoft customer, and Microsoft may disclose
information processed by the App at the direction of the organization that provides users access to Microsoft
Dynamics CRM or Dynamics 365. Microsoft does not use information users process via the App for any other
purpose.
If users use the App to connect to Microsoft Dynamics CRM (online) or Dynamics 365 (online), by installing the
App, users consent to transmission of their organization's assigned ID and assigned end user ID, and device ID to
Microsoft for purposes of enabling connections across multiple devices, or improving Microsoft Dynamics CRM
(online), Dynamics 365 (online) or the App.
Location data. If users request and enable location-based services or features in the App, the App may collect
and use precise data about their location. Precise location data can be Global Position System (GPS ) data, as well
as data identifying nearby cell towers and Wi-Fi hotspots. The App may send location data to Microsoft Dynamics
CRM or Dynamics 365. The App may send the location data to Bing Maps and other third party mapping services,
such as Google Maps and Apple Maps, a user designated in the user's phone to process the user's location data
within the App. Users may disable location-based services or features or disable the App's access to user's
location by turning off the location service or turning off the App's access to the location service. Users' use of
Bing Maps is governed by the Bing Maps End User Terms of Use available at https://go.microsoft.com/?
linkid=9710837 and the Bing Maps Privacy Statement available at https://go.microsoft.com/fwlink/?
LinkID=248686. Users' use of third party mapping services, and any information users provide to them, is
governed by their service specific end user terms and privacy statements. Users should carefully review these
other end user terms and privacy statements.
The App may include links to other Microsoft services and third party services whose privacy and security
practices may differ from those of Microsoft Dynamics CRM or Dynamics 365. IF USERS SUBMIT DATA TO
OTHER MICROSOFT SERVICES OR THIRD PARTY SERVICES, SUCH DATA IS GOVERNED BY THEIR
RESPECTIVE PRIVACY STATEMENTS. For the avoidance of doubt, data shared outside of Microsoft Dynamics
CRM or Dynamics 365 is not covered by users' Microsoft Dynamicss CRM or Dynamics 365 agreement(s) or the
applicable Microsoft Dynamics Trust Center. Microsoft encourages users to review these other privacy statements.
Licensed Dynamics 365 Online users with specific Security Roles (CEO – Business Manager, Sales Manager,
Salesperson, System Administrator, System Customizer, and Vice President of Sales) are automatically authorized
to access the service by using Dynamics 365 for tablets, as well as other clients.
An administrator has full control (at the user security role or entity level) over the ability to access and the level of
authorized access associated with the tablet client. Users can then access Dynamics 365 (online) by using
Dynamics 365 for tablets, and Customer Data will be cached on the device running the specific client.
Based on the specific settings at the user security and entity levels, the types of Customer Data that can be
exported from Dynamics 365 (online) and cached on an end user’s device include record data, record metadata,
entity data, entity metadata, and business logic.
If you use Microsoft Dynamics 365 for Outlook, when you go offline, a copy of the data you are working on is
created and stored on your local computer. The data is transferred from Dynamics 365 (online) to your computer
by using a secure connection, and a link is maintained between the local copy and Dynamics 365 Online. The next
time you sign in to Dynamics 365 (online), the local data will be synchronized with Dynamics 365 (online).
An administrator determines whether or not an organization’s users are permitted to go offline with Microsoft
Dynamics 365 for Outlook by using security roles.
Users and administrators can configure which entities are downloaded via Offline Sync by using the Sync Filters

setting in the Options dialog box. Alternatively, users and Administrators can configure which fields are
downloaded (and uploaded) by using Advanced Options in the Sync Filters dialog box.
If you use Dynamics 365 (online), when you use the Sync to Outlook feature, the Dynamics 365 data you are
syncing is “exported” to Outlook. A link is maintained between the information in Outlook and the information in
Dynamics 365 (online) to ensure that the information remains current between the two. Outlook Sync downloads
only the relevant Dynamics 365 record IDs to use when a user attempts to track and set regarding an Outlook
item. The company data is not stored on the device.
An administrator determines whether your organization’s users are permitted to sync Dynamics 365 data to
Outlook by using security roles.
If you use Microsoft Dynamics 365 (online), exporting data to a static worksheet creates a local copy of the
exported data and stores it on your computer. The data is transferred from Dynamics 365 (online) to your
computer by using a secure connection, and no connection is maintained between this local copy and Dynamics
365 (online).
When you export to a dynamic worksheet or PivotTable, a link is maintained between the Excel worksheet and
Dynamics 365 (online). Every time a dynamic worksheet or PivotTable is refreshed, you’ll be authenticated with
Dynamics 365 (online) using your credentials. You’ll be able to see the data that you have permissions to view.
An administrator determines whether or not an organization’s users are permitted to export data to Excel by using
security roles.
When Dynamics 365 (online) users print Dynamics 365 data, they are effectively “exporting” that data from the
security boundary provided by Dynamics 365 (online) to a less secure environment, in this case, to a piece of
paper.
An administrator has full control (at the user security role or entity level) over the data that can be extracted.
However, after the data has been extracted it is no longer protected by the security boundary provided by
Dynamics 365 (online) and is instead controlled directly by the customer.
See also
Security concepts for Dynamics 365
Manage security, users and teams
Copy a security role

Save time creating a security role by copying one
8/24/2018 • 2 minutes to read • Edit Online

Applies to Dynamics 365 (online), version 9.x
Applies to Dynamics 365 (online), version 8.x
If you want to create a security role that is similar to another security role, you can copy an existing security role
and save it with a new name. You can then modify the privileges and access levels to accommodate the new
security role.
NOTE
You can’t copy a security role to a different business unit.
Security role privileges are subject to change with updates and the copied security role could become out-of-date. You
should periodically check security role privileges. See Create an administrative user and prevent elevation of security role
privilege for an alternative method to assign security role privileges that will change dynamically.

1. Make sure that you have the System Administrator or System Customizer security role or equivalent
permissions.
Check your security role
Follow the steps in View your user profile.
Don’t have the correct permissions? Contact your system administrator.
2. Go to Settings > Security.
3. Click Security Roles.
4. In the list of security roles, under Name, click or tap to select the security role you want to copy, and then
on the Actions toolbar, click or tap More Actions > Copy Role.
5. In the Copy Security Role dialog box, in the New Role Name text box, type in the name for the new
security role.
6. To modify the new security role after creating a copy, verify that the Open the new security role when
copying is complete check box is selected; otherwise, clear the check box.
7. Click OK.
See also
Security concepts for Microsoft Dynamics 365
Security roles
Field level security Prevent elevation of security role privilege

Create an administrative user and prevent elevation
of security role privilege
8/24/2018 • 2 minutes to read • Edit Online

Applies to Dynamics 365 (online), version 9.x
Applies to Dynamics 365 (online), version 8.x
Dynamics 365 (on-premises)
The copy security role method is a quick and easy way to create a new security role based on an existing set of
privileges. However, security role privileges can change with product updates which could render the new security
role out-of-date and might not function as expected. This is especially true in the case where you want to allow a
certain group of administrative users to assign security roles to your users. We recommend you not copy the
System Administrator security role and assign it to users, since this would allow the users to elevate the assigned
user to System Administrators. In addition, newer privileges from product updates will not be automatically added
to the copied System Administrator security role resulting in the role having insufficient privileges to continue to
assign security roles.
The following steps describe a method to create a new custom security role with privileges that will change
dynamically with updates and therefore can continue to be used for security role assignments.
Create a new custom security role that only has access to "Security Role"
1. Make sure that you have the System Administrator permissions.
Check your security role
Follow the steps in View your user profile.
Don’t have the correct permissions? Contact your system administrator.
2. Go to Settings > Security > Security Roles, and then choose New.
3. Enter a role name, and then select the Business Management tab.
4. Scroll down to the Entity list and set the Security Role entity privileges as follows:
PRIVILEGE

SETTING

Create

Business Unit

Read

Organization

Write

Business Unit

Delete

Business Unit

Append

Business Unit

Append To

Business Unit

Assign

Business Unit

5. Choose Save and Close.
Assign the new security role to an administrative user
1. Go to Settings > Security > Users.
2. Select an administrative user and then choose Manage Roles.
3. Select the new security role.
4. Select all the security roles that the administrative user can assign to other users.
5. Choose OK.
NOTE
Dynamics 365 is designed to prevent any elevation of security role privileges. Therefore, the administrative user cannot
assign System Administrator, System Customizer, or any security roles that have a higher privilege.

See also
Global and Service administrators can administer without a license

Assign security roles to a form to more finely control
access
8/24/2018 • 2 minutes to read • Edit Online

Applies to Dynamics 365 (online), version 9.x
Applies to Dynamics 365 (online), version 8.x
Control form and field access by assigning different security roles to different forms you create.
More information: Security concepts for Microsoft Dynamics 365
1. Make sure you have the System Administrator security role or equivalent permissions in Microsoft
Dynamics 365.
Check your security role
Follow the steps in View your user profile.
Don’t have the correct permissions? Contact your system administrator.
2. Go to Settings > Customizations.
3. Choose Customize the System.
4. Enable security roles.
a. Under Components, expand Entities, and then expand the entity you want.
b. Choose Forms. In the list, choose a form to edit it if it has a form type of Main.
c. On the Home tab, in the Form group, choose Enable Security Roles.
5. Assign security roles.
a. In the Assign Security Roles dialog box, select the security roles to which this form will be available.
b. To make this the fallback form, select the Enabled for fallback check box.
At least one form per entity must be a fallback form (the form that is displayed to a user when no
other form is available for that user's security role).
c. Choose OK.
6. Preview the main form.
a. On the Home tab, choose Preview, and then select Create Form, Update Form, or Read-Only
Form.
b. To close the Preview form, on the File menu, choose Close.
7. When you’re ready to save your data, choose Save and Close.
8. Publish your customization.
To publish just the edited component, choose Save > Publish on the Home tab.
To publish all unpublished components at one time, choose Publish All Customizations.

NOTE
Installing a solution or publishing customizations can interfere with normal system operation. We recommend that you
schedule a solution import when it’s least disruptive to users.

View your user profile
8/24/2018 • 2 minutes to read • Edit Online

Applies to Dynamics 365 (online), version 9.x
Your user profile displays useful information about you to your entire organization; for example, your
contact information, your organization, and your security role. Depending on your security role, you may be
able to make changes to your user profile.
1. Go to Options.
In Dynamics 365, in the upper-right corner of the screen, choose the Settings button

> Options.

2. Scroll down to the very bottom of the Set Personal Options dialog box, and then choose View
your user information.
3. To check your security role, on the nav bar, choose the down arrow
choose Security Roles.

next to your name, and then

4. To view other profile information, such as Work Hours, Connections, and Services, on the nav bar,
choose the down arrow next to your name.
See also
Set personal options

Security enhancements: User session and access
management
10/19/2018 • 5 minutes to read • Edit Online

Applies to Dynamics 365 (online), version 9.x
Applies to Dynamics 365 (online), version 8.x
New for Customer Engagement in Dynamics 365 (online), version 9.0, you can use new security enhancements to
better secure the Dynamics 365 (online) application.
IMPORTANT
These security enhancements are also available for:
Microsoft Dynamics CRM 2016 (on-premises, version 8.2)
The feature is available by contacting support.
Microsoft Dynamics CRM 2016 (on-premises, version 8.1)
The feature is available by contacting support.
Microsoft Dynamics CRM 2015 (on-premises)
The feature is available by contacting support.
For more information on these versions, see Security enhancements: User session and access management

TIP
Check out the following video: Security Enhancements: User session management.

User session timeout
By default, Dynamics 365 (online) sets a user session timeout of 24 hours. A user is not required to log in with
their credentials for up to 24 hours regardless of whether the user was active or inactive.
You can change this behavior.
To enforce users to re-authenticate after a pre-determined period of time, admins can set a session timeout for
their individual Dynamics 365 (online) instances. Users can only remain signed in the application for the
duration of session. The application signs out the user when the session expires. Users need to sign-in with
their credentials to return to Dynamics 365 (online).
NOTE
User session timeout is not enforced in the following:
1. Dynamics 365 for Outlook
2. Dynamics 365 for phones and Dynamics 365 for tablets
3. Unified Service Desk client using WPF browser (Internet Explorer is supported)
4. Live Assist (Chat)

Configure session timeout
1. In Dynamics 365 (online), choose Settings > Administration > System Settings > General tab.
2. Under Set session timeout, set the values to apply to all your users.
NOTE
Default values are:
Maximum Session Length: 1440 minutes
Minimum Session Length: 60 minutes
How long before session expires before showing timeout warning: 20 minutes

Inactivity timeout
By default, Dynamics 365 (online) does not enforce an inactivity session timeout. A user can remain logged in the
application until the session timeout expires. You can change this behavior.
To enforce users to automatically signed out after a pre-determined period of inactivity, admins can set an
inactivity timeout period for each of their Dynamics 365 (online) instances. The application signs out the user
when the inactivity session expires.
NOTE
Inactivity session timeout is not enforced in the following:
1. Dynamics 365 for Outlook
2. Dynamics 365 for phones and Dynamics 365 for tablets
3. Unified Service Desk client using WPF browser (Internet Explorer is supported)
4. Live Assist (Chat)

To enforce the inactivity session timeout for Web Resources, Web Resources need to include the
ClientGlobalContext.js.aspx file in their solution.
The Dynamics 365 (online) portal has its own settings to manage its session timeout and inactivity session timeout
independent of these system settings.

Configure inactivity timeout
1. In Dynamics 365 (online), choose Settings > Administration > System Settings > General tab.
2. Under Set inactivity timeout, set the values to apply to all your users.
NOTE
Default values are:
Minimum Duration of Inactivity: 5 minutes
Maximum Duration of Inactivity: less than Maximum Session length or 1440 minutes

Access management
Dynamics 365 (online) uses Azure Active Directory as the identity provider. To secure the user’s access to
Dynamics 365 (online), the following were implemented:

To enforce users to re-authenticate, users are required to sign in with their credentials after they signed out
within the application.
To prevent users from sharing credentials to access Dynamics 365 (online), the user access token is validated to
ensure that the user who was given access by the identity provider is the same user who is accessing Dynamics
365 (online).

Steps for enabling security enhancements for Dynamics 365 (onpremises) deployments
These security enhancements are shipped disabled by default. Administrators can enable these enhancements
when using one of the supported Dynamics 365 (on-premises) builds listed below.
NOTE
This applies to customers with the following versions of Dynamics 365:
Microsoft Dynamics CRM 2016 (on-premises, version 8.2)
The feature is included in this update.
Microsoft Dynamics CRM 2016 (on-premises, version 8.1)
The feature is available by contacting support.
Microsoft Dynamics CRM 2015 (on-premises)
The feature is available by contacting support.
Requirement These security enhancement features require claims-based authentication for user authentication. You can
configure claims-based authentication in one of two ways:
With an Internet-facing deployment (IFD). See Configure IFD for Microsoft Dynamics 365.
With claims-based authentication alone if Microsoft Dynamics 365 is deployed in the same domain where all Microsoft
Dynamics 365 users are located, or users are in a trusted domain. See Configure claims-based authentication.

To obtain SDK sample code (for reference, not required to configure and enable session timeout):
1. Access your Dynamics 365 server using your administrator account.
2. Open a browser session and download the Dynamics 365 Software Development Kit (SDK).
3. Select and run MicrosoftDynamics365SDK.exe. This will extract the download and create an SDK folder on
your Dynamics 365 server.
4. Open a PowerShell command prompt.
5. Navigate to the downloaded SDK folder.
6. Open the SampleCode\PS folder.
After updating to a supported on-premises version, follow the steps below to enable security enhancements.
User session timeout
System admins can now force users to re-authenticate after a set period. You can set an active session timeout for
each of your Dynamics 365 instances. Users can only remain signed in to the application for the duration of the
session. Once the session expires, they’ll need to sign in again with their credentials. System admins can also
require sign in for users after a period of inactivity. You can set an inactivity timeout for each of your instances. The
helps prevent unauthorized access by a malicious user from an unattended device.
Enable user session timeout
1. Enable session timeout:

SetAdvancedSettings.ps1 -ConfigurationEntityName ServerSettings -SettingName AllowCustomSessionDuration
-SettingValue true

2. Enable inactivity timeout:
SetAdvancedSettings.ps1 -ConfigurationEntityName ServerSettings -SettingName
AllowCustomInactivityDuration -SettingValue true

Access token management
To better protect user access and data privacy in Dynamics 365, when a user signs out in the web client and needs
to return to the application, they will need to enter their credentials again in all open browser sessions. Dynamics
365 ensures that the sign-in token was originally generated for the current browser and computer.
Enable access token management
To enable for all organizations by default, copy and run this command in PowerShell:
SetAdvancedSettings.ps1 -ConfigurationEntityName ServerSettings -SettingName WSFedNonceCookieEnabled SettingValue true

Sample:

-OR To enable for a single organization, copy and run this command in PowerShell:
SetAdvancedSettings.ps1 -ConfigurationEntityName Organization -SettingName WSFedNonceCookieEnabled SettingValue true -Id

To get [Your organization ID GUID ], open PowerShell, and run the following:
Add-PSSnapin Microsoft.Crm.PowerShell
Get-CrmOrganization

Sample:

For more information, see Get-CrmOrganization for details.

Field level security to control access
8/24/2018 • 4 minutes to read • Edit Online

Applies to Dynamics 365 (online), version 9.x
Applies to Dynamics 365 (online), version 8.x
Record-level permissions are granted at the entity level, but you may have certain fields associated with an entity
that contain data that is more sensitive than the other fields. For these situations, you use field level security to
control access to specific fields.
The scope of field level security is organization-wide and applies to all data access requests including the
following:
Data access requests from within a client application, such as web browser, mobile client, or Microsoft
Dynamics 365 for Outlook.
Web service calls using the Dynamics 365 Customer Engagement Web Services (for use in plug-ins,
custom workflow activities, and custom code)
Reporting (using Filtered Views)

Overview of field level security
Field level security is available for the default fields on most out-of-box entities, custom fields, and custom fields
on custom entities. Field level security is managed by the security profiles. To implement field level security, a
system administrator performs the following tasks.
1. Enable field security on one or more fields for a given entity.
2. Associate one more existing security profiles, or create one or more new security profiles to grant the
appropriate access to specific users or teams.
A security profile determines the following:
Permissions to the secure fields
Users and Teams
A security profile can be configured to grant user or team members the following permissions at the field
level:
Read. Read-only access to the field’s data.
Create. Users or teams in this profile can add data to this field when creating a record.
Update. Users or teams in this profile can update the field’s data after it has been created.
A combination of these three permissions can be configured to determine the user privileges for a specific data
field.
IMPORTANT
Unless one or more security profiles are assigned to a security enabled field, only Dynamics 365 users with the system
administrator security role will have access to the field.

Example for restricting the mobile phone field for the Contact entity
Imagine you company’s policy is that sales members should have different levels of access to contact mobile
phone numbers as described here.
USER OR TEAM

ACCESS

Vice presidents

Full. Can create, update, and view mobile phone numbers for
contacts.

Sales Managers

Read-only. Can only view mobile phone numbers for contacts.

Salespersons and all other Dynamics 365 users

None. Cannot create, update or view mobile phone numbers
for contacts.

To restrict this field, you would perform the following tasks.
Secure the field.
1. Go to Settings > Customizations.
2. Click Customize the System.
3. Click Entities > Contact > Fields.
4. Click mobilephone, click Edit.
5. Next to Field Security, click Enable, click Save and Close.
6. Publish the customization.
Configure the security profiles.
1. Create the field security profile for sales managers.
a. Go to Settings > Security.
b. Click Field Security Profiles.
c. Click New, enter a name, such as Sales Manager access contact mobile phone, and click Save.
d. Click Users, click Add, select the users that you want to grant read access to the mobile phone
number on the contact form, and then click Add.
TIP
Instead of adding each user, create one or more teams that include all users that you want to grant read
access.

e. Click Field Permissions, click mobilephone, click Edit, select Yes next to Allow Read, and then
click OK.
2. Create the field security profiles for vice presidents.
a. Click New, enter a name, such as VP access contact mobile phone, and click Save.
b. Click Users, click Add, select the users that you want to grant full access to the mobile phone
number on the contact form, and then click Add.
c. Click Field Permissions, click mobilephone, click Edit, select Yes next to Allow Read, Allow

Update, and Allow Create, and then click OK.
3. Click Save and Close.
Any Dynamics 365 users not defined in the previously created field security profiles will not have access to the
mobile phone field on contact forms or views. The field value displays ********, indicating that the field is
secured.

Which fields can be secured?
Every field in the system contains a setting for whether field security is allowed. You can view this in the
Customizations area of the web application.
There are thousands of attributes that can be secured, so there are two easier ways to look for this information. To
view the entity metadata for your organization, install the Metadata Browser solution described in Browse the
Metadata for Your Organization. You can also view the metadata for an uncustomized organization in the Office
Excel file called EntityMetadata.xlsx included in the top-level folder of the SDK. Download the Microsoft Dynamics
365 SDK

Best practices when you use field security
When you use calculated fields that include a field that is secured, data may be displayed in the calculated field to
users that don’t have permission to the secured field. In this situation, both the original field and the calculated
field should be secured.
Some data, such as addresses, are actually made up of multiple fields. Therefore, to completely secure data that
includes multiple fields, such as addresses, you must secure and configure the appropriate field security profiles
on multiple fields for the entity. For example, to completely secure addresses for an entity, secure all relevant
address fields, such as address_line1, address_line2, address_line3, address1_city, address1_composite, and so on.
See also
Video: Field Level Security in Microsoft Dynamics CRM 2015
Create a field security profile
Add or remove security from a field
Hierarchy security

Set up security permissions for a field
8/24/2018 • 2 minutes to read • Edit Online

Applies to Dynamics 365 (online), version 9.x
Applies to Dynamics 365 (online), version 8.x
You can restrict access to a field by creating a field security profile. After you create the profile, you assign users
and or teams to that profile, and set up specific read, create, or write permissions for the field.
More information: Security concepts for Dynamics 365
1. Make sure you have the System Administrator security role or equivalent permissions in Microsoft
Dynamics 365.
Check your security role
Follow the steps in View your user profile.
Don’t have the correct permissions? Contact your system administrator.
2. Go to Settings > Security.
3. Click Field Security Profiles, and then on the command bar, click New.
4. Enter a name and a description (optional) and click Save.
5. Under Common, click Field permissions.
6. Select a field, and then click Edit.
7. Select the permissions that you want to assign to users or teams, and then click OK.
8. To add users or teams:
a. Under Members, click Teams or Users.
b. On the command bar, click Add.
c. In the Look Up Records dialog box, select a team or user from the list (or search for a team or user),
and then click Select.
d. Repeat the preceding steps to add multiple teams or users, and then click Add.
See also
Enable or disable security for a field

Enable or disable security for a field to control access
8/24/2018 • 2 minutes to read • Edit Online

Applies to Dynamics 365 (online), version 9.x
Applies to Dynamics 365 (online), version 8.x
Field-level security lets you set which fields users can see or edit. For example, if want to prevent users from
accidentally changing an account name, you can restrict them from editing that field. In Dynamics CRM 2013, you
could only set field-level security for custom fields, but in Dynamics CRM 2015 or later, you can also set field-level
security for default fields. More information: Field-level security
To set which users and teams have read or write access to fields, see Set up security permissions for a field.
NOTE
You can’t change the permissions on a field that you don’t have permission to access.

1. Go to Settings > Customizations.
2. Click Customize the System.
3. Under Components, expand Entities, expand the entity that has the field you want to secure, and then
click Fields.
4. In the list of fields, double-click the field you want to secure.
5. In the Field window, on the General tab, to the right of Field Security, specify whether to Enable or
Disable security for the field.
6. Click Save or Save and Close.
7. When your customizations are complete, publish them:
To publish customizations for only the entity that you are currently editing, in the navigation pane,
select the entity, and then click Publish.
To publish customizations for all unpublished entities at one time, in the navigation pane, click
Entities, and then on the command toolbar, click Publish All Customizations.
See also
Field level security
Set up security permissions for a field

Hierarchy security to control access
9/27/2018 • 9 minutes to read • Edit Online

Applies to Dynamics 365 (online), version 9.x
Applies to Dynamics 365 (online), version 8.x
The hierarchy security model is an extension to the existing Dynamics 365 security models that use business units,
security roles, sharing, and teams. It can be used in conjunction with all other existing security models. The
hierarchy security offers a more granular access to records for an organization and helps to bring the maintenance
costs down. For example, in complex scenarios, you can start with creating several business units and then add the
hierarchy security. This will achieve a more granular access to data with far less maintenance costs that a large
number of business units may require.

Manager hierarchy and Position hierarchy security models
Two security models can be used for hierarchies, the Manager hierarchy and the Position hierarchy. With the
Manager hierarchy, a manager must be within the same business unit as the report, or in the parent business unit
of the report’s business unit, to have access to the report’s data. The Position hierarchy allows data access across
business units. If you are a financial organization, you may prefer the Manager hierarchy model, to prevent
managers’ accessing data outside of their business units. However, if you are a part of a customer service
organization and want the managers to access service cases handled in different business units, the Position
hierarchy may work better for you.
NOTE
While the hierarchy security model provides a certain level of access to data, additional access can be obtained by using
other forms of security, such as security roles.

Manager hierarchy
The Manager hierarchy security model is based on the management chain or direct reporting structure, where the
manager’s and the report’s relationship is established by using the Manager field on the system user entity. With
this security model, the managers are able to access the data that their reports have access to. They are able to
perform work on behalf of their direct reports or access information that needs approval.
NOTE
With the Manager hierarchy security model, a manager has access to the records owned by the user or by the team that a
user is a member of, and to the records that are directly shared with the user or the team that a user is a member of.
In addition to the Manager hierarchy security model, a manager must have at least the user level Read privilege on an entity,
to see the reports’ data. For example, if a manager doesn’t have the Read access to the Case entity, the manager won’t be
able to see the cases that their reports have access to.

For a non-direct report, a manager has the Read-only access to the report’s data. For a direct report, the manager
has the Read, Write, Update, Append, AppendTo access to the report’s data. To illustrate the Manager hierarchy
security model, let’s take a look at the diagram below. The CEO can read or update the VP of Sales data and the
VP of Service data. However, the CEO can only read the Sales Manager data and the Service Manager data, as
well as the Sales and Support data. You can further limit the amount of data accessible by a manager with
“Depth”. Depth is used to limit how many levels deep a manager has Read-only access to the data of their reports.
For example, if the depth is set to 2, the CEO can see the data of the VP of Sales, VP of Service and Sales and

Service Managers. However, the CEO doesn’t see the Sales data or the Support data.

It is important to note that if a direct report has deeper security access to an entity than their manager, the
manager may not able to see all the records that the direct report has access to. The following example illustrates
this point.
A single business unit has three users: User 1, User 2 and User 3.
User 2 is a direct report of User 1.
User 1 and User 3 have User level read access on the Account entity. This access level gives users access to
records they own, the records that are shared with the user, and records that are shared with the team the
user is a member of.
User 2 has Business Unit read access on the Account entity. This allows User 2 to view all of the accounts
for the business unit, including all of the accounts owned by User 1 and User 3.
User 1, as a direct manager of User 2, has access to the accounts owned by or shared with User 2, and any
accounts that are shared with or owned by a team that User 2 is a member of. However, User 1 doesn’t
have access to the accounts of User 3, even though his direct report may have access to User 3 accounts.
Position hierarchy
The Position hierarchy is not based on the direct reporting structure, like the Manager hierarchy. A user doesn’t
have to be an actual manager of another user to access user’s data. As an administrator, you will define various job
positions in the organization and arrange them in the Position hierarchy. Then, you add users to any given
position, or, as we also say, “tag” a user with a particular position. A user can be tagged only with one position in a
given hierarchy, however, a position can be used for multiple users. Users at the higher positions in the hierarchy
have access to the data of the users at the lower positions, in the direct ancestor path. The direct higher positions
have Read, Write, Update, Append, AppendTo access to the lower positions’ data in the direct ancestor path. The
non-direct higher positions, have Read-only access to the lower positions’ data in the direct ancestor path.
To illustrate the concept of the direct ancestor path, let’s look at the diagram below. The Sales Manager position
has access to the Sales data, however, it doesn’t have access to the Support data, which is in the different ancestor
path. The same is true for the Service Manager position. It doesn’t have access to the Sales data, which is in the
Sales path. Like in the Manager hierarchy, you can limit the amount of data accessible by higher positions with
“Depth”. The depth will limit how many levels deep a higher position has a Read-only access, to the data of the
lower positions in the direct ancestor path. For example, if the depth is set to 3, the CEO position can see the data
all the way down from the VP of Sales and VP of Service positions, to the Sales and Support positions.

NOTE
With the Position hierarchy security, a user at a higher position has access to the records owned by a lower position user or
by the team that a user is a member of, and to the records that are directly shared to the user or the team that a user is a
member of.
In addition to the Position hierarchy security model, the users at a higher level must have at least the user level Read
privilege on an entity to see the records that the users at the lower positions have access to. For example, if a user at a
higher level doesn’t have the Read access to the Case entity, that user won’t be able to see the cases that the users at a
lower positions have access to.

Set up hierarchy security
To set up the security hierarchy, you must have an Administrator security role.
The hierarchy security is disabled by default. To enable:
1. Go to Settings > Security.
2. Choose Hierarchy security and select Enable Hierarchy Modeling.
IMPORTANT
To make any changes in Hierarchy security, you must have the Change Hierarchy Security Settings privilege.

After you have enabled the hierarchy modeling, choose the specific model by selecting the Manager Hierarchy
or Custom Position Hierarchy. All system entities are enabled for hierarchy security out-of-the-box, but, you can
exclude selective entities from the hierarchy. The Hierarchy Security window shown below:

Set the Depth to a desired value to limit how many levels deep a manager has a Read-only access to the data of
their reports. For example, if the depth equals to 2, a manager can only access his accounts and the accounts of the
reports two levels deep. In our example, if you log in into Dynamics 365 not as an Administrator, who can see all
accounts, but, as the VP of Sales, you’ll only be able to see the active accounts of the users shown in the red
rectangle, as illustrated below:

NOTE
While, the hierarchy security grants the VP of Sales access to the records in the red rectangle, additional access can be
available based on the security role that the VP of Sales has.

Set up Manager and Position hierarchies
The Manager hierarchy is easily created by using the manager relationship on the system user record. You use the
Manager (ParentsystemuserID ) lookup field to specify the manager of the user. If you have already created the
Position hierarchy, you can also tag the user with a particular position in the Position hierarchy. In the following
example, the sales person reports to the sales manager in the Manager hierarchy and also has the Sales position
in the Position hierarchy:

To add a user to a particular position in the Position hierarchy, use the lookup field called Position on the user
record’s form, as show below:
IMPORTANT
To add a user to a position or change the user’s position, you must have the Assign position for a user privilege.

To change the position on the user record’s form, on the nav bar, choose More (…) and choose a different position,
as shown below:

To create a Position hierarchy:
1. Go to Settings > Security.
2. Choose Positions.
For each position, provide the name of the position, the parent of the position, and the description. Add
users to this position by using the lookup field called Users in this position. Below is the example of
Position hierarchy with the active positions.

The example of the enabled users with their corresponding positions is shown below:

Performance considerations
To boost the performance, we recommend:
Keep the effective hierarchy security to 50 users or less under a manager/position. Your hierarchy may have
more than 50 users under a manager/position, but you can use the Depth setting to reduce the number of
levels for Read-only access and with this limit the effective number of users under a manager/position to
50 users or less.
Use hierarchy security models in conjunction with other existing security models for more complex
scenarios. Avoid creating a large number of business units, instead, create fewer business units and add
hierarchy security.
See also
Security concepts for Microsoft Dynamics 365
Query and visualize hierarchical data
Video: Hierarchical Security Modelling in Microsoft Dynamics CRM 2015
Video: Hierarchy Visualization in Microsoft Dynamics CRM 2015

Create users in Dynamics 365 (online) and assign
security roles
10/11/2018 • 13 minutes to read • Edit Online

Applies to Dynamics 365 (online), version 9.x
Applies to Dynamics 365 (online), version 8.x
You use the Office 365 Admin Center to create user accounts for every user who needs access to Dynamics 365
(online). The user account registers the user with Microsoft Online Services environment. In addition to
registration with the online service, the user account must be assigned a license in order for the user to have
access to the service. Note that when you assign a user the global administrator or the service administrator role
in the Microsoft Online Services environment, it automatically assigns the user the System Administrator
security role in Dynamics 365. More information: Differences between the Microsoft Online services
environment administrative roles and Dynamics 365 (online) security roles

Create a user account
When you create a user account in the Office 365 Admin Center, the system generates a user ID and temporary
password for the user. You have the option to let the service send an email message to the user as clear text.
Although the password is temporary, you may consider copying the information to send to the user through a
more secure channel, such as from an email service that can digitally encrypt the contents. For step-by-step
instructions for creating a Microsoft Online Services user account, see Create or edit users in Office 365.
Check out the following video: Add People to Dynamics 365.
NOTE
When you create a user and assign a license in the Office 365 Admin Center, the user is also created in Dynamics 365
(online). The synchronization process between the Office 365 Admin Center and Dynamics 365 (online) can take a few
minutes to complete.
By entering a user ID and password, a user can access the Office 365 Admin Center to view information about the service.
However, the user will not have access to Dynamics 365 (online) until you assign at least one Dynamics 365 (online)
security role to this user.

TIP
To force an immediate synchronization between the Office 365 Admin Center and Dynamics 365 (online), do the following:
Sign out of Dynamics 365 (online) and the Office 365 Admin Center.
Close all open browsers used for Dynamics 365 (online) and the Office 365 Admin Center.
Sign back in to Dynamics 365 (online) and the Office 365 Admin Center.

User profile information
Some user profile information is maintained and managed in the Office 365 Admin Center. After you create or
update a user, these user profile fields are automatically updated and synchronized in your Dynamics 365
(online) instances.
The following table shows the fields that are managed in the Users section of the Office 365 Admin Center.

DYNAMICS 365 USER FORM

OFFICE 365 / AZURE ACTIVE DIRECTORY USER

User Name

Username

Full Name

First name + Last name

Title

Job title

Primary Email*

Main Phone

Office phone

Mobile Phone

Mobile phone

Fax

Fax number

Address

Street address

Address

City

Address

State or province

Address

Country or region

*To prevent data loss, the Primary Email field does not automatically update and synchronize with Dynamics 365
(online).
The following are Office 365 user contact fields.

Add a license to a user account
You can license the user when you create the user account, or you can license the user later. You must assign a
license to every user account that you want to access the online service.
For step-by-step instructions, see Assign, reassign, or remove licenses.

IMPORTANT
Licensed users must be assigned at least one Dynamics 365 security role to access Dynamics 365 (online).

About user licenses
Dynamics 365 (online) uses user licenses to provide access to your organization. You need one user
license per person with an active user record who logs into your organization.
When you add a new person, the New user account form displays the number of user licenses available.
If you reach your limit, the On button is no longer available. You can add additional licenses by choosing
Billing > Purchase Services from the left-side menu in the Office 365 Admin Center.
An unaccepted invitation requires a user license until the invitation expires two weeks after it was issued.
If you have more user licenses than you are using, contact support to reduce the number of licenses. You
cannot reduce the number of licenses to less than you are currently using or less than your offer allows.
Any changes are reflected in your next billing cycle.
Each user license requires a unique Microsoft account, and every user who logs on to Dynamics 365
needs a license. Most Dynamics 365 subscriptions include a specific number of user licenses.

Assign a security role to a user
Security roles control a user’s access to data through a set of access levels and permissions. The combination of
access levels and permissions that are included in a specific security role sets limits on the user’s view of data
and on the user’s interactions with that data.
Dynamics 365 (online) provides a default set of security roles. If necessary for your organization, you can create
new security roles by editing one of the default security roles and then saving it under a new name.
You can assign more than one security role to a user. The effect of multiple security roles is cumulative, which
means that the user has the permissions associated with all security roles assigned to the user.
Security roles are associated with business units. If you have created business units, only those security roles
associated with the business unit are available for the users in the business unit. You can use this feature to limit
data access to only data owned by the business unit.
For more information about the difference between Microsoft Online Services administrator roles and Dynamics
365 (online) security roles, see Grant users access to Microsoft Dynamics 365 (online) as a Microsoft Online
service.
IMPORTANT
You must assign at least one security role to every Dynamics 365 (online) user. The service does not allow access to users
who do not have at least one security role. Even if a user is a member of a team with its own security privileges, the user
won’t be able to see some data and may experience other problems when trying to use the system.

In Dynamics 365 (online):
1. Click Settings > Security > Users.
2. In the list, select the user or users that you want to assign a security role to.
3. Click Manage Roles.
Only the security roles available for that user's business unit are displayed.

4. In the Manage User Roles dialog box, select the security role or roles you want for the user or users, and
then click OK.

(Optional) Assign an administrator role
You can share Microsoft Online Services environment administration tasks among several people by assigning
Microsoft Online Services environment administrator roles to users you select to fill each role. You might decide
to assign the global administrator role to a second person in your organization for times when you are not
available.
There are five Microsoft Online Services environment administrator roles with varying levels of permissions. For
example, the password reset administrator role can reset user passwords only; the user management
administrator role can reset user passwords as well as add, edit, or delete user accounts; and the global
administrator role can add online service subscriptions for the organization and can manage all aspects of
subscriptions. For detailed information about Microsoft Online Services administrator roles, see Assigning
Admin Roles.
NOTE
Microsoft Online Services environment administrator roles are valid only for managing aspects of the online service
subscription. These roles don’t affect permissions within the Dynamics 365 (online) service.

Enable or disable users
To enable a user, assign a license to the user and add a user to the security group that is associated with an
instance of Dynamics 365 (online). If you enable a user that was disabled, you must send a new invitation for the
user to access the system.
To disable a user, remove a license from the user or remove the user from the security group that is associated
with an instance of Dynamics 365 (online). Removing a user from the security group doesn’t remove the user’s
license. If you want to make the license available to another user, you have to remove the license from the
disabled user.
NOTE
Removing all security roles from the user prevents the user from signing into and accessing Dynamics 365 (online).
However, it doesn’t remove the license from the user and the user remains in the list of the enabled users in Dynamics 365
(online). Removing security roles from a user isn’t a recommended method of removing access to Dynamics 365 (online).

You must be a member of an appropriate administrator role to do these tasks. More information: Assigning
Admin Roles
Enable a user by assigning a license to the user and adding a user to the security group
1. Browse to the Office 365 admin center and sign in.
2. Click Users > Active users and select the user.
3. Under Product licenses, click Edit.
4. Turn on a Dynamics 365 (online) license, and then click Save > Close.
5. In the Office 365 Admin Center, click Groups > Groups.
6. Choose the security group that is associated with your Dynamics 365 (online) organization.
7. Under Members, click Edit, and then Add members. Select from the list of users with Office 365

licenses or use Search to find users.
8. Select the users to add to the security group, and then click Save > Close multiple times.
To add multiple users, see: bulk add users to Office365 groups.
Disable a user by removing a license from the user
1. In the Office 365 Admin Center, click Users > Active Users and select a user.
2. In the right-side menu, under Product licenses, click Edit.
3. Turn off the Dynamics 365 (online) license, and then click Save > Close multiple times.
Disable a user by removing the user from the security group that is associated with an instance of Dynamics
365 (online )
1. In the Office 365 Admin Center, click Groups > Groups.
2. Choose the security group that is associated with your Dynamics 365 (online) organization.
3. In the right-side menu, under Members, click Edit.
4. Click Remove members, and then the select users to remove from the security group.
5. Click Save > Close multiple times.
NOTE
You can also delete users in the Office 365 Admin Center. When you remove a user from your subscription, the license
assigned to that user automatically becomes available to be assigned to a different user. If you want the user to still have
access to other applications you manage through Office 365, for example Microsoft Exchange Online or SharePoint, don't
delete them as a user. Instead, simply remove the Dynamics 365 license you've assigned to them.

NOTE
When you sign out of the Office 365 Admin Center, you aren’t signing out of Dynamics 365. You have to do that
separately.

Create an Administrative user account
An Administrative user is a user who has access to the Settings and Administration features but has no access to
any of the customer engagement functionality. It is used to allow customers to assign administrative users to
perform day-to-day maintenance functions (create user accounts, manage security roles, etc). Since the
administrative user does not have access to customer data and any of the customer engagement functionalities,
it does not require a Dynamics 365 (online) license (after setup).
You need to have the System Administrator security role or equivalent permissions in Dynamics 365 to create an
administrative user. First, you’ll create a user account in Office 365 and then in Dynamics 365 (online), select the
Administrative access mode for the account.

NOTE
See Create an administrative user and prevent elevation of security role privilege for an example of how an Administrative
user account can be used.

1. Create a user account in the Office 365 Admin Center.
Be sure to assign a Dynamics 365 (online) license to the account. You'll remove the license (step 6) once
you've assigned the Administrative Access Mode.
2. Go to Dynamics 365 (online).
3. Go to Settings > Security.
4. Choose Users > Enabled Users, and then click a user’s full name.
5. In the user form, scroll down under Administration to the Client Access License (CAL ) Information
section and select Administrative for Access Mode.
You then need to remove the Dynamics 365 (online) license from the account.
6. Go to the Office 365 Admin Center.
7. Click Users > Active Users.
8. Choose the Administrative user account and under Product licenses, click Edit.
9. Turn off the Dynamics 365 (online) license, and then click Save > Close multiple times.

Create a non-interactive user account
The non-interactive user is not a ‘user’ in the typical sense – it is not a person but an access mode that is created
with a user account. It is used for programmatic access to and from Dynamics 365 between applications. A noninteractive user account lets these applications or tools, such as a Dynamics 365 to ERP connector, authenticate
and access Dynamics 365 (online), without requiring a Dynamics 365 (online) license. For each instance of
Dynamics 365 (online), you can create up to five non-interactive user accounts.
You need to have the System Administrator security role or equivalent permissions in Dynamics 365 to create a
non-interactive user. First, you’ll create a user account in Office 365 and then in Dynamics 365 (online), select the
non-interactive access mode for the account.
1. Create a user account in the Office 365 Admin Center.
Be sure to assign a Dynamics 365 (online) license to the account.
2. Go to Dynamics 365 (online).
3. Go to Settings > Security.
4. Choose Users > Enabled Users, and then click a user’s full name.
5. In the user form, scroll down under Administration to the Client Access License (CAL ) Information
section and select Non-interactive for Access Mode.
You then need to remove the Dynamics 365 (online) license from the account.
6. Go to the Office 365 Admin Center.
7. Click Users > Active Users.
8. Choose the non-interactive user account and under Product licenses, click Edit.

9. Turn off the Dynamics 365 (online) license, and then click Save > Close multiple times.
10. Go back to Dynamics 365 (online) and confirm that the non-interactive user account Access Mode is still
set for Non-interactive.

Create an application user
Introduced in December 2016 Update for Dynamics 365 (online), you can use server-to-server (S2S )
authentication to securely and seamlessly communicate with December 2016 update for Dynamics 365 (online)
with your web applications and services. S2S authentication is the common way that apps registered on
Microsoft AppSource use to access the Dynamics 365 data of their subscribers. All operations performed by
your application or service using S2S will be performed as the application user you provide rather than as the
user who is accessing your application.
All application users are created with a non-interactive user account, however they are not counted towards the
five non-interactive user accounts limit. In addition, there is no limit on how many application users you can
create in an instance.
You will need to create a custom security role and an application user to associate with your registered app. For
more information, see Build web applications using Server-to-Server (S2S ) authentication.

How stub users are created
A stub user is a user record that has been created as a placeholder. For example, records have been imported
that refer to this user but the user does not exist in Dynamics 365 (online). This user cannot log in, cannot be
enabled, and cannot be synchronized to Office 365. This type of user can only be created through data import.
A default security role is automatically assigned to these imported users. The Salesperson security role is
assigned in a Dynamics 365 Customer Engagement instance and the Common Data Service User security role
is assigned in a PowerApps environment.
See also
Manage subscriptions, licenses, and user accounts
Assigning Admin Roles
Add users to Office 365 for business
Security roles and privileges
Manage Microsoft Dynamics 365 (online) licenses

Manage teams
9/27/2018 • 6 minutes to read • Edit Online

Applies to Dynamics 365 (online), version 9.x
Applies to Dynamics 365 (online), version 8.x
Using teams in Dynamics 365 is optional. However, teams provide an easy way to share business objects and let
you collaborate with other people across business units. While a team belongs to one business unit, it can include
users from other business units. You can associate a user with more than one team.
You can use two types of teams:
An owner team owns records and has security roles assigned to the team. The team’s privileges are defined
by these security roles. In addition to privileges provided by the team, team members have the privileges
defined by their individual security roles and by the roles from other teams in which they are members. A
team has full access rights on the records that the team owns.
An access team doesn’t own records and doesn’t have security roles assigned to the team. The team
members have privileges defined by their individual security roles and by roles from the teams in which
they are members. The records are shared with an access team and the team is granted access rights on the
records, such as Read, Write, or Append.

Owner team or access team?
Choosing the type of the team may depend on the goals, nature of the project, and even the size of your
organization. There are a few guidelines that you can use when choosing the team type.
When to use owner teams
Your organization’s policies require the ability for records to be owned by entities other than users, such as
the team entity.
The number of teams is known at the design time of your Dynamics 365 system.
Daily reporting on progress by owning teams is required.
When to use access teams
The teams are dynamically formed and dissolved. This typically happens if the clear criteria for defining the
teams, such as established territory, product, or volume are not provided.
The number of teams is not known at the design time of your Dynamics 365 system.
The team members require different access rights on the records. You can share a record with several
access teams, each team providing different access rights on the record. For example, one team is granted
the Read access right on the account and another team, the Read, Write, and Share access rights on the
same account.
A unique set of users requires access to a single record without having an ownership of the record.

About owner teams
An owner team can own one or more records. To make a team an owner of the record, you must assign a record
to the team.
While teams provide access to a group of users, you must still associate individual users with security roles that

grant the privileges they need to create, update, or delete user-owned records. These privileges can't be applied by
assigning security roles to a team and then adding the user to that team.
If an owner team doesn’t own records and doesn’t have security roles assigned to the team, it can be converted to
an access team. It is a one-way conversion. You can’t convert the access team back to the owner team. During
conversion, all queues and mailboxes associated with the team are deleted. When you create a team in the Web
application, you have to choose the team type Owner.
More information: Assign a record to a user or team

Create a team
1. Make sure that you have the System Administrator, System Customizer, Sales Manager, Vice President of
Sales, Vice President of Marketing, or CEO -Business Manager security role or equivalent permissions.
Check your security role
Follow the steps in View your user profile.
Don’t have the correct permissions? Contact your system administrator.
2. Go to Settings > Security.
(In Microsoft Dynamics 365 for Outlook, go to Settings > System > Security.)
3. Click Teams.
4. On the Actions toolbar, click the New button, complete the required fields, and then click Save.
If you don’t select the business unit to which the team will belong, by default, the root business unit is
selected. The root business unit is the first business unit created for an organization.

Edit a team
1. Make sure that you have the System Administrator, System Customizer, Sales Manager, Vice President of
Sales, Vice President of Marketing, or CEO -Business Manager security role or equivalent permissions.
Check your security role
Follow the steps in View your user profile.
Don’t have the correct permissions? Contact your system administrator.
2. Go to Settings > Security.
(In Dynamics 365 for Outlook, go to Settings > System > Security.)
3. Click Teams.
4. In the Teams dropdown list, select All Teams or another appropriate view.
5. In the grid, select the team you want to edit.
6. On the Actions toolbar, click Edit, change the desired fields, and then click Save.

About access teams and team templates
You can create an access team manually by choosing the team type Access, or let the system create and manage
an access team for you. When you create an access team, you can share multiple records with the team.
A system-managed access team is created for a specific record, other records can’t be shared with this team. You

have to provide a team template that the system uses to create a team. In this template, you define the entity type
and the access rights on the record that are granted to the team members when the team is created.
A team template is displayed on all record forms for the specified entity as a list. When you add the first user to
the list, the actual access team for this record is created. You can add and remove members in the team by using
this list. The team template applies to the records of the specified entity type and the related entities, according to
the cascading rules. To give team members different access on the record, you can provide several team templates,
each template specifying different access rights. For example, you can create a team template for the Account
entity with the Read access right, which allows the team members to view the specified account. For another team
that requires more access to the same account, you can create a team template with Read, Write, Share and other
access rights. To be added to the team, a minimum access level a user must have on the entity specified in the
template is Basic (User) Read.
Because of the parental relationship between the team template and system-managed access teams, when you
delete a template, all teams associated with the template are deleted according to the cascading rules. If you
change access rights for the team template, the changes are applied only to the new auto-created (systemmanaged) access teams. The existing teams are not affected.
NOTE
A user must have sufficient privileges to join an access team. For example, if the access team has the Delete access right on
an account, the user must have the Delete privilege on the Account entity to join the team. If you’re trying to add a user
with insufficient privileges, you’ll see this error message: “You can’t add the user to the access team because the user doesn’t
have sufficient privileges on the entity.”

For the step-by-step instructions on how to create a team template and add it the entity form, see the article in the
Create a team template and add to an entity form

Maximum settings for system-managed access teams
The maximum number of team templates that you can create for an entity is specified in the
MaxAutoCreatedAccessTeamsPerEntity deployment setting. The default value is 2. The maximum number of entities
that you can enable for auto-created access teams is specified in the MaxEntitiesEnabledForAutoCreatedAccessTeams
deployment setting. The default value is 5. You can use the Set-CrmSetting Windows PowerShell command to
update this value.
See also
Manage security, users and teams
Create a team template and add to an entity form
About team templates
Print leads, quotes, and other records
Add teams or users to a field security profile
About team templates
Download: Access Teams in Microsoft Dynamics CRM
Download: Scalable security modeling with Microsoft Dynamics CRM
Entity relationship behavior

About collaborating with team templates
8/24/2018 • 2 minutes to read • Edit Online

Applies to Dynamics 365 (online), version 9.x
Applies to Dynamics 365 (online), version 8.x
Using teams in Dynamics 365 is optional, however, teams give you an easy way to share information and
collaborate with users across business units. A team is a group of users. As a group, you will be able to track
information about the records and perform assigned tasks in much more efficient and coordinated way. While a
team belongs to only one business unit, it can include users from other business units. A user can be associated
with more than one team.
There are two types of teams that you can work with: owner and access.
An owner team owns records and has security roles assigned to the team. The team’s privileges are defined
by these security roles. In addition to privileges provided by the team’s security roles, users have the
privileges defined by their individual security roles and by the roles from other teams in which they are
members. A team has full access rights on the records that the team owns.
An access team doesn’t own records and doesn’t have security roles assigned to the team. The users have
privileges defined by their individual security roles and by the roles from other teams in which they are
members. The records are shared with an access team and the team members are granted access rights on
the records, such as Read, Write, or Append.
An access team can be created manually (user-created) or automatically (system-managed). You can share
multiple records with a user-created access team. A system-managed team is created for a specific record and
other records can’t be shared with this team. For system-managed teams, you have to provide a team template
that the system uses to create a team. In this template, you define the entity type and the access rights on the
record that are granted to the team members when the team is created. A team template is displayed on all record
forms for the specified entity as a list. When you add the first user to the list, the actual access team for this record
is created. You can add and remove members in the team using this list. The team template applies to the records
of the specified entity type and the related entities, according to the cascading rules. To give team members
different access on the record, you can provide several team templates, each template specifying different access
rights. For example, you can create a team template for the account entity with the Read access right, which allows
the team members to view the specified account. For another team that requires more access to the same account,
you can create a team template with Read, Write, Share and other access rights.
Only entities that are enabled for system-managed access teams can be specified in the template.
If you change access rights in the team template, the changes are only applied to new system-managed access
teams. The existing teams aren’t affected.
For information about how to create a team template, enable an entity for system-managed access teams and how
to customize the entity form to add the team template, see Create a team template and add to an entity form.
See also
Create a team template and add to an entity form
Manage teams
Access teams in Microsoft Dynamics CRM

Create a team template to control access rights for
automatically created teams
8/24/2018 • 2 minutes to read • Edit Online

Applies to Dynamics 365 (online), version 9.x
Applies to Dynamics 365 (online), version 8.x
A team template can be used for the entities that are enabled for automatically created access teams. In the team
template, you have to specify the entity type and the access rights on the entity record. For example, you can
create a team template for an account entity and specify the Read, Write, and Share access rights on the account
record that the team members are granted when the team is automatically created. After you create a team
template, you have to customize the entity main form to include the new team template. After you publish
customizations, the access team template is added in all record forms for the specified entity in a form of a list. For
example, you created a team template called “Sales team” for the account entity. On all account record forms
you’ll see the list called “Sales team”. You can add or remove team members using this list.

Enable an entity for access teams
1. Make sure you have the System Administrator security role or equivalent permissions in Microsoft
Dynamics 365.
2. Go to Settings > Customizations.
3. In the Customization window, choose Customize the System.
4. In the navigation pane, expand Entities, and then choose the entity you want to use in the team template.
5. On the Entity Definition form, in the Communication & Collaboration section, select the Access
Teams checkbox.
6. On the Actions toolbar, choose Save.

Create a team template
1. Go to Settings > Security.
2. Choose Access Team Templates.
3. On the Actions toolbar, choose New, complete the required fields, and then choose Save.

Add a team template to the entity form
1. Make sure you have the System Administrator security role or equivalent permissions in Microsoft
Dynamics 365.
2. Go to Settings > Customizations.
3. In the Customization window, choose Customize the System.
4. In the navigation pane, expand Entities, expand the entity you want to use in the team template, and then
choose Forms.
5. In System Forms, select Active Forms > Main form.

6. On the Main form, open the Insert tab.
7. On the ribbon, choose Sub-Grid.
The Set Properties dialog box appears.
8. In Set Properties, complete the required fields, and then select the Display label on the Form check box.
9. In the Records drop-down list, select All Record Types.
10. In the Entity drop-down list, select Users.
11. In the Default View drop-down list, select Associated Record Team Members.
12. In the Team Template drop-down list, select the desired template and choose Set.
The team template you selected now appears on the Main form.
13. On the Actions toolbar, click or tap Save, and then choose Publish.
See also
Manage teams
About team templates

Add teams or users to a field security profile to
control access
9/27/2018 • 2 minutes to read • Edit Online

Applies to Dynamics 365 (online), version 9.x
Applies to Dynamics 365 (online), version 8.x
Role-based security controls access to a specific entity type, record-based security controls access to individual
records, and field-level security controls access to specific fields. You can use a field security profile to manage the
permission of users and teams to read, create, or write in secured fields. For example, the System Administrator
field security profile gives full access to all secured fields in Dynamics 365.
1. Go to Settings > Security.
2. Choose Field Security Profiles.
3. Choose the profile name that you want to add teams or users to.
4. Under Related, choose Teams or Users.
5. On the Actions toolbar, choose Add.
6. Select a team or user from the list. You can search for a team or user first.
7. Choose Add.
8. Close the field security profile record.
See also
Control data access
Security concepts for Microsoft Dynamics 365
Manage security, users and teams
Synchronize user information between Microsoft Dynamics 365 and Active Directory

Synchronize user information with Active Directory
8/24/2018 • 2 minutes to read • Edit Online

Applies to Dynamics 365 (on-premises)
Dynamics 365 supports two methods for authenticating users:
Integrated Windows Authentication
Claims-based authentication
By default, customers who purchase Dynamics 365 and deploy it on-premises use Windows Authentication. These
customers also can set up claims-based authentication for Internet-facing deployments (IFDs) of the product.
With integrated Windows Authentication, each user record in Dynamics 365 must be associated with a user
account in Active Directory to enable log on to Dynamics 365. When the user records are associated, Dynamics
365 automatically reads and stores other information about the user record (including the first and last name, the
email address, and the globally unique identifier, or GUID ) from the Active Directory directory service.
However, changes to the Active Directory information associated with a specific user can create discrepancies with
the information maintained in Dynamics 365, thereby preventing the user from accessing Dynamics 365.
Specifically, if value of the User SamAccountName logon attribute in Active Directory changes for a user, the
corresponding user information in Dynamics 365 won’t match and the user won’t be able log on.
To ensure that the user can successfully log on to Dynamics 365, you must update the information in the Dynamics
365 user record so that it matches the detail in Active Directory.
Before you start, be sure to record the value of the User SamAccountName logon attribute for the affected user
before updating the corresponding user record in Dynamics 365.
NOTE
For information about synchronizing Dynamics 365 (online) with Active Directory, see the blog post How to Synchronize
CRM Online with your Active Directory.

1. Go to Settings > Security.
2. Choose Users.
3. In the list of users, choose to select the user record you want to update, and then choose Edit.
4. In the User Name text box, type an Active Directory user name that isn’t used by any Dynamics 365 user
record.
IMPORTANT
If you specify a user name that already exists in Active Directory, Dynamics 365 will try to map the user to the
updated user in Active Directory, and when it locates an existing record with the same GUID, the mapping will fail.

If all the user accounts in Active Directory are used by Dynamics 365 user records, create a temporary
Active Directory user account.
5. Save the user record, and then in the User Name text box, type in the User SamAccountName logon

value that appears for the user Active Directory, which you recorded prior to starting this procedure.
6. Choose Save and Close.
See also
Manage security, users and teams
Add or remove territory members

Add or remove territory members
9/27/2018 • 2 minutes to read • Edit Online

Applies to Dynamics 365 (online), version 9.x
Applies to Dynamics 365 (online), version 8.x
To accommodate changes in sales territories or the representatives that are assigned to each territory, you can add
or remove territory members in Dynamics 365.
1. Go to Settings > Business Management.
2. Choose Sales Territories.
3. In the list of territories, under Territory Name, double-click or tap the entry for the territory you want to
add people to or remove people from.
4. In the Navigation Pane, expand Common if necessary, and then choose Members.
5. Follow the steps for the task you’re performing:
Add people to a sales territory
a. On the ribbon, choose Add Members, view the text in the Message from webpage dialog box, and
then choose OK to close the dialog box.
b. In the Look Up Records dialog box, in the Search text box, type in the name or a part of the name of
the user you want to add to the sales territory, and then choose the Start search icon .
c. In the list of records, select the people you want to add to the sales territory, and then tap or click
Add.
Remove people from a sales territory
a. In the list of members, select the people you want to remove from the sales territory, and then on the
ribbon, choose Remove Members.
b. In the Remove Members dialog box, choose Remove.
NOTE
When you remove someone from a sales territory, the updated list of members isn’t displayed until you
refresh the page.

See also
Manage users
Manage security, users and teams

Troubleshooting: User needs read-write access
8/24/2018 • 2 minutes to read • Edit Online

Applies to Dynamics 365 (online), version 9.x
Applies to Dynamics 365 (online), version 8.x
You don’t have sufficient permissions to access Dynamics 365. A Dynamics 365 system administrator will need to
do the following in the Dynamics 365 application:
1. Go to Settings > Security.
2. Choose Users.
3. Open the user record.
4. Choose More Commands ( ) > Manage Roles.
5. Make note of the role assigned to the user. If appropriate, select a different security role. Close the Manage
User Roles dialog box.
6. Choose Security > Security Roles.
7. Choose the security role from step 4.
8. Choose Core Records.
9. Confirm that the Read permission for User Entity UI Settings is set to the User level (a yellow circle with
a wedge-shaped segment).
If the security role is missing this permission, the system administrator will need to change this setting by
clicking or tapping on it.

NOTE
If you have multiple security roles assigned, confirm that at least one assigned role has the User Entity UI Settings privilege
set to the User level.

See also
Manage security, users and teams

Manage instances
8/24/2018 • 2 minutes to read • Edit Online

Applies to Dynamics 365 (online), version 9.x
Applies to Dynamics 365 (online), version 8.x
You manage your Dynamics 365 (online) instances from the Dynamics 365 admin center.
1. Browse to the Office 365 admin center and sign in using Global administrator credentials.
2. Choose Admin > Dynamics 365
This section provides information on how you add or edit instances of a Dynamics 365 (online) subscription and
set up additional non-production (Sandbox) instances.
See also
Terminology used in the product and documentation

What's new for instance management
8/24/2018 • 2 minutes to read • Edit Online

Applies to Dynamics 365 (online), version 9.x
Applies to Dynamics 365 (online), version 8.x
You might have noticed some changes to the Dynamics 365 admin center. On March 21, 2018, we introduced the
following:

1. Instance type picker. Filter on the type of instance: Trial, Production, Sandbox.
2. Common Data Service instance. PowerApps Environments provisioned with Common Data Service in the
PowerApps admin center are now displayed in the Dynamics 365 admin center as Common Data Service
instances.

Filter by instance type
If you're a large organization, you might have numerous instances of various types such as Production and
Sandbox. You can now filter for instance type to show only the type you're interested in.
1. Browse to the Office 365 admin center and sign in using Office 365 Global administrator credentials.
2. Click Admin centers > Dynamics 365.
3. Choose the Instances tab.
4. Select an instance type to display instances for that type only.

Common Data Service instance
Once you create Environments provisioned with Common Data Services in the PowerApps admin center, they will
now show up as Common Data Service instances in your Dynamics 365 admin center.

For more information, see Manage Common Data Service instances.
See also
Administer PowerApps overview
Introduction to the admin center for PowerApps

Manage Sandbox instances
8/24/2018 • 3 minutes to read • Edit Online

Applies to Dynamics 365 (online), version 9.x
Applies to Dynamics 365 (online), version 8.x
A Sandbox instance is any non-production instance of Dynamics 365 (online). Isolated from production, a
Sandbox instance is the place to safely develop and test application changes with low risk.
NOTE
With December 2016 Update for Dynamics 365 (online), we no longer require a minimum purchase amount to receive a
free Sandbox instance. If you've purchased a subscription and have not received a free Sandbox instance, you will be
provided one when you purchase full Dynamics 365 Enterprise licenses. There is a limit of one free Sandbox instance per
tenant. You can also purchase additional Sandbox instances. For more information, see Dynamics 365 pricing and licensing.
Check out Switch an instance for information on how to switch an instance to or from Sandbox and for licensing
considerations.

TIP
Check out the following video: Sandbox instances for Dynamics 365 (3:18).

View your Sandbox instances
You manage your Sandbox instances from the Dynamics 365 admin center.
1. Browse to the Office 365 admin center and sign in using Office 365 Global administrator credentials.
2. Click Admin centers > Dynamics 365.
3. Choose the Instances tab.
On the Manage your Dynamics 365 instances page, you’ll see a list of all your instances.

Reset a Sandbox instance
You can reset a Sandbox instance to delete and re-provision it. Consider a reset when you want to:
Change to a different version of Dynamics 365 (online).
Create a new project
Free up storage space
Remove an instance containing Personally Identifiable Information (PII) data

NOTE
You can only reset Sandbox instances.
Check out the following video: Dynamics CRM 2013 Spring '14 Online New Features -Reset.
This video also applies to CRM Online 2015 Update 1 and Dynamics CRM Online 2016 Update.

An example scenario
Thomas is looking at the storage consumed by the various Contoso instances and is getting concerned that
they’ll run out of space in one of their production instances. He’d like to free up some space so he can give the
production instance some additional storage. He’s also been notified that the Legal department has set a
retention policy on the use of production data in the test environment.
After contacting Isaac, Thomas resets the Sales department’s complete Sandbox instance. The instance is reprovisioned to factory settings and ready for future use as a Sandbox instance for a future project.
To reset an instance
1. Browse to the Office 365 admin center and sign in using Office 365 Global administrator credentials.
2. Click Admin centers > Dynamics 365.
3. Choose the Instances tab.
4. Select a Sandbox instance, and then click Reset.
5. On the reset instance page, adjust the instance settings as needed and then click Reset.
WARNING
The Sandbox instance will be deleted and reset to factory settings. You will not be able to recover any deleted data.

6. Click yes in the confirmation dialog box.

Administration mode
When you place a Sandbox instance in administration mode only users with Dynamics 365 System
Administrator or System Customizer security roles will be able to sign in to that instance. Administration mode is
useful when you want to make operational changes and not have regular users affect your work, and not have
your work affect regular users.
NOTE
You can only place Sandbox instances in administration mode.
Processes that use code, such as plug-ins or custom workflow assemblies, continue to be processed by the
Dynamics 365 platform when administration mode is enabled and background operations are disabled.
Check out the following video: Dynamics CRM 2013 Spring '14 Online New Features -Admin Mode.
This video also applies to CRM Online 2015 Update 1 and Dynamics CRM Online 2016 Update.

On the admin settings page, you can set the following.

SETTING

DESCRIPTION

Enable administration mode

Select to enable administration mode for the selected
Sandbox instance. Only System Administrators or System
Customizers will be able to sign in to the selected Sandbox
instance.

Disable background operations

Select to disable all asynchronous operations (see
Asynchronous service architecture ) such as workflows and
synchronization with Exchange. Emails will not be sent and
server-side synchronization for appointments, contacts, and
tasks are disabled. Note: Administration mode must be
enabled to disable background operations.

Custom message for end users

Enter a message that will be displayed to all users when they
attempt to sign in.

Set administration mode
1. Browse to the Office 365 admin center and sign in using Office 365 Global administrator credentials.
2. Click Admin centers > Dynamics 365.
3. Choose the Instances tab.
4. Select a Sandbox instance, and then click Admin.
5. Select Enable administration mode to enable it, and then click Save.
See also
Blog: Introducing Sandbox Instances in CRM Online
Switch an instance
Delete an instance
Copy an instance

Add an instance to your subscription
8/24/2018 • 8 minutes to read • Edit Online

Applies to Dynamics 365 (online), version 9.x
Applies to Dynamics 365 (online), version 8.x
You can add production and non-production (Sandbox) instances to a Dynamics 365 (online) subscription. Each
new instance creates a separate organization that can be used by different departments, locations, or for nonproduction purposes such as development. For more information on the instance types available to you, see
Microsoft Dynamics 365 pricing and licensing.
Purchase the Dynamics 365 (online) instance on the Microsoft online services portal Purchase subscriptions page.
Additional storage and instances can be purchased by customers who have a paid Dynamics 365 (online)
Professional user license subscription.
You must have the Office 365 Global administrator to do these tasks. For more information, see Assigning
administrator roles.

What information do I need to create an instance?
When you add an instance, you can accept the default values, or enter different values to create a Dynamics 365
(online) instance.
Select which scenario fits you best. The apps you can choose depend on the licenses you've purchased.
If you haven't purchased any Dynamics 365 licenses, you'll only see None of these (don't preinstall any
apps).

Name. This is typically the name of your organization and is displayed in the Dynamics 365 application.
URL. The URL is used to construct the URL for users to sign-in to the Dynamics 365 application. Therefore,
we recommend that you limit the length of URL name to reduce the overall length of the URL.
Purpose. This value is used to associate the instance with a specific intent and is only displayed in the
instance picker, which is accessed through the Dynamics 365 admin center. For example, if this instance is
for exclusive use by your sales and marketing departments you can enter Contoso Sales and Marketing or
if the instance is for development and for testing purposes enter a relevant name such as Contoso
Development.
Security Group. This value is used to determine the Microsoft Online Services security group that includes
the users who will have access to this instance of Dynamics 365 (online). For more information, see Control
user access to instances: security groups and licenses.

IMPORTANT
If you do not specify a security group, all users associated with the subscription who have a Dynamics 365 (online)
license will be added to the new instance.

Country/Region. You can specify a region for the instance.
NOTE
To request the ability to create Dynamics 365 (online) instances (production and non-production) in more than one
geographical region, please contact your account manager or Technical Support.

Currency. When you add an instance, you must select a base currency before the instance is provisioned.
Although you can add currencies in the Dynamics 365 application, only the base currency will be used for
reporting.
WARNING
Once set, the base currency cannot be changed.

Add an additional instance
The following steps apply to customers who do not purchase using volume licensing. Volume license customers
should see: Microsoft Volume Licensing Service Center.
Step 1: Purchase the additional instance
1. Sign in to the Office 365 admin center as an Office 365 Global administrator. In the navigation pane, click
Billing > Purchase Services.
2. Scroll down to the Add-on subscriptions section, and then hover over Microsoft Dynamics 365
(online) Additional Non-production Instance or Microsoft Dynamics 365 (online) Additional
Production Instance, and then click Buy now.
3. Proceed through the screens to purchase additional instances.
For more information, see Microsoft Dynamics 365 pricing and licensing.
TIP
Close your Dynamics 365 (online) browser session and open a new session to force an update to the Manage all Dynamics
365 (online) instances page.

Step 2: Configure the additional instance
1. Browse to the Office 365 admin center and sign in using Office 365 Global administrator credentials.
2. Click Admin centers > Dynamics 365.
3. Choose the Instances tab.
4. Select the instance that you want to configure, and then click Configure.

TIP
If the instance does not appear in the list or is in a state other than ready to configure, wait a few minutes and
then try again. Or, close your Dynamics 365 (online) browser session and open a new session to force an update to
the Manage all Dynamics 365 (online) instances page.
You cannot start a new Dynamics 365 (online) instance until you click Configure and complete the configuration
process.
Dynamics 365 (online) instances will not come prepared with sample data when configured by an Office 365 Global
administrator who does not have a Dynamics 365 (online) license. Sample data may be added later, after the instance
is configured and ready to use, by a Dynamics 365 (online) licensed user who has the Dynamics 365 System
administrator security role. For more information, see Add or remove sample data.

5. On the configure new instance page, enter your settings, and then click Next.
6. On the Confirm some details page, verify that the country/region and currency displayed are correct.
Although you can add currencies in the Dynamics 365 application, only the base currency will be used for
reporting.
WARNING
After a base currency is selected it cannot be changed.

After you have verified that the base currency is correct, click Finish.
7. Once your instance is set up, make note of the URL and click or tap it to launch Dynamics 365 (online).
Prepare the instance for users by assigning security roles, creating teams, customizing, and importing data.
More information: Getting Started.

What is the effect of an additional instance on storage?
When you add a new Dynamics 365 (online) instance, the new instance and any existing instances will consume
the existing storage that is available to the account. Warnings will be communicated when storage is near capacity.

Control user access to instances: security groups and licenses
If your company has multiple Dynamics 365 (online) instances, you can use security groups to control which
licensed users can be a member of a particular instance.
Consider the following example scenario:
INSTANCE

SECURITY GROUP

PURPOSE

Coho Winery Sales

Sales_SG

Provide access to the organization that
creates sales opportunities, handles
quotes, and closes deals.

Coho Winery Marketing

Marketing_SG

Provide access to the organization that
drives marketing efforts through
marketing campaigns and advertising.

Coho Winery Service

Marketing_SG

Provide access to the organization that
processes customer cases.

INSTANCE

SECURITY GROUP

PURPOSE

Coho Winery Dev

Developer_SG

Provide access to the Sandbox instance
used for development and testing.

In this example, four security groups provide controlled access to a specific organization.
Note the following about security groups:
When users are added to the security group, they are added to the Dynamics 365 instance.
When users are removed from the group, they are disabled in the Dynamics 365 instance.
When a security group is associated with an existing instance with users, all users in the instance that are
not members of the group will be disabled.
If a Dynamics 365 instance does not have an associated security group, all users with a Dynamics 365
license will be created as users and enabled in the instance.
If a security group is associated with an instance, only users with Dynamics 365 licenses that are members
of the instance security group will be created as users in the Dynamics 365 instance.
When you remove a security group that is associated with a Dynamics 365 (online) instance, either by
editing the instance and removing the security group or by deleting the security group, Dynamics 365
(online) licensed users who were members of the security group will have the same access to Dynamics
365 (online).
When you assign a security group to an instance, that instance will not show up in the Instances tab
(instance picker) in the Dynamics 365 admin center for users not in the group.
If you do not assign a security group to an instance, the instance will show up in the Instances tab
(instance picker) in the Dynamics 365 admin center even for those who have not been assigned a security
role in that Dynamics 365 instance.
You cannot make security groups members of other security groups.
NOTE
All licensed users, whether or not they are members of the security groups, must be assigned Dynamics 365 security roles to
access Dynamics 365 (online). You assign the Dynamics 365 security roles in the Dynamics 365 (online) web application.
Users can’t access instances of Dynamics 365 (online) until they are assigned at least one security role for that instance.
More information: Grant users access to Microsoft Dynamics 365 (online).

Create a security group and add members to the security group
1. Sign in to the Office 365 admin center.
2. Click Groups > Groups.
3. Click + Add a group.
4. Change the type to Security group, add the group Name and Description. Click Add > Close.
5. Click the group you created, and then next to Members, click Edit.
6. Click + Add members. Select the users to add to the security group, and then click Save > Close several
times to return to the Groups list.
7. To remove a user from the security group, select the security group, next to Members, click Edit. Click Remove members, and then click X for each member you want to remove.

NOTE
If the users you want to add to the security group are not created, create the users and assign to them the Dynamics 365
(online) licenses.
To add multiple users, see: bulk add users to Office365 groups.

Create a user and assign license
1. In the Office 365 Admin Center, click Users > Active users > + Add a user. Enter the user information,
select licenses, and then click Add.
More information: Add users individually to Office 365 - Admin Help
Associate a security group with a Dynamics 365 instance
1. In the Office 365 Admin Center, click Admin centers > Dynamics 365.
2. Click the Instances tab, select an instance, and then click Edit.
3. In security settings, search for a specific security group, and then click Next > Save.
TIP
To force an immediate synchronization between the Office 365 admin portal and Dynamics 365 (online), do the following:
Sign out of Dynamics 365 (online) and the Office 365 admin portal.
Close all open browsers used for Dynamics 365 (online) and the Office 365 admin portal.
Sign back in to Dynamics 365 (online) and the Office 365 admin portal.

See also
Edit properties of an instance
Manage Dynamics 365 (online) Sandbox instances
Grant users access to Microsoft Dynamics 365 (online)
Manage subscriptions, licenses, and user accounts

Switch an instance
8/24/2018 • 2 minutes to read • Edit Online

Applies to Dynamics 365 (online), version 9.x
Applies to Dynamics 365 (online), version 8.x
You may decide that your customization work developed and tested on a Sandbox instance is now ready to go
live. If you’ve placed your Sandbox instance in administration mode, only users with Dynamics 365 System
Administrator or System Customizer security roles are able to sign in to that instance. Once you switch the
instance type to Production, all your users can access your Dynamics 365 organization. When you configure or
edit an instance, you can switch the instance from:
Production to Sandbox
Sandbox to Production
Switching an instance does not change the number of your purchased licenses. Review the License
considerations section for how switching can impact license allocation.

Switch an instance
1. Browse to the Office 365 admin center and sign in using Office 365 Global administrator credentials.
2. Click Admin centers > Dynamics 365.
3. Choose the Instances tab.
4. Select the instance that you want, and then click Edit. If this is a new instance, click Configure.
5. Under Instance type, choose the instance type and then click Next.
6. Review the settings and then click Save.

License considerations
Review the following table to see how switching an instance type is impacted by your Dynamics 365 (online)
licenses.
SCENARIO

RESULT

NOTES

Switch a Production instance to
Sandbox. You have unused Sandbox
licenses.

A Sandbox license is used.

Sandbox instances have special features
such as Reset and Administration
modes. See Manage Dynamics 365
(online) Sandbox instances.

Switch a Production instance to
Sandbox. You do not have any unused
Sandbox licenses. You have unused
Production licenses.

A Production license is used.

Sandbox instances have special features
such as Reset and Administration
modes. See Manage Dynamics 365
(online) Sandbox instances.

Switch a Production instance to
Sandbox. You do not have any unused
Sandbox or Production licenses.

The Production instance is not
changed. You need to purchase a
Sandbox instance.

Sandbox instances have special features
such as Reset and Administration
modes. See Manage Dynamics 365
(online) Sandbox instances.

SCENARIO

RESULT

Switch a Sandbox instance to
Production. You have unused
Production licenses.

A Production license is used. A Sandbox
instance becomes available.

Switch a Sandbox instance to
Production. You do not have any
unused Production licenses.

You will need to purchase a Production
license.

See also
Manage Microsoft Dynamics 365 (online) instances
Manage Dynamics 365 (online) Sandbox instances
Add an instance to your subscription

NOTES

See Add an instance to your
subscription.

Copy an instance to a Sandbox instance
8/24/2018 • 6 minutes to read • Edit Online

Applies to Dynamics 365 (online), version 9.x
Applies to Dynamics 365 (online), version 8.x
You can use Copy instance in the Dynamics 365 admin center to copy the Dynamics 365 application and all data
from any instance to a Sandbox instance. You can do either a full or minimal copy.
TIP
Check out the following video on copying an instance to a Sandbox instance: Microsoft Dynamics CRM 2013 Spring '14
Online New Features -Copy.
This video also applies to CRM Online 2015 Update 1 and Dynamics CRM Online 2016 Update.

NOTE
To copy instances larger than 100 GB, please contact technical support.

Full copy instance
A full copy includes all application data, users, and customizations from the source instance and is suitable for:
User acceptance testing
Upgrade testing
Preview in production (TAP/EA)
Training
An example scenario
Isaac, a business application developer, has received a request from the sales department to configure and deploy
a social media integration solution from another company vendor. Isaac has never installed a solution from this
vendor and is unsure what impact this would have on the production application. He’d like to import the solution
into an environment that is nearly identical to, but isolated from, production to learn about the solution and make
the appropriate configuration changes. Isaac submits a request to Thomas, the IT Manager for Contoso, to create a
full copy Sandbox instance for him.
After the full copy is complete, Isaac receives a mail from Thomas telling him the Sandbox instance is ready. Isaac
logs into the Sandbox instance and makes the necessary changes to make sure that production external services
will not be impacted by the Sandbox instance. Once changes are complete, Isaac turns off administration mode
and enables background services. Isaac is able to use the full copy Sandbox instance to do his testing and later
manually import the solution into production.

Minimal copy instance
A Minimal copy only includes users, customizations, and schema from the source instance and is suitable for:
Iterative team development

Partner/ISV solutions
Proof of concept
An example scenario
Isaac has a large development project starting next week for the sales department. He has a team of developers
ready to start on the project, some of whom are internal to Contoso and some are external vendors. The Contoso
sales application contains Personally Identifiable Information (PII) that the sales manager has explicitly stated
must not be made available to any external parties for privacy and legal liability reasons. Isaac requests a minimal
copy Sandbox instance that does not contain any production data or users. In addition, Isaac creates an Office 365
security group to give the development team access to the Sandbox instance.
After modifying and enabling some of the plug-ins, the developer Sandbox instance functions the same and is
completely isolated from the production application. The development team works on their modifications in this
instance for several weeks. They package their changes into a solution and export/import to deploy to the full copy
Sandbox instance. After a successful round of testing and signoffs, the changes are manually deployed to
production.
Entities copied in a Minimal copy
The following entities are copied when you do a Minimal copy:
ENTITIES

BusinessUnit
ConnectionRole
Currency
DuplicateRule
DuplicateRuleCondition
EmailServerProfile
FieldPermission
FieldSecurityProfile
ImportMap
InternalAddress
Mailbox
Organization
Position
Report
Resource

ENTITIES

ResourceGroup
Role
RollupField
SavedQuery
SLAKPIInstance
Solution
Subject
Team
TeamTemplate
Template
SystemUser

To copy an instance
1. Browse to the Office 365 admin center and sign in using Office 365 Global administrator credentials.
NOTE
Global administrators can copy all available instances. Dynamics 365 System administrators can copy instances for
which they have the System administrator role.

2. Click Admin centers > Dynamics 365.
3. Choose the Instances tab.
4. Select an instance, and then click Copy.
5. On the copy instance page, select a target instance, a copy type, adjust the instance settings as needed,
and then click Copy.
A target instance can be a Sandbox or Preview instance; not a Production instance.
WARNING
The target instance will be deleted and replaced with a copy of the data and customizations from the source instance.
You won’t be able to recover any deleted data.

6. Click yes in the confirmation dialog box.
Once the copy process is complete, the target instance is placed in Administration mode and background
operations are disabled. The next section describes recommended Administrator actions for the newly created
copy (target) instance.

Next steps after copying an instance
To ensure the newly created copy (target) instance does not impact your production instance, once the copy
operation is complete, two things happen:
1. The newly created copy instance is placed in administration mode. Only those with Dynamics 365 System
Administrator or System Customizer security roles can sign in and manage the copy instance. Regular
Dynamics 365 users cannot sign in and use the copy instance.
2. Background operations are disabled in the copy instance. Disabled operations include workflows and
synchronization with Microsoft Exchange.
Review components
You should review the status of application components in the copy instance with external connections such as
Yammer, email, plug-ins, custom workflow activities, etc. Review these and consider what action to take:
1. Disable the component.
2. Redirect the component to another service instance such as one running Exchange or SharePoint.
3. Do nothing – leave the component as is in the copy instance. For example, you might decide to allow
Yammer posting to both the copy and production instances.
Here are some possible application components in the copy instance that could have external connections
and therefore could impact services with the same connections in your production instance.
Email. A mailbox cannot be synced with two different instances. For a full copy instance, the user mailboxes
in the copy instance must be disabled so the mailboxes do not attempt to send or receive email, or track
appointments, contacts, or tasks. Set synchronization for the following to None.
Incoming Email
Outgoing Email
Appointments, Contacts, Tasks
More information: Set the delivery method for incoming and outgoing email
SharePoint. Deactivate or redirect SharePoint to a sandbox SharePoint environment to prevent impacting
documents in Dynamics 365 managed by SharePoint. In Dynamics 365, go to Settings > Documentation
Management > SharePoint Sites. Select your site, and then click Deactivate.
Yammer. Disable Yammer or redirect to a separate Yammer service to prevent posts made in the copy
instance conflicting with posts made in the production instance. In Dynamics 365, go to Settings >
Administration > Yammer Configuration.
After creating a new Sandbox instance, workflows and system jobs might be pending execution. Apart from
these jobs, if you have connected Yammer to Dynamics 365 there will be Yammer activity streams posted
from Dynamics 365 to Yammer asynchronously. These activity streams are not visible through the system
jobs. If there were any pending Yammer activity streams before the Disable Background Process is turned
on, these activity steams will be posted to the current Yammer configuration once the Disable Background
Process is turned back off. In the Sandbox instance, if you have your current Yammer configuration
connected to the same Yammer network as your production environment, you might see duplicate activity
streams. To avoid duplicate Yammer activity streams, redirect your Sandbox instance to another Yammer
network (possibly a test network) before turning background processes back on.
Platform extensibility. Consider disabling the following that could be running in the copy instance and
impacting external service components.

Server-side plug-ins.
Workflow custom activity.
Client extensibility. Review the following.
Client-side JavaScript. Take a look at your JavaScript and HTML web resources for read/write
operations that could impact external services.
IFRAMES. Determine if the target of an IFRAME is a production instance.
See also
Introducing Sandbox Instances in CRM Online
Manage Dynamics 365 (online) Sandbox instances
Manage Microsoft Dynamics 365 (online) instances

Delete an instance
8/24/2018 • 2 minutes to read • Edit Online

Applies to Dynamics 365 (online), version 9.x
Applies to Dynamics 365 (online), version 8.x
You can delete Dynamics 365 (online) Sandbox instances to recover the licenses and storage space or to prevent
them from being used by mistake. In order to delete a production instance, you must first switch to a Sandbox
instance and then delete the Sandbox instance. You can delete a Support instance directly.

Delete an instance
1. Browse to the Office 365 admin center and sign in using Office 365 Global administrator credentials.
2. Click Admin centers > Dynamics 365.
3. Choose the Instances tab.
4. Select the instance that you want, and then click Delete.
WARNING
Your data will be lost! Be sure you’ve selected the correct instance.

5. Click Confirm to delete the instance.
Deleting an instance doesn’t change the number of your licenses purchased. For example, say you have two
instances - one Sandbox and one production - and you decide to delete your Sandbox instance. After the delete
has successfully completed, you’ll see one production instance and one instance to configure in the Instance tab
of the Manage your Dynamics 365 updates page.
See also
Manage Microsoft Dynamics 365 (online) instances
Switch an instance

Backup and restore instances
8/24/2018 • 3 minutes to read • Edit Online

Applies to Dynamics 365 (online), version 9.x
Applies to Dynamics 365 (online), version 8.x
Protecting your Dynamics 365 data and providing continuous availability of service is important for you and for us.
You have multiple options for backing up and restoring your Dynamics 365 (online) instances.

Daily system backups
Good news! Some backups take place without you having to do anything.
About Dynamics 365 (online) system backups:
All your instances are backed up.
System backups occur daily.
System backups are retained up to three days. Check your expiration date.

System backups do not count against your storage limits.
System backups are identified as created by System on the Manage backups page.

See your system backups
1. Browse to the Office 365 admin center and sign in using Office 365 Global administrator credentials. You
can also sign in with Dynamics 365 System Administrator or Delegated Admin security roles.
2. Click Admin centers > Dynamics 365.
3. Click the Backup & Restore tab.
4. Choose an instance from the Backups for drop-down list.
System-created backups appear under Created By as System.

On-demand backup: Dynamics 365 managed
Automated system backups are great, but you will want to be able to make your own backups before making some
significant customization change or applying a version update. You can do this with on-demand Dynamics 365
managed backups.
NOTE
A backup is created for you when we update your instance.

About Dynamics 365 managed on-demand backups:
You can back up Production and Sandbox instances.
You can only restore to a Sandbox instance. To restore to a Production instance, first switch it to a
Sandbox instance. See Switch an instance.
Only CRM Online 2016 Update 1 or later versions are supported for backup.
On-demand backups are retained for up to three days. Check your expiration date.

You are not limited in the number of on-demand backups you can make.
On-demand backups do not count against your storage limits.
On-demand backups are identified by having a label you created and by the presence of Edit | Delete |
Restore in the details section. System backups have only Restore.

Create an on-demand backup of a Dynamics 365 instance
1. Browse to the Office 365 admin center and sign in using Office 365 Global administrator credentials. You
can also sign in with Dynamics 365 System Administrator or Delegated Admin security roles.
2. Click Admin centers > Dynamics 365.
3. Click the Backup & Restore tab.
4. Choose an instance from the Backups for drop-down list.
5. Click New backup.

6. Type a label and any notes to help identify this backup for future restoration.
7. Click Create.

A notification will be displayed to confirm the backup is being created. The status column in the list provides
the status of the backup.
NOTE
The instance remains available while being backed up.

Edit a Dynamics 365 on-demand backup
Edit a backup to change its label and your notes about the backup.
1. Browse to the Office 365 admin center and sign in using Office 365 Global administrator credentials. You
can also sign in with Dynamics 365 System Administrator or Delegated Admin security roles.
2. Click Admin centers > Dynamics 365.
3. Click the Backup and Restore tab.
4. Choose an instance from the Backups for drop-down list.
5. Choose an on-demand backup from the list of backups.
6. Click Edit.

7. Change the information as needed, and then click Save.
Restore a Dynamics 365 on-demand backup
You can only restore to Sandbox instances. To restore to a Production instance, first switch it to a Sandbox instance,
restore to it, and then switch it back to a Production instance. See Switch an instance.
1. Browse to the Office 365 admin center and sign in using Office 365 Global administrator credentials. You

can also sign in with Dynamics 365 System Administrator or Delegated Admin security roles.
2. Click Admin centers > Dynamics 365.
3. Click the Backup and Restore tab.
4. Choose an instance from the Backups for drop-down list.
5. Choose an on demand backup from the list of backups.
6. Click Restore.

7. Click Select target to pick a target instance.
8. Click Next. Verify the details, and then click Restore.

A notification will be displayed confirming that the backup is being restored. It can take some time for the
restoration to complete.

NOTE
The instance remains unavailable while being restored.

Delete a Dynamics 365 on-demand backup
You can use the Dynamics 365 admin center to delete Dynamics 365-managed, on-demand backups. You can't
delete system backups.
1. Browse to the Office 365 admin center and sign in using Office 365 Global administrator credentials. You
can also sign in with Dynamics 365 System Administrator or Delegated Admin security roles.
2. Click Admin centers > Dynamics 365.
3. Click the Backup & Restore tab.
4. Choose an instance from the Backups for drop-down list.
5. Choose an on-demand backup from the list of backups.
6. Click Delete.

7. Click Confirm.
See also
Switch an instance

Manage Support instances
8/24/2018 • 2 minutes to read • Edit Online

A Support instance is any non-production instance of Dynamics 365 (online) used by Microsoft Support to
reproduce and resolve customer issues. When there is an issue affecting the operation of your online service,
Microsoft can create a Support instance in your tenant to troubleshoot and repair the issue. It is isolated from your
production instance so it does not impact your business operations. Dynamics 365 System admins have full
control of managing and providing organization data by copying it to a Support instance.
What is a Support instance?
It is an instance created in your tenant by Microsoft for purposes of preventing, detecting, or repairing
problems affecting the operation of your online service.
It does not require any additional non-production instance to be purchased.
The database size of a Support instance does not count towards your storage limit.
It resides in the same regional datacenter as your source instance.
What data is in a Support instance?
When a Support instance is initially created by Microsoft, it contains no customer data or customizations.
System admins manage Support instances in the Dynamics 365 admin center.
System admins can copy an instance to a Support instance, and then choose whether to provide a Minimal or a
Full copy of their instance.
System admins must consent to providing a copy of their data to Microsoft.
Who has access to a Support instance?
Minimal copy:
Microsoft staff who are members of a support security group
Full copy:
Microsoft staff who are members of an elevated support security group
What kind of data access does Microsoft have?
Online (via the application):
System admin privileges
Database (via SQL query tools):
Read/Write access to all tables
Access to the database requires additional approval by Microsoft and it is managed, controlled, and granted as
needed.
Access to the database is time limited (for example, 30 minutes) and expires automatically.
How long does a Support instance stay in your tenant?
1. 14 days or upon resolution of the problem.
2. System admins can delete the Support instance at any time.
Is access and usage of Support instance audited?

Yes.

Tenant to tenant migration
10/22/2018 • 3 minutes to read • Edit Online

Applies to Dynamics 365 (online), version 8.x

Move an instance to a different tenant
You can use the Tenant to Tenant Migration feature for Dynamics 365 (online) to request to have an instance in one
tenant moved to another tenant. To do so, contact technical support and submit a support request.
There are no user-interface changes or version changes as part of this move. You can move one or multiple
Dynamics 365 (online) instances. Once complete, your Dynamics 365 (online) instance(s) will appear in your new
tenant.
IMPORTANT
When moving individual Dynamics 365 (online) instances from one tenant to another, if that requires a geographical region
change, your tenant becomes a multiregional tenant. Regional features are enabled in the Dynamics 365 admin center.
You might need to reconfigure some applications and settings after tenant to tenant migration such as Microsoft Dynamics
365 for Outlook, server-side sync, SharePoint integration, etc.
Dynamics 365 (online) version 9.0 does not currently support tenant to tenant migration. Check back later for availability.

Impact of migrating between tenants
When your organization is moved from one tenant to another, the URL does not need to change, as the source
instance will be deleted after the move.
In order to perform this operation, you'll need to provide some information, such as:
What is the source tenant domain and its region? (example: EMEA, NA, APAC )
What is the destination tenant domain and its region? (example: EMEA, NA, APAC )
Does the destination tenant have a valid Dynamics 365 subscription?
Does the destination tenant have enough available user licenses?
Does the destination tenant have enough Dynamics 365 instance licenses?
Does the destination tenant have enough Dynamics 365 storage available for the instances being migrated?
If you do not have a Dynamics 365 subscription and/or trial in the destination tenant, then you will need to create
one. You might need to purchase a new Dynamics 365 subscription in the destination tenant (or convert a trial to
paid), if not already done.
You will need to create a temporary instance or instances in the destination tenant, depending on how many source
instances you are migrating. Source instance type and destination instance type must match (production vs nonproduction (Sandbox)). These instances should also be version 8.2.2 or below. The users to be migrated from one
tenant to another need to be created on the target tenant as well.
The destination tenant needs an equal or higher number of active user licenses, Dynamics 365 instance licenses for
the instances being migrated, and equal or greater storage as the source tenant.

How the move works

You’ll be provided with a list of prerequisites and post-requisites for your migration as part of the support request
raised. The following table describes what Microsoft does before, during, and after your move.

What Microsoft does

BEFORE THE MOVE
NOTIFICATION

DURING THE MOVE
CUT-OVER

AFTER THE MOVE
NOTIFICATION AND SUPPORT

Your support representative
or Account Manager will
work with you to request a
move and schedule it.

Cut-over for the migration
takes several hours,
depending on the number of
users and the amount of
data. During this period, the
organization is not
accessible, so the cut-over
should be scheduled during
the evening or over a
weekend.

You will be alerted by email
or telephone when your
instance is migrated to the
new tenant.

There is a step that will
require your involvement,
which is to provide a
Dynamics 365 User Mapping
File. This is requested in
advance so that we can
validate the users being
moved before the migration
takes place.

After the tenant migration is
complete, your support
representative or Account
Manager will assist you to
contact with billing to cancel
and/or credit your previous
subscription, if needed.

We will adhere to the terms of the Microsoft Online Services Service Level Agreement for all moves.

Common Data Service instances
8/24/2018 • 2 minutes to read • Edit Online

Applies to Dynamics 365 (online), version 9.x
Applies to Dynamics 365 (online), version 8.x
The Common Data Service allows you to securely store and manage data used in your PowerApps environments.
As of March 21, 2018, PowerApps environments provisioned with a Common Data Service database are displayed
as instances in the Dynamics 365 admin center. There you can view and do some management of your Common
Data Service instances.

Identify Common Data Service instances
1. In the Dynamics 365 admin center, select the Instances tab.
2. Select an instance and look for Common Data Service in the description details.

Manage Common Data Service instances
Currently, Common Data Service instances are available as trial and production types. What management actions
are available depends on which admin center you use.
Management in the Dynamics 365 admin center
You can manage the following with the Common Data Service instance in the Dynamics 365 admin center:
Open an instance
Edit an instance
Copy an instance
Delete an instance
Change notifications

Management in the PowerApps admin center
You can manage the following with the Common Data Service instance in the PowerApps admin center:
Add or remove a user or group from either the Environment Admin or Environment Maker role. For more
information, see Environment Administration.
Provision a Common Data Service database for the environment. For more information, see Create a
Common Data Service database.
Set Data Loss Prevention policies. For more information, see Data loss prevention policies.
Set database security policies (as open or restricted by database roles). For more information, see
Configure database security.
Members of the Azure AD tenant Global administrator role (includes Office 365 Global admins) can also
manage all environments that have been created in their tenant and set tenant-wide policies from the
PowerApps admin center.

More information
Administer PowerApps overview
Introduction to the admin center for PowerApps

Edit properties of an instance
8/24/2018 • 3 minutes to read • Edit Online

Applies to Dynamics 365 (online), version 9.x
Applies to Dynamics 365 (online), version 8.x
Administrators can edit properties of a Dynamics 365 (online) instance, such as the friendly name, URL, and the
purpose. However, instances that are being provisioned cannot be edited, and disabled instances must be enabled
before they can be edited.

Edit an instance
1. Browse to the Office 365 admin center and sign in using Office 365 Global administrator credentials.
2. Click Admin centers > Dynamics 365.
3. Choose the Instances tab.
4. Select the instance that you want, and then click Edit.
5. Select any of the following field values that you want to change.
Name. This is typically the name of your organization and is displayed in the Dynamics 365
application. After you save the change, it may take up to 5 minutes for the friendly name to appear in
the application.
URL. The URL is used to construct the URL for users to sign in to Dynamics 365. We recommend
that you limit the length of the URL name to reduce the overall length of the URL.
WARNING
There are important tasks that you must communicate to your Dynamics 365 (online) users immediately
following a URL name change.
For users of the web application, send information that includes the new URL with instructions about
how to bookmark it.
For users of Dynamics 365 for Outlook Online, the following two tasks must be completed in the
order specified here:
a. Synchronize offline data. Dynamics 365 for Outlook users connected to this instance who work
offline must synchronize by using the previous URL. If you run the Configuration Wizard and
change the URL before completing this step, offline data may be lost.
b. Run the Configuration Wizard. After a URL name change is saved and any offline data is
synchronized, users of Dynamics 365 for Outlook must run the Configuration Wizard to update
the URL.

After a URL name change is saved, all users who access that instance must be notified of the change.
Users will be able to access the instance for up to 24 hours by using the previous URL. After the 24hour period has passed, the previous URL will not work.
Notice that interim URL names are discarded when there are multiple changes within 24 hours. For
example, consider the following situation:
The original URL of your instance is fourthcoffeesales.crm.dynamics.com.

Using the instance picker, you change the URL name from
fourthcoffeesales.crm.dynamics.com to fourthcoffeemktg.crm.dynamics.com.
Within 24 hours of the URL name change, you change the URL name again, this time from
fourthcoffeemktg.crm.dynamics.com to fourthcoffeesalesandmktg.crm.dynamics.com.
In this situation, the first URL name change to fourthcoffeemktg.crm.dynamics.com will be
immediately removed from the system. The new URL,
fourthcoffeesalesandmktg.crm.dynamics.com, will become active. Additionally, the original
URL, fourthcoffeesales.crm.dynamics.com, will be active for up to 24 hours.
Purpose. This value is used to associate the instance with a specific intent and is only displayed in
the Manage all Dynamics 365 (online) instances page, which is accessed through the Dynamics
365 admin center. For example, if this instance is for exclusive use by your sales and marketing
departments, you can enter Contoso Sales and Marketing or, if the instance is for development and
testing, enter a relevant name such as Contoso Development.
Security Group. This value is used to determine the security group that includes the users who will
have access to this instance of Dynamics 365 (online). Learn more: Control user access to instances:
security groups and licenses
IMPORTANT
If you do not specify a security group, all users who have a Dynamics 365 (online) license will be added to
this instance.

6. Click Save.
See also
Add an instance to your subscription
Switch an instance
Manage Dynamics 365 (online) Sandbox instances
Manage subscriptions, licenses, and user accounts
Manage storage for Microsoft Dynamics 365 (online) User session and access management

About multiple online instances or tenants
8/24/2018 • 10 minutes to read • Edit Online

Applies to Dynamics 365 (online), version 9.x
Applies to Dynamics 365 (online), version 8.x
Dynamics 365 (online) gives you options for segregating your Dynamics 365 data and user access. For most
companies, adding and using multiple instances in your subscription provides the right mix of functionality and
ease of management. Enterprises with separate geographic locations might consider using multiple tenants to
separate Dynamics 365 (online) licenses. Multiple instances can share users among instances; multiple tenants
cannot.
NOTE
The concept and operation of tenants and instances, though similar, differs between online and on-premises deployments of
Dynamics 365. This topic is for those administering Dynamics 365 (online) deployments.

Terminology
TERM

DEFINITION

Tenant

For Dynamics 365 (online), a tenant is the account you create
in the Microsoft Online Services environment when you sign
up for a Dynamics 365 (online) subscription. A tenant contains
uniquely identified domains, users, security groups, and
subscriptions and can contain multiple Dynamics 365 (online)
instances.
The tenant created for you has a domain name of
.onmicrosoft.com. For example,
contoso.onmicrosoft.com.

Instance

Multiregional instance

TERM

DEFINITION

Subscription

A subscription consists of the Dynamics 365 licenses and addons included with the trial or paid service you signed up for in
your Dynamics 365 (online) account. Dynamics 365
subscriptions can vary in license type, price, and end date.
For example, a subscription might be 100 licenses of Dynamics
365 (online) Professional and 10 licenses of Dynamics 365
(online) Enterprise.

Identity

User account

A user account assigned by an organization (work, school,
non-profit) to one of their constituents (an employee, student,
customer) that provides sign-in access to one or more of the
organization’s Microsoft cloud service subscriptions, such as
Exchange Online or Dynamics 365 (online). Access to an online
service is controlled by the license assigned to the user
account.
User accounts are stored in an organization’s cloud directory
within Azure Active Directory, and are typically deleted when
the user leaves the organization. Organizational accounts
differ from Microsoft accounts in that they are created and
managed by admins in the organization, not by the user.

Security group

If your company has multiple Dynamics 365 (online) instances,
you can use instance security groups to control which licensed
users can access a particular instance. More information:
Control user access to instances: security groups and licenses

Uses for multiple instances
Dynamics 365 (online) instances are similar in concept to a high-rise business complex with floors organized
according to business functions. Consider each floor within the building as an application
(Sales/Service/Marketing, Vendor management, Wealth management) and consider each unit within a floor as an
instance for a specific purpose such as Production, Training, Testing, and Development.

Multiple instances are needed when segregation is required of plugins, workflows, or admin resources that cannot

be easily isolated by using business units in Dynamics 365.

A multi-instance deployment
A typical Dynamics 365 (online) deployment includes one tenant only. A tenant can include one or more Dynamics
365 (online) instances; however, a Dynamics 365 (online) instance is always associated with a single tenant.

This example uses two instances for three teams: Sales, Marketing, and Services.
Sales and Marketing share an instance so lead information can be easily accessed by both. Services has its own
instance so tickets and warranties can be managed separately from campaigns and other sales related events.
You can provide access to one or both instances easily. Sales and Marketing users could be limited to their instance
while Service users with extended access could update support escalations records related to accounts in both
instances.
About single tenant with multiple instances:
A tenant can include up to 50 Dynamics 365 (online) production instances and up to 75 non-production
(Sandbox) instances.
Each instance within the tenant receives its own SQL database.
Dynamics 365 data is not shared across instances.
Storage is shared across the primary instance and any additional instances.
All instances for a single customer tenant will be set up in the geography where they initially signed up for
their account. Storage consumption is totaled and tracked across all the instances attached to a customer
tenant.
You can set up separate security groups for all instances.
A licensed Dynamics 365 (online) user can potentially access all the Dynamics 365 (online) instances
associated with the tenant. Access is controlled by instance security group membership.
You can purchase additional instances through the Additional Instance Add-On. Additional instances can be
added only to "paid" subscriptions - not trials or Internal Use Rights (IUR ). If you purchased your Dynamics
365 (online) subscription through Volume Licensing, you must go through your Large Account Reseller
(LAR ) to purchase the additional instance. More information: Billing and subscription support
You can’t merge existing trials or subscriptions onto an additional instance; instead, you will need to move
your data and customizations.

Why use multiple instances?
The following are common use cases for multi-instance deployment. Consider these examples when you decide
the deployment type that best fits your company’s requirements.
Master data management
In this scenario, a “master” data set provides for change management through a central master data source. This
approach requires that the central master data be synchronized to all instances so that each instance has access to
the latest version of the core information. Requested changes to the information can be made directly within the
master system. Alternatively, users can explicitly access the master system or capture the changes in the local
instance, with those changes subsequently passed on to the master instance.
Requiring that changes be made centrally can provide for centralized change control. For example, anti-fraud
checks can be performed to ensure that changes are made only by a central team and not by local teams that
might otherwise benefit from a change, such as a change in credit limits. This would provide a second level of
change authorization and verification that avoids the ability for a single person or a group of people who work
closely together to collaborate to affect a fraud. Pushing a request to a different, independent team can provide
protection against potential fraud.
Security and privacy
Differences in regional, for example European Union (EU ), or national legislation can result in variations in
requirements for securing data or maintaining data privacy across the different regions or countries in a
deployment. In some cases, legislative/regulatory restrictions make it illegal to host data outside the borders of a
country or region, and addressing this challenge is particularly critical in specific business sectors.
For example, consider healthcare sector restrictions on sharing patient information. Some EU regulations require
that any health information that is collected about people residing in the EU be maintained and shared only within
EU boundaries, while similar data collected about people in the United States (US ) is kept within US boundaries.
Also consider banking sector restrictions on sharing customer information. In Switzerland, for example, regulations
make it illegal to share customer information outside of their national boundaries.
Scalability
While a single instance of Dynamics 365 can scale up and out to support the growth of a customer’s business, with
very high data volumes or levels of complexity, there are additional considerations. For example, in environments
with extreme volumes and/or extensive use of Service Scheduling, scaling up SQL Server can require complicated
and expensive infrastructure that is prohibitively expensive or extremely difficult to manage.
There are many scenarios in which there is a natural functional split in capability requirements. In such cases,
delegating workloads by creating scale-out scenarios that are based on these functional splits can provide for
higher volumes by using commodity infrastructure.

Add an instance to your subscription
For information about how to add an instance to your Dynamics 365 (online) subscription, see Add an instance to
your subscription.

A multi-tenant deployment
Global businesses with regional or country models that differ can use tenants to account for variations in
approach, market size, or compliance with legal and regulatory constraints.

This example includes a second tenant for Contoso Japan.
User accounts, identities, security groups, subscriptions, licenses, and storage cannot be shared among tenants. All
tenants can have multiple instances associated with each specific tenant. Dynamics 365 data is not shared across
instances or tenants.
About multiple tenants:
In a multi-tenant scenario, a licensed Dynamics 365 (online) user associated with a tenant can only access
one or more Dynamics 365 (online) instances mapped to the same tenant. To access another tenant a user
would need a separate license and a unique set of sign-in credentials for that tenant.
For example, if User A has an account to access Tenant A their license allows them to access any and all
instances created within Tenant A - if they are allowed by their administrator. If User A needs to access
instances within Tenant B, they will need an additional Dynamics 365 (online) license.
Each tenant will require a tenant administrator(s) with unique sign-in credentials, and each tenant affiliate
will manage its tenant separately in the administrator console.
Multiple instances within a tenant are visible from the Dynamics 365 (online) interface if the administrator
has access.
You cannot reassign licenses between tenant enrollments. An enrolled affiliate can use license reduction
under one enrollment and add licenses to another enrollment to facilitate this.
On-premises Active Directory federation cannot be established with more than one tenant unless you have
top-level domains that you need to federate with different tenants (for example Contoso.com and
Fabricam.com).

Why use multiple tenants?
Functional localization
This scenario typically arises in organizations with overlapping but separate functional needs. Some common
examples include:
Organizations with different business divisions, each with a different market or model of operation.
Global businesses with regional or country models that differ to account for variations in approach, market
size, or compliance with legal and regulatory constraints.
In these types of business environments, an organization often will have common sets of functionality that
allow specific regions, countries, or business areas with a degree of localization regarding:
Information capture. For example, capturing the ZIP Code in the United States would correlate to capturing

the Post Code in the United Kingdom.
Forms, workflows.
Physical distribution
For business solutions that must support users that are physically distributed over large distances, particularly for
global deployments, using a single instance may not be suitable because of the implications (such as WAN latency)
associated with the infrastructure over which the users connect, which can significantly impact the user experience.
Distributing instances to provide users with more local access can reduce or overcome WAN -related issues, as the
access occurs over shorter network connections.

Add a multi-tenant deployment under volume licensing
For a multi-tenant deployment, you'll need a Multi-Tenant Amendment. A Multi-Tenant Amendment is an actual
amendment to the Volume License agreement used to purchase licenses. Contact your Microsoft Sales
Representative or Reseller to obtain the amendment.

Constraints of multi-tenants
Admins who want to deploy and manage multiple tenants should be aware of the following:
User accounts, identities, security groups, subscriptions, licenses, and storage cannot be shared among
tenants.
A single domain can only be federated with one tenant.
Each tenant must have its own namespace; UPN or SMTP namespaces cannot be shared across tenants.
If an on-premises Exchange organization exists, you cannot split this organization across multiple tenants.
A consolidated Global Address List will not be available, except if explicitly managed downstream from the
synchronization.
Cross-tenant collaboration will be limited to Lync Federation and Exchange Federation features.
SharePoint access across tenants may not be possible. While this may be solved with Partner Access, the
user experience is disrupted and licensing aspects apply.
There can be no duplicate accounts across the tenants or partitions in the on-premises Active Directory.
See also
Manage Microsoft Dynamics 365 (online) instances
Using multi-tenancy in Microsoft Dynamics CRM 2013 to address challenges in enterprise business environments
(primarily on-premises)
Blog: Dynamics CRM and multi-tenancy (on-premises)

Add and edit multiregional instances
8/24/2018 • 5 minutes to read • Edit Online

Applies to Dynamics 365 (online), version 9.x
Applies to Dynamics 365 (online), version 8.x
For multinational companies with employees and customers distributed around the world, you can create and
manage Dynamics 365 (online) instances specific to your global regions. You can create an instance in a different
region than where your Dynamics 365 (online) tenant resides. Local instances can provide quicker data access for
users in that region. Be sure to read A multi-instance deployment to understand the features of multiple instances.
Purchase the Dynamics 365 (online) instance on the Purchase subscriptions page. You must have an active
Dynamics 365 (online) account to complete the purchase. Additional storage and instances can be purchased by
customers who have a paid Dynamics 365 (online) Professional or Dynamics 365 (online) Enterprise subscription.
You must have an Office 365 Global administrator or Dynamics 365 (online) System administrator role to do
these tasks. For more information, see Assigning admin roles.
NOTE
To request the ability to create Dynamics 365 (online) instances (production and non-production) in more than one
geographical region, please contact your account manager or Technical Support.

What information do I need to create an instance?
During the initial configuration an instance, you can accept the default values, or enter different values to create a
Dynamics 365 (online) instance.
Region. Choose from the following: Asia Pacific (APAC ); Canada (CAN ); Europe, Middle-East, Africa
(EMEA); India (IND ); Japan (JPN ); North America (NA); Oceania (OCE ); South America (LATAM/SAM ).
TIP
To view the current data centers for your region, see Where is my data?

Name. This is typically the name of your organization and is displayed in the Dynamics 365 (online)
application.
URL. The URL name is used to construct the URL for users to sign-in to the Dynamics 365 application.
Therefore, we recommend that you limit the length of URL name to reduce the overall length of the URL.
Purpose. This value is used to associate the instance with a specific intent and is only displayed in the
instance picker. For example, if this instance is for exclusive use by your sales and marketing departments
you can enter Contoso Sales and Marketing or if the instance is for development and for testing purposes
enter a relevant name such as Contoso Development.
Instance Security Group. This value is used to determine the Microsoft Online Services security group
that includes the users who will have access to this instance of Dynamics 365 (online). For more
information, see Control user access to instances: security groups and licenses.

IMPORTANT
If you do not specify a security group, all users associated with the subscription who have a Dynamics 365 (online)
license will be added to the new instance.

Organizational language. This language will be used for the Dynamics 365 (online) application.
Base currency. When you add an instance, you must select a base currency before the instance is
provisioned. Although you can add currencies in the Dynamics 365 application, only the base currency will
be used for reporting.
WARNING
Once set, the base currency cannot be changed.

Create a regional instance
The following steps apply to customers who do not purchase using volume licensing. Volume license customers
should see: Microsoft Volume Licensing Service Center.
Step 1: Purchase the additional instance
1. Global administrators sign in to the Office 365 admin center, and then, in the navigation pane, click Billing
> Purchase services.
2. Scroll down to the Add-on subscriptions section, and then hover over Microsoft Dynamics 365
(online) Additional Non-production Instance or Microsoft Dynamics 365 (online) Additional
Production Instance, and then click Buy now.
3. Proceed through the screens to purchase additional instances.
You can choose to add production or non-production (Sandbox) instances. For more information, see
Microsoft Dynamics 365 pricing and licensing.
Step 2: Configure the additional instance for a region
1. Browse to the Office 365 admin center and sign in using Office 365 Global administrator credentials.
2. Click Admin centers > Dynamics 365.
3. Choose the Instances tab.
4. Select the instance that you want to configure, and then click Configure.
IMPORTANT
If the instance does not appear in the list or is in a state other than ready to configure, wait a few minutes and
then try again.
You cannot start a new Dynamics 365 (online) instance until you click Configure and complete the configuration
process.
Dynamics 365 (online) instances will not come prepared with sample data when configured by a Global administrator
who does not have a Dynamics 365 (online) license. Sample data may be added later, after the instance is configured
and ready to use, by a Dynamics 365 (online) licensed user who has the Dynamics 365 system administrator security
role. For more information, see Add or remove sample data.

5. On the configure new instance page, select a region for the instance.

6. Enter the rest of your settings, including choosing a currency, and then click Next.
IMPORTANT
After a base currency is selected it cannot be changed.
Although you can add currencies in the Dynamics 365 application, only the base currency will be used for reporting.
To select a different currency, click Change currency and select a different one or specify a custom currency.

7. On the confirmation page, verify that the settings are correct and then click Configure.
8. On the Your Microsoft Dynamics 365 organization is ready page, click Launch Dynamics 365
(online) to start Dynamics 365 (online) to prepare the instance for users such as assign security roles,
create teams, customize, and import data. More information: Getting started.
TIP
Note the Dynamics 365 (online) instance URL that is displayed on the page. You can use this URL to directly access
the Dynamics 365 (online) instance.

Configure and manage a regional instance
To configure and manage a regional instance, you must first select your active region to be the same as the
regional instance.
Select a regional instance to configure and manage
1. Browse to the Office 365 admin center and sign in using Office 365 Global administrator credentials.
2. Click Admin centers > Dynamics 365.
3. Choose the Instances tab.
4. From the drop-down list, select the region of the regional instance to configure. For example, to edit an
instance in Japan, select the APAC region.
NOTE
If you don’t see the Your current region is: drop-down list, you don’t have any instances outside of your current
region.

5. Select the instance that you want to configure, and then click Configure.
The Edit, Copy, and Reset buttons appear when you’ve selected a regional instance matching your active
region.
NOTE
Copied instances are copied to the same region as the source instance.
Instances that are reset are reset to the current region.

See also
Edit properties of an instance
Manage Dynamics 365 (online) Sandbox instances
Manage Microsoft Dynamics 365 (online) instances

Differences between the Microsoft Online services environment administrative roles and Dynamics 365 (online)
security roles
Grant users access to Microsoft Dynamics 365 (online) as a Microsoft Online service
Manage subscriptions, licenses, and user accounts

Migrate Microsoft Dynamics 365 (online) to Microsoft
Dynamics 365 (on-premises)
8/24/2018 • 9 minutes to read • Edit Online

Applies to Dynamics 365 (online), version 8.x
This document describes the steps needed to migrate from an instance of Dynamics 365 (online) to a Microsoft
Dynamics 365 on-premises deployment. To complete the migration, follow the steps provided here in the order
presented..
IMPORTANT
This document assumes that you already have a deployment of Microsoft Dynamics 365 on-premises. For information about
how to deploy Microsoft Dynamics 365, see Microsoft Dynamics CRM Server installation.
To migrate from Dynamics CRM Online 2016 Update to Dynamics 365 (on-premises), you must have Dynamics CRM 2015
or a later version.

Feature and customization changes when you migrate from Microsoft
Dynamics CRM Online 2016 Update to Microsoft Dynamics CRM 2016
on-premises
Before you migrate from Dynamics CRM Online 2016 Update to Microsoft Dynamics 365 on-premises, be aware
of the following behaviors or issues. These characteristics will appear after you import a Dynamics CRM Online
2016 Update organization into a Microsoft Dynamics 365 on-premises deployment.
Managed solutions
All managed solutions that have a dependency on a feature introduced in Dynamics CRM Online 2016 Update will
be removed from the organization that is prepared for migration. For example, this applies if the solution includes
one or more of the following features:
A rollup field that uses the AVG operator or aggregates data across all activities related to a record.
A calculated field that computes the difference between two dates by using DIFFINDAYS, DIFFINHOURS,
DIFFINMINUTES, DIFFINMONTHS, DIFFINWEEKS, or DIFFINYEARS.
Additionally, you can’t export record creation or update rules from Dynamics CRM Online 2016 Update to
Microsoft Dynamics 365 on-premises. More information: Set up rules to automatically create or update records in
Dynamics 365 (Customer Service)
Unmanaged solutions
Any field in an unmanaged solution that includes a feature introduced in Dynamics CRM Online 2016 Update will
be removed from the organization. For example, this applies if the field includes one of the following features:
A rollup field that uses the AVG operator or aggregates data across all activities related to a record.
A calculated field that computes the difference between two dates by using DIFFINDAYS, DIFFINHOURS,
DIFFINMINUTES, DIFFINMONTHS, DIFFINWEEKS, or DIFFINYEARS.
Additionally, these behaviors appear:

You can’t export record creation or update rules from Dynamics CRM Online 2016 Update to Microsoft
Dynamics 365 on-premises. More information: Set up rules to automatically create or update records in
Dynamics 365 (Customer Service)
Records with date and time fields having values earlier than January 1, 1900 are considered invalid and will
return an error message, such as “Invalid Date/Time The date/time format is not valid, or the value is
outside the supported range.” When this issue occurs you can’t open forms, view lists, or process workflows
from an entity record that has a date and time value that’s before January 1, 1900.

Copy your Dynamics 365 (online) organization encryption key
During the import of the Dynamics 365 (online) database into your Dynamics 365 (on-premises) deployment, you
must provide the organization database encryption key used for your instance of Dynamics 365 (online).
1. Sign in to the instance of Dynamics 365 (online) that you want to migrate as a user with the system
administrator security role.
2. Go to Settings > Data Management.
3. Choose Data Encryption.
4. In the Data Encryption dialog box, select Show Encryption Key, in the Current encryption key box select
the encryption key, and copy it to the clipboard.
5. Paste the encryption key in to a text editor, such as Notepad.
WARNING
By default, Dynamics 365 generates a passphrase that is a random collection of Unicode characters. Therefore, you
must save the system-generated passphrase by using an application and file that supports Unicode characters. Some
text editors, such as Notepad use ANSI coding by default. Before you save the passphrase using Notepad, select Save
As, and then in the Encoding list, select Unicode.

6. As a best practice, save the file that contains the encryption key on a computer in a secure location on an
encrypted hard drive.

Request a backup of your organization database
To request a backup of your Dynamics 365 (online) database contact Microsoft Customer Support Services for
Dynamics 365 (online). For contact information, see Contact Technical Support.
IMPORTANT
Obtaining a backup of your Dynamics 365 (online) database isn’t available with Dynamics 365 (online), version 9.x.

Restore the Microsoft Dynamics 365 (online) database
The backup of your Dynamics 365 (online) database must be restored by using a server running the same or a
later version of SQL Server as the database you receive. You will be able to request the version you need before
you receive the database.
Restore the copy of the Dynamics 365 (online) database to a computer running SQL Server in the target Dynamics
365 (on-premises) deployment. To do this, follow the steps here.

IMPORTANT
Your Dynamics 365 (online) database may be encrypted with a certificate. For more information, see “Cannot find server
certificate with thumbprint” error message when you try to restore a Dynamics 365 organization database later in this topic.

Restore a Microsoft Dynamics 365 (online) organization database to SQL Server

1. Open SQL Server Management Studio, and then connect to the appropriate instance of SQL Server.
2. In Object Explorer, right-click Databases, and then click Restore Database.
3. Type the name of a new database in the To database open text box. The database name must include
_MSCRM in the name. For example the database name is Contoso_MSCRM.
4. On the General page, in the Source section, click Device.
5. Click the browse button in the Device option. This opens the Select backup devices window.
6. In the Select backup devices window, click Add to open the Locate Backup File window.
7. Select the file you want to use for the restore operation, and then click OK.
8. Click OK to close the Select backup device window.
9. Mark the checkbox in the Restore column next to the backup set option.
10. Click OK to begin the restore process.

Apply the latest updates to the Dynamics 365 on-premises deployment
You must apply the latest Dynamics 365 (on-premises) updates before you import the Dynamics 365 (online)
database. More information: Microsoft Dynamics CRM 2016 Updates and Hotfixes

Import the Dynamics 365 (online) database into the Dynamics 365 onpremises deployment
How long it takes to complete the import of the organization database depends on several factors. These factors
include the size of the database you are importing, the number of users, and the hardware you use to complete the
import.
NOTE
The procedure described here uses Dynamics 365 Deployment Manager. Deployment Manager is an MMC snap-in that is
included with Dynamics 365 Server. Alternatively, your can run Windows PowerShell commands to complete the import.
More information: Import-CrmOrganization
To import an organization, you must have the Deployment Administrator Microsoft Dynamics 365 role.

Import an organization database using Deployment Manager

1. On the Microsoft Windows Server running the Microsoft Dynamics 365 Server Deployment Tools server
role, start Deployment Manager (DMSnapin.msc).
2. Start the Import Organization Wizard. Right-click Organizations, and then click Import Organization.

NOTE
You will receive a message if you attempt to import into a Dynamics 365 (on-premises) version that allows only one
organization per deployment. The message notifies you that proceeding will deactivate, but not delete, the existing
organization.

3. Select the SQL Server and database. In the Select SQL Server window, select the SQL Server where the
organization database is restored in the SQL Server list, and then select the organization database in the
Organization database list. Click Next.
4. Specify the organization name. Enter the display name and name for the organization in the Specify the
Organization Settings window. The Display name will appear in Dynamics 365 applications. The Unique
Database name will be used as the database name in SQL Server and will also be used to construct the
URL for client applications. Notice that the values you enter don’t need to match the names that you used
with Dynamics 365 (online). Click Next.
5. Specify the SQL Server Reporting Services server. In the Specify Reporting Services Server window, type
the Reporting Services server URL for the organization in the Report Server URL field. Click Next.
6. Select the method for mapping users. Map users from the Dynamics 365 (online) deployment to the
Dynamics 365 (on-premises) deployment. Users must already exist in Active Directory for the Dynamics
365 (on-premises) deployment. The Import Organization Wizard does not create the users automatically. To
complete the mappings, the user running the import operation must be mapped to a user in Dynamics 365.
For more information about how to map users, see Import an organization.
7. In the System Checks window you receive the results of several environment diagnostic checks. If you
receive a red alert, the issue must be resolved prior to completing the wizard. If you receive a yellow
warning, you may proceed with the import. Click Next.
Due to versioning differences between Dynamics 365 (online) and Dynamics 365 (on-premises), you may
receive a warning. This warning is expected and in most cases shouldn’t prevent the import from
completing. After you successfully complete the steps in this document, the versioning will be correct.
8. Begin the import. In the Ready to Import window, verify that the information is correct, and then click
Import.
9. Complete the import. After the import is complete, the Import Organization window appears. Click View
the log file to view the log file that is created during the import. If the import is successful, click Finish.
The import log is stored in the C:\Documents and Settings\\Application Data\Microsoft\MSCRM\Logs
folder.
10. Activate encryption
a. As a user with System Administrator security role privileges, sign-in to the organization that was just
imported, then go to Settings > Data Management.
b. Choose Data Encryption.
c. In the Activate Encryption Key box enter the encryption key that you copied earlier, and then select
Activate.
d. Select OK in the confirmation message and then choose Close to exit the Data Encryption page.
e. We recommend that you copy the key to a safe place.

“Cannot find server certificate with thumbprint” error message when

you try to restore a Dynamics 365 organization database
When you try to restore a Dynamics 365 organization database, you may receive the following error message.
An exception occurred while executing a Transact-SQL statement or batch. (Microsoft.SqlServer.ConnectionInfo)
Additional Information: Cannot find server certificate with thumbprint.
This error message occurs because the database that is to be restored is using Transparent Data Encryption (TDE ).
A certificate must be present to restore the database.
To resolve this issue, follow these steps.
1. Obtain the certificate. Dynamics 365 (online) customers receive the certificate as part of the power of choice
backup of your database. Additional instructions may also be included.
2. Execute the following SQL statements in the order specified to import the certificate where:
CustomerGeneratedStrongPassword is the password you want to use to create the master key.
DomainName, GUID, .cer, .pvk, and Certificate secured password provided are values that are
included in the information sent to you from Microsoft for importing the TDE certificate.
use master
GO
/* Check if DMK (##MS_DatabaseMasterKey##) exists. */
select * from sys.symmetric_keys
GO
/* If key does not exist, create database master key */
CREATE MASTER KEY ENCRYPTION BY PASSWORD = ''
GO
/* Verify that the database master key is created */
select * from sys.symmetric_keys
GO
/* Import the certificate provided for TDE Database backup. TDE certificate name will also be provided
in email */
CREATE CERTIFICATE LTOP__ FROM FILE = 'D:\<>_1.cer' WITH PRIVATE KEY (FILE = 'D:\
<>_1.pvk', DECRYPTION BY PASSWORD = '')

3. Restore the organization database. To do this, see Restore the Microsoft Dynamics 365 (online) database.
IMPORTANT
We strongly recommend that you store your TDE certificate in a secure location. If the certificate is lost and the database is
encrypted, you will lose your data. For more information about TDE encryption, see Move a TDE Protected Database to
Another SQL Server.

Manage the encryption keys
8/24/2018 • 8 minutes to read • Edit Online

Applies to Dynamics 365 (online), version 8.x
All instances of Dynamics 365 (online) use SQL Server Transparent Data Encryption (TDE ) to perform real-time
encryption of data when written to disk, also known as encryption at rest.
By default, Microsoft stores and manages the database encryption keys for your instances of Dynamics 365
(online) so you don’t have to. The manage keys feature in the Dynamics 365 admin center gives administrators the
ability to self-manage the database encryption keys that are associated with instances of Dynamics 365 (online).
IMPORTANT
Self-managed database encryption keys are only available in the December 2016 Update for Dynamics 365 (online) and may
not be made available for later versions.

Introduction to key management
With Dynamics 365 (online) key management, administrators can provide their own encryption key or have an
encryption key generated for them, which is used to protect the database for an instance.
The key management feature supports both PFX and BYOK encryption key files, such as those stored in a
hardware security module (HSM ). To use the upload encryption key option you need both the public and private
encryption key.
The key management feature takes the complexity out of encryption key management by using Azure Key Vault to
securely store encryption keys. Azure Key Vault helps safeguard cryptographic keys and secrets used by cloud
applications and services. The key management feature doesn’t require that you have an Azure Key Vault
subscription and for most situations there is no need to access encryption keys used for Dynamics 365 (online)
within the vault.
The manage keys feature lets you perform the following tasks.
Enable the ability to self-manage database encryption keys that are associated with Dynamics 365 (online)
instances.
Generate new encryption keys or upload existing .PFX or .BYOK encryption key files.
Lock a Dynamics 365 (online) instance.
Cau t i on

You should never lock an instance as part of your normal business process. While a Dynamics 365 (online)
instance is locked it takes the instance completely offline and it cannot be accessed by anyone, including
Microsoft. Additionally, services such as synchronization and maintenance are all stopped. An appropriate
reason why you would lock an instance is when you move your database from online to on-premises.
Locking the instance can make sure that your online data is never accessed again by anyone.
A locked instance can’t be restored from backup.
Unlock a Dynamics 365 (online) instance. To unlock a locked instance of Dynamics 365 (online), you must
upload the encryption key that was used to lock it. While a Dynamics 365 (online) instance is locked, it
cannot be accessed by anyone.

Understand the potential risk when you manage your keys
As with any business critical application, personnel within your organization who have administrative-level access
must be trusted. Before you use the key management feature, you should understand the risk when you manage
your database encryption keys. It is conceivable that a malicious administrator (a person who is granted or has
gained administrator-level access with intent to harm an organization's security or business processes) working
within your organization might use the manage keys feature to create a key and use it to lock a Dynamics 365
(online) instance. Consider the following sequence of events.
1. The malicious administrator signs in to the Dynamics 365 admin center, goes to the edit page for an
instance, and then generates a new encryption key to use to encrypt the instance. As part of the key
generation, the malicious Dynamics 365 administrator downloads the encryption key.
2. The malicious administrator locks the associated Dynamics 365 (online) instance and takes or deletes the
encryption key that was used to lock the instance.
IMPORTANT
To prevent the malicious administrator from interrupting the business operations by locking the database, the managed keys
feature does not allow the database to be locked for 72 hours after the encryption key is changed. Additionally, anytime an
encryption key is changed for a Dynamics 365 (online) instance, all Dynamics 365 (online) administrators receive an email
message alerting them of the key change. This provides up to 72 hours for other administrators to roll back any
unauthorized key changes.

Key management requirements
Privileges required
To use the manage keys feature you need one of the following privileges:
Office 365 Global Administrators membership.
Office 365 Service Administrators group membership.
System Administrator security role for the instance of Dynamics 365 (online) that you want to manage the
encryption key.
Subscription requirements
The ability to self-manage database encryption keys requires either Dynamics 365 Customer Engagement Plan or
Dynamics 365 Plan.
Encryption key requirements
If you provide your own encryption key, your key must meet these requirements that are accepted by Azure Key
Vault.
The encryption key file format must be PFX or BYOK.
2048-bit RSA or RSA-HSM key type.
PFX encryption key files must be password protected.
For more information about the key types supported by Key Vault by uploading the file in the Dynamics 365 admin
center. Only the encrypted version of your key leaves the original workstation. For more information about
generating and transferring an HSM -protected key over the Internet see How to generate and transfer HSM protected keys for Azure Key Vault.

Key management tasks

The following sections describe the tasks you can perform when you choose to self-manage the database
encryption key for one or more instances.
Set or change the encryption key for an instance
Use this procedure to set the manage key feature the first time for an instance or to change an encryption key for
an already self-managed instance.
1. Sign in to the Office 365 Admin center.
2. Expand Admin centers, and then click Dynamics 365.
3. Click Instance, select the instance where you want to manage the database encryption key, and then click
Edit.
4. Under database encryption settings, click manage key.

5. Review the message that appears and if you want to manage your own database encryption key for the
instance, click ok.
6. By default, the name for the key is InstanceName Encryption Key. Leave the key name or change it and then
click either new or upload.

new
Click new to have a .PFX encryption key generated for you that will be used to encrypt the database.
1. When you are prompted, enter the password that will be used for the encryption key.
2. To use the key for the instance, click **Yes**.
3. When you're prompted to save the private key, save it to a secure location. The key generated is RSA SHA256
2048-bit. We strongly recommend that you back up the key and save the password to a secure location.
4. Click **close** to close the manage your database encryption key dialog box.

upload
Click upload to provide your own password protected PFX or BYOK encryption key file.
1. Browse
encryption
export the
encryption

for and add your own key that has been exported from your local hardware security module (HSM) or
key application. For BYOK encryption key files, make sure you use the subscription id when you
encryption key from your local HSM. Click **Uploading a BYOK file?** on the **manage you database
key** dialog box to find your subscription id.

2. If you’re sure you want to change the encryption key, click **yes**.
3. Enter a password for the key, and click **ok**.
4. Click **close** to close the manage your database encryption key dialog box.
5. An email message is sent to all [!INCLUDE[pn_crm_online_shortest](../includes/pn-crm-online-shortest.md)]
administrators in your organization. This occurs whenever a key is changed for an instance.

Notice that the key name you specified to manage database encryption settings now appears under Current
Encryption Key.

Revert a managed encryption key
Reverting a managed key configures the instance back to the default behavior where Microsoft manages the
encryption key for you.
From the Dynamics 365 admin center, click Instance, select the instance that you want to revert, and then
click Edit.
Under database encryption settings, click manage key.
Click revert.
To revert the instance back to Microsoft-managed key encryption, click yes.
Click close to close the manage your database encryption key dialog box.
Lock an instance
A locked instance remains inaccessible to everyone, including Microsoft, until a tenant administrator in your
organization unlocks it by using the key that was used to lock it.
Cau t i on

While a Dynamics 365 (online) instance is locked it takes the instance completely offline and it cannot be accessed
by anyone, including Microsoft. Additionally, services such as synchronization and maintenance are all stopped.
You should never lock an instance as part of your normal business process. A common reason why you would lock
an instance is when you move your database from online to on-premises. Locking the instance can make sure that
your online data is never access again by anyone.
A locked instance can’t be restored from backup.
1. From the Dynamics 365 admin center, click Instance, select the instance that you want to lock, and then
click Edit.

2. Under database encryption settings, click manage key.
3. Click lock instance.
4. Enter the name as it appears in the dialog box to confirm that you understand the risks with locking an
instance, and then click upload.
5. Browse for and select the encryption key file that was used to encrypt the instance, and then click Open.
6. Enter the password for the key, and then click ok.
7. To lock the instance, click yes.
8. Click close to close the manage your database encryption key dialog box.
Unlock a locked instance
To unlock an instance, you must provide the encryption key and password that was used to lock the instance.
1. From the Dynamics 365 admin center, click Instance, select the instance that you want to unlock, and then
click Edit.
2. Under database encryption settings, click manage key.
3. Click unlock instance.

4. Browse for and select the encryption key that was used to encrypt the instance, and then click Open.
5. Enter the password for the key, and then click ok.
6. Click close to close the manage your database encryption key dialog box.
See also
SQL Server: Transparent Data Encryption (TDE )

Troubleshooting: Unblock required URLs
8/24/2018 • 2 minutes to read • Edit Online

Applies to Dynamics 365 (online), version 9.x
Applies to Dynamics 365 (online), version 8.x
Dynamics 365 (online) uses several Microsoft URLs to help provide security, services, and features. However, your
computer or your organization’s computer network may block access to some of these URLs. Blocking any of the
required URLs will cause Dynamics 365 (online) to operate incorrectly or not at all.
You may see a network or server error message if your computer or your organization's network blocks the URLs
you need. The error message might look like one of these:
"The specified Dynamics 365 Server address (URL ) is not responding. Ask your administrator to verify that
the server is turned on, and then try again."
"There is a problem communicating with the Dynamics 365 Server. The server might be unavailable."
You can unblock these URLs on your computer by adding them to a list of approved sites in your browser.
IMPORTANT
If the following procedure doesn’t unblock the URLs required for Dynamics 365, ask your system administrator to unblock
the URLs on the organization’s network.

Unblock Dynamics 365 URLs in Internet Explorer
1. On the Explorer bar, click or tap the Tools icon (the white gear shape), and then click or tap Internet
options.
2. Click or tap the Security tab > Trusted sites > Sites.
3. In Add this website to the zone, type the URL for your Dynamics 365 (online) organization. For example,
https://contoso.crm.dynamics.com
4. Click or tap Add > Close > OK.
For a list of other URLs you may need to add to unblock, see Internet accessible URLs required for Microsoft
Dynamics CRM Online

Datacenter regions
8/24/2018 • 2 minutes to read • Edit Online

Applies to Dynamics 365 (online), version 9.x
Applies to Dynamics 365 (online), version 8.x
Dynamics 365 (online) is being hosted in datacenters in more and more regions. After Dynamics 365 (online)
becomes available in a new region, the following apply:
For new Dynamics 365 (online) organizations, the datacenter will be aligned with the country/region you
selected during sign-up.
For existing Dynamics 365 (online) organizations, Microsoft will soon accommodate migrations to
datacenters in the new region when requested by the customer as long as the Dynamics 365 (online)
organization meets certain business requirements.
The following table lists the newest datacenter regions. Checkout the interactive data map: Where is my data?
DATACENTER REGIONS

SERVICE AREA

INFORMATION

Canada

About Microsoft Cloud Canada

Germany

About Microsoft Cloud Germany

India

About Microsoft Cloud India

Japan

About Microsoft Cloud Japan

Oceania

Australia, New Zealand, Fiji

About Microsoft Cloud Australia

Migration process
This is the overall process for migrating to a new datacenter.

Depending on the type of transition, you may be required to go through more steps.
See also
Geo to geo migrations for Dynamics 365 (online)
Products by region
Terminology used in the product and documentation

About the Microsoft Cloud Australia datacenter
8/24/2018 • 14 minutes to read • Edit Online

Applies to Dynamics 365 (online), version 9.x
Applies to Dynamics 365 (online), version 8.x
You may request migration to the Australia datacenter upon datacenter availability (Q1 CY2015).
If you’re an existing Dynamics 365 (online) customer with a billing address mapping to a new data center region,
review the information in this topic to understand the move process.

Australia GEO expansion announcement
What is Microsoft announcing?
Dynamics 365 (online) will become a service within the Australia datacenters with availability in Q1 CY2015.
Dynamics 365 (online) is currently available in 130 markets and 44 languages enabling us to sell side-by-side with
Office 365 in the majority of the markets worldwide. With the inclusion of datacenters in Japan (recently
announced) and Australia, both targeting Q1 CY2015, our global customers will be served by 17 datacenters
covering 6 global regions around the world.
This marks an important step for customers and partners on our cloud journey to serve our customers in
Australia, New Zealand, and Oceania (Australia GEO ). By bringing Dynamics 365 (online) to the local region, we’ll
be able to serve our customers more effectively and with better performance while also ensuring compliance with
local requirements.
What prompted Microsoft to undertake this geographic expansion of Dynamics 365 (online )?
In order to better serve customer needs for data residency and reduced latency, we continually evaluate where we
should expand availability around the world. We are committed to long-term investment in Dynamics 365 (online)
and expansion over time.
This global expansion will enable us to deliver on the promise of increasing sales productivity while allowing our
customers to sell effectively, market smarter, and provide care everywhere to offer amazing experiences to their
customers.
What are the future geographic expansion plans for Dynamics 365 (online )?
Geographic expansion of Dynamics 365 (online) is a high priority and we’re constantly evaluating market needs.
While we have no additional information or specifics on future plans to announce at this time, we will update if and
when we have something to share.

Datacenter overview
Where are the datacenters located in the Australia Geo?
The Dynamics 365 (online) Australia Geo will consist of datacenters in the Australia East Region (New South
Wales) and the Australia Southeast Region (Victoria).
What does this announcement mean for customers in the Australia Geo?
Microsoft is committed to meeting the growing demand for reliable and connected devices and services for our
customers around the globe. We have heard loud and clear that our customers in the Australia Geo need locally
delivered services. The growth of Dynamics 365 (online) in the Australia Geo means we can better serve the needs
of these customers in three ways:

Most customer data will be kept within Australia, except for Azure Active Directory data*, helping customers
meet data residency requirements.
Customers who deploy applications to the new Australia datacenters enjoy improved performance within
the Australia Geo as network latency is reduced.
Our expansion in the Australia Geo also provides customers with the same level of high availability and
redundancy as with our datacenters in other countries/regions. Customers in Australia, New Zealand, and
Oceania will enjoy the benefit of a financially backed 99.9% service level agreement (SLA) and redundancy
both inside of the primary datacenter where they are deployed as well as to the secondary datacenter in the
Australia geography to help ensure ongoing uptime and protect against a major disaster in a single region.
*The Australia Geo will be considered a separate Geo subject to the same data location commitments we make for
other Geos. For the definition of customer data and details on our data flow maps in Geo, see the Dynamics Trust
Center.
What region will be used for replication of data for the Australia Geo?
Dynamics 365 (online) services deployed in the Australia East Region will replicate data to the Australia Southeast
Region and vice-versa.
For the Australia East and Southeast Region datacenters, access to provisioning resources in these datacenters is
limited, as described here:
For Web Direct, access to the datacenters is based on the country/region set in your Dynamics 365 (online)
account.
If the account country/region is Australia, New Zealand or Fiji, Dynamics 365 (online) resources will
be provisioned in the Australia East and Southeast Region datacenters.
If the account country/region is not Australia, New Zealand, or Fiji, the customer will not be able to
provision Dynamics 365 (online) services in the Australia East and Southeast Region datacenters. To
do so a customer needs to try or purchase Dynamics 365 (online) for an organization located in
Australia, New Zealand or Fiji. The customer can create another Web direct account for organizations
located in Australia, New Zealand and Fiji, with a billing address in any these regions, if they wish to
select and deploy Dynamics 365 (online) services in the Australia East and Southeast Region
datacenters.
For Volume Licensing (VL ) customers, access to the datacenters is based on the country/region in which the
volume license agreement was signed.
If the VL agreement was signed in Australia, New Zealand, or Fiji, the customer will be able to use
Dynamics 365 (online) services in the Australia East and Southeast region datacenters. Accounts
added to the VL agreement will be enabled to use Dynamics 365 (online) in the Australia East and
Southeast Region datacenters.
VL customers can also create a secondary deployment in Australia, New Zealand, or Fiji under an
existing VL agreement by either signing an enrollment in Australia, New Zealand, or Fiji or by
applying for a multitenant amendment through the local Licensing Specialist.
Web direct and VL customers in Australia will still have the ability to deploy instances in datacenters outside
of Australia – however, you must have a tenant already provisioned in Australia. Under this
multitenant/multi-geo scenario, AU GST will still be applied to instances deployed in other regions.
How do I find what country or region my account is under?
1. Sign in to https://portal.office.com.
2. In the upper-right corner of Office 365 Admin Center, choose your organization.

3. On the Company profile page, your account country/region is listed under Country or region.

Dynamics 365 (online) service overview
Will multi-geo instances be available to customers in Australia?
Multi-geo instances will be supported for Australian customers as long as the tenant is first provisioned in
Australia. For customers who aren’t located in Australia but want to provision an instance of Dynamics 365
(online) within the Australia datacenter, they must first purchase a tenant for an organization located in
Australia and then the tenant will be able to get provisioned in Australia.
Availability of multi-geo instance support will be limited in the initial rollout to a fixed number of eligible
customers upon request, and we will continue to expand over time.
Will the standard Dynamics 365 Online SLA be offered at general availability launch?
Yes, on the date of general availability, the standard 99.9 % financially backed service level agreement (SLA) for
Dynamics 365 (online) will apply, just as it does in our other regions around the world. Note: the SLA for
Dynamics 365 (online) doesn’t cover Microsoft Social Engagement.
What rules govern New Zealand or Oceania customers who want to license affiliates located in Australia?
A New Zealand and Oceania customer may not place orders under its existing agreement for any affiliate located
in Australia, nor grant any affiliate located in Australia administrative rights to manage subscriptions, if the
customer elects to access and use services delivered from datacenters located in Australia. An affiliate located in
Australia that wants to access and use Online Services delivered from our datacenters located in Australia must
enter into its own subscription under its separate Microsoft Online Services Agreement.
Will Microsoft Dynamics Marketing, Social Engagement, and Parature be available in the Australia datacenters?
These services will be available for purchase in the local market but will be delivered outside of the Australia
Datacenters at this time. Note: Dynamics 365 (online) leverages Azure Active Directory and Multi-Factor
Authentication, which don’t offer a region choice to customers.
Will Dynamics 365 be available on Azure Infrastructure as a Service (IaaS ) in Australia?
At this time, Dynamics 365 (online) is only available for Dev/Test scenarios and isn’t supported for production use
cases. Developers can leverage their MSDN subscription and Azure credits for dev/test scenarios. Note: we
recently announced intent to support Dynamics 365 (online) on Azure IaaS but we’re dependent on Azure
Premium Storage availability in each geography. Azure’s Limited Public Preview will only be available in the U.S.
and part of Europe.
Where can I find more about Dynamics 365 (online ) security, data privacy, and compliance?
The Microsoft Dynamics 365 Trust Center will be updated as needed when the Australia Datacenters launch into
general availability.
What data for Dynamics 365 (online ) will be in Australia datacenters at general availability?
For Dynamics 365 (online), we’ll store all customer data, including backups, within the Australia Datacenter. For
any Office 365 services that are running in conjunction with Dynamics 365 (online) those services will follow the
data storage rules for Office 365.
Will Dynamics 365 (online ) be Information Security Registered Assessors Program (IRAP) certified when the
datacenters are live in Australia?
We’re actively investigating IRAP requirements and how they relate specifically to Dynamics 365 (online) and we’ll
share more information at a later date.

Where can I find out more about the physical infrastructure for Dynamics 365 (online )?
Microsoft Cloud Infrastructure and Operations (MCIO ) powers the Microsoft cloud services. MCIO focuses on
smart growth, high reliability, operational excellence, cost-effectiveness, environmental sustainability, and a
trustworthy online experience for customers and partners worldwide.
MCIO delivers the core infrastructure and foundational technologies for Microsoft's 200+ online businesses
including Bing, Outlook.com, MSN, Office 365, Xbox Live, and Dynamics 365 (online). The infrastructure is
comprised of a large global portfolio of datacenters, servers, content distribution networks, edge computing nodes,
and fiber optic networks.

Migration
I have applications and data in an existing Microsoft Dynamics 365 (online ) datacenter. Will I be able to move
those resources to the Australia datacenters?
For Web direct customers, if the account country/region is Australia, New Zealand, or Fiji, the customer will be
eligible to have his instances moved to the Australia East and Southeast region datacenters.
The account country/region can be found in the Office 365 Admin Center.
1. Sign in to https://portal.office.com.
2. In the upper-right corner of Office 365 Admin Center, choose your organization.

3. On the Company profile page, your account country/region is listed under Country or region.
If the account country/region is outside Australia, New Zealand, or Fiji, you’ll need to create another Web
direct account with a billing address in Australia, New Zealand, or Oceania. Once the new account and
tenant are created, you can then request the move of their Dynamics 365 (online) instance and data from
other regions into the Australia region by contacting Dynamics 365 (online) Support. For more information,
see How do I request my instance to be moved to the Australia datacenter? Microsoft reserves the right to
make a unilateral decision to migrate accounts based on multiple conditions.
If you’re a volume license customer and the volume license agreement was signed in Australia, New
Zealand, or Oceania, you’ll be eligible to move applications and data to the Australia East and Southeast
region datacenters and deploy services there.
Accounts added to the volume license agreement are eligible to move applications and data to the Australia
East and Southeast region datacenters and deploy services there.
To provision a tenant in the Australia datacenter, if you have a volume license enrollment outside the
Australia datacenter you will need to sign an enrollment in Australia, New Zealand, or Oceania and then
migrate existing instances to the Australia datacenter.
To move your tenants, instances, and data to the Australia regions, you should contact Dynamics 365
(online) Support for additional information regarding migrating your instances. For more information, see
How do I request my instance to be moved to the Australia datacenter? Microsoft reserves the right to
make a unilateral decision to migrate accounts based on multiple conditions.
For additional guidance regarding multiple tenants and multiple instances, see Multiple online instances or
tenants. This link will be updated with the Dynamics 365 (online) 2015 launch.
How do I request my instance to be moved to the Australia datacenter?
You can request a move to the new Australian datacenter by submitting a technical support incident through the
Office 365 Admin Center.

1. Sign in to https://portal.office.com.
2. Go to Support > Service Requests > +
3. Choose More > Dynamics 365 Online
4. For Feature, select Data Management. For Symptom, select Data Center migration request.
5. Fill in the rest of the information to submit a service request.
A Dynamics 365 (online) support engineer will assist you in verifying required prerequisites and provide
guidance throughout the move process.
How will Microsoft engage with me on the migration?
Once you have been scheduled for migration, a member of the Microsoft Support team will work directly with you
to discuss scheduling and any other issues that may come up during the migration.
If I am scheduled for an update to CRM Online 2015 Update or CRM Online 2015 Update 1, will Microsoft apply
the update at the same time as their migration to the Australia datacenter?
You must be updated to Microsoft Dynamics CRM Online 2015 Update or later prior to migrating to the Australia
datacenter. Customers can schedule their update. For more information, see Manage Dynamics 365 (online)
updates.
If I have both Office 365 services and Dynamics 365 (online ), how will migration be handled?
The migration of each service will be handled separately. For Dynamics 365 (online), you’ll be able to choose their
migration date and time. Microsoft will work with you to schedule the migration. For Office 365 scheduling and
migration, see New datacenter regions for Office 365.
Can I move Office 365 and Dynamics 365 (online ) at the same time?
The move process for each service is handled separately but the Dynamics 365 (online) move can be scheduled to
coincide with the Office 365 Admin Center move if requested.

Pricing and licensing
Will all versions of Dynamics 365 Online be available?
Customers will be able to purchase all licenses that are currently available in market today. Please see local
availability at Microsoft Dynamics CRM Solutions. Global pricing can be found at Microsoft Dynamics Pricing List
How will a customer who has an existing volume license (VL ) agreement outside of Australia be billed if they
add a new tenant to their agreement that resides in Australia?
The additional seats will be invoiced at the same rate on the customer’s invoice. The business desk will need to
provide a multi-tenant amendment to provide an additional tenant in Australia.
Will customers who purchase Dynamics CRM Online and an additional service such as Parature, Dynamics
Marketing, or Microsoft Social Engagement be taxed differently per service?
Microsoft has a datacenter footprint that varies according to each online service offered. Dynamics 365 (online)
will be provisioned and available from datacenters located within Australia, which makes those services subject to
some taxes that do not necessarily apply to tenants located and provisioned outside Australia. Microsoft Social
Engagement has their own datacenter footprint; they’re offered from to customers in Australia from datacenters
outside of Australia. Therefore, these online services are subject to a different tax treatment.

Tax and billing
Will there be any changes on my bill?
New Zealand and Fiji customers will see no changes on their invoices.

For Australia customers, from the general availability date when Dynamics 365 (online) services become available
from Microsoft Australia datacenters, Microsoft will charge all Australian customers an additional amount equal to
the Australian GST for Dynamics 365 (online) services and will issue tax invoices. This change will occur because
Australian GST is payable on taxable supplies of goods and services provided and offered in Australia.
My tenant has not moved to Australia datacenter, why am I being charged Australia Goods and Service Tax
(GST )?
There are various factors that must be considered to determine whether GST is payable on the supply. Australian
GST is payable on taxable supplies of goods and services provided and offered in Australia.

Trials
If I started a trial outside of Australia and before general availability, will I be moved to the Australia datacenter
after general availability?
No. Trials will remain in the geography where they were initiated. You may choose to start a new trial that would
be provisioned in the Australia datacenter.
If I choose to convert a trial to a paid subscription, where the trial was created in a geographic region outside of
Australia prior to general availability, will my subscription tenant and instance be moved to the Australia
datacenter?
No. If you choose to convert a trial that was created in a geographic region outside of Australia before general
availability, your trial will be converted and billed in the geography where it was initiated. Australia GST does not
apply.
If the trial was originally deployed in Australia and converted to a paid subscription, you’ll charged Australia GST.
If you decide you want your instance to be in the Australia datacenter, you’ll need to follow the migration steps
outlined previously. Once you’re moved to Australia, the appropriate billing and tax will be applied.
If a customer creates a trial in the Australia datacenter after general availability, will they be taxed for the trial?
No. Trials are free for 30 days.
Can I create a trial in the Australia datacenter before general availability?
No. You can’t create a trial or move a production instance before general availability.
See also
Office 365 and Dynamics CRM Online now available from datacenters in Australia
New datacenter regions for Dynamics 365 (online)

About the Microsoft Cloud Canada datacenter
8/24/2018 • 6 minutes to read • Edit Online

Applies to Dynamics 365 (online), version 9.x
Applies to Dynamics 365 (online), version 8.x

New Microsoft Cloud Services in Canada
What is Microsoft announcing?
We’re announcing the general availability of Dynamics 365 (online) served from new datacenter regions in
Toronto and Quebec City, joining Azure and Office 365 in providing the trusted Microsoft Cloud in Canada.
Built on foundational principles of security, privacy and control, compliance, and transparency, the Microsoft Cloud
delivers trusted cloud services to enable people and organizations to achieve more. Providing flexible platform and
productivity solutions - Azure, Office 365, and now Dynamics 365 (online) - the local Microsoft Cloud is designed
to fuel innovation and accelerate Canada’s digital transformation.
What is the benefit to customers?
The new local Microsoft Cloud enables data residency for customers in Canada, bringing enterprise-grade
reliability and performance to regulated industries and other businesses. This includes data replication in multiple
regions within Canada for business continuity, reduced network distance, and the option of a private connection to
the cloud with Azure ExpressRoute. The Microsoft Cloud in Canada comes with the same deep commitment to
high availability as our other regions, including a financially backed service level agreement of 99.9%.
For Dynamics 365 (online), data residency means that most customer data will be kept within Canada, except for
Azure Active Directory data. For the definition of customer data and details on our data flow maps in Geo, see the
Microsoft Dynamics 365 Trust Center.
Where are the Microsoft Cloud Canada regions?
The Dynamics 365 (online) Canada Geo will consist of datacenters in Toronto and Quebec City.
How do I find what country or region my account is under?
1. Sign in to https://portal.office.com.
2. In the upper-right corner of the Office 365 admin center menu bar, click your organization.

3. On the Company profile page, your account country/region is listed under Country or region.

Dynamics 365 (online) service overview
Will multi-geo instances be available to customers in Canada?
Yes, multi-geo instances will be supported for Canada. Multi-geo instances are designed for companies with
offices in multiple countries or regions who want to keep core customer data within those countries or regions.
Availability of multi-geo instance support will be limited in the initial rollout to a fixed number of eligible
customers. We'll continue to expand this capacity over time. Read more on how to create and edit multi-geo
instances.

Will the standard Dynamics 365 Online service level agreements be offered?
Yes, the standard Dynamics 365 (online) service level agreements (SLAs) will apply to the Canada regions, just as
they do in our other regions around the world.
NOTE
The SLA for Dynamics 365 (online) doesn't cover Microsoft Social Engagement.

Will Microsoft Dynamics Marketing, Social Engagement, and Parature be available in the Canada datacenters?
These services are available for purchase in Canada, however, these services are provisioned regionally at this
time.
What is the customer experience if I use both Dynamics CRM Online from the Canada regions while using
Microsoft Dynamics Marketing, Microsoft Social Engagement, and Parature from other regions?
The customer experience will be unchanged, the workloads for the other services will simply be provisioned from
other regions.
When will ExpressRoute be available in Canada for Dynamics 365 Online customers, and through which partners?
ExpressRoute is currently available in Canada. View a current list of ExpressRoute locations and partners.
Microsoft is currently working to enable customers to use ExpressRoute with Dynamics 365 (online) from the
Canada regions.
Where can I find more about Microsoft Dynamics 365 (online ) security, data privacy, and compliance?
You can find more information at the Microsoft Dynamics 365 Trust Center.
Where can I find out more about the physical infrastructure for Dynamics 365 (online )?
These services are hosted in the Microsoft cloud infrastructure comprising more than 100 globally distributed
datacenters, edge computing nodes, and service operations centers. This infrastructure is supported by one of the
world’s largest multi-terabit global networks, with an extensive dark fiber footprint that connects them all.
Microsoft provides cloud services to customers 24x7x365, and the Microsoft Cloud Infrastructure and Operations
team designs, builds, operates and helps secure every facet of the infrastructure. Since opening our first datacenter
in 1989, we’ve invested more than $15 billion on our infrastructure and remain focused on delivering reliable,
scalable, and secure online services.

Migration
You may request migration to the Canada datacenter by submitting a technical support request. If you’re an
existing Dynamics 365 (online) customer with a billing address mapping to Canada, review the information in this
topic to understand the move process.
How do I request my instance to be moved to Canada?
You can request a move to the new Canada datacenter by submitting a technical support request through the
Dynamics 365 admin center or by calling Microsoft Support. Please select the Data Management topic and Data
Center Migration Request sub-topic to ensure your request receives the best possible routing. A Dynamics 365
(online) support engineer will assist you in verifying required prerequisites and provide guidance throughout the
move process.

*Customers will be required to go through more steps depending on the type of transition.
How will Microsoft engage with me on the migration?
Once you have been scheduled for migration, a member of the Microsoft Support team will work directly with you
to discuss scheduling and any other issues that may come up during the migration.
If I am scheduled for an update to CRM Online 2015 Update or CRM Online 2015 Update 1, will Microsoft apply
the update at the same time as their migration to the Canada datacenter?
You must be updated to Microsoft Dynamics CRM Online 2015 Update or later prior to migrating to the Canada
datacenter. Customers can schedule their update. For more information, see Manage Dynamics 365 (online)
updates.
If I have both Office 365 services and Dynamics 365 (online ), how will migration be handled?
The migration of each service will be handled separately. For Dynamics 365 (online), you’ll be able to choose their
migration date and time. Microsoft will work with you to schedule the migration. For Office 365 scheduling and
migration, see New datacenter regions for Office 365.
Can I move Office 365 and Dynamics 365 (online ) at the same time?
The move process for each service is handled separately. The Dynamics 365 (online) move can be requested to
coincide with the Office 365 Admin Center move.
If my content is stored in the Canada datacenters, can I access my content for work from locations outside of
Canada?
Yes. If you're outside of Canada and sign in to Dynamics 365 (online) as an authenticated user, you'll be able to
access the relevant data.

Licensing and pricing
Will all versions of Dynamics 365 (online ) be available?
Customers will be able to purchase all licenses that are currently available in the market today. Please see local
availability at Microsoft Dynamics CRM Solutions. Global pricing can be found at Microsoft Dynamics Pricing List.
How will a customer who has an existing volume license agreement outside of Canada be billed if they add a
new tenant to their agreement that resides in Canada?
The additional seats will be invoiced at the same rate on the customer’s invoice. The business desk will need to
provide a multi-tenant amendment to provide an additional tenant in Canada.
If I started a trial outside of Canada and before general availability, will I be moved to the Canada datacenter
after general availability?
No. Trials will remain in the geography where they were initiated. You may choose to start a new trial that will
provision in the Canada datacenter.
If I choose to convert a trial to a paid subscription, where the trial was created in a geographic region outside of
Canada prior to general availability, will my subscription tenant and instance be moved to the Canada
datacenter?
No. If you choose to convert a trial that was created in a geographic region outside of Canada before general
availability, your trial will be converted and billed in the geography where it was initiated. If the trial was originally

deployed in Canada and converted to a paid subscription, it will continue to be deployed in Canada.
If a customer creates a trial in the Canada datacenter after general availability, will they be taxed for the trial?
No. Trials are free for 30 days.
See also
Office 365 datacenters now available in Canada
New datacenter regions for Dynamics 365 (online)

About the Microsoft Cloud Germany datacenter
8/24/2018 • 4 minutes to read • Edit Online

Applies to Dynamics 365 (online), version 8.x
Microsoft Dynamics 365 Germany address the needs of the most regulated customers in Germany, the European
Union (EU ), and the European Free Trade Association (EFTA). The German datacenter delivers services that bring
together the best of Microsoft in productivity, collaboration, intelligence and platform to grow, evolve and
transform your business.
NOTE
Due to the unique nature of Microsoft Dynamics 365 Germany, there are some features that have not yet been enabled. The
key sales, marketing, and service features for Dynamics 365 will be the same as in other regions. However, there may be
external factors that are made available in other clouds, but will not be available to German cloud customers at this time.
Please check back for the latest information.

German Data Residency
Customer Data will be stored at rest in two independent, geographically dispersed datacenter locations in
Germany. Replication of Customer Data across these German datacenters ensures data remains in Germany even
in backup, business continuity, and disaster recovery scenarios.
Customer Data means all data that are provided to Microsoft by, or on behalf of the customer through the use of
Dynamics 365.
Note the following:
Customer Data is stored at rest in Germany
Access control is through a German Data Trustee.
All security and compliance capabilities of Dynamics 365 are included.

German Data Trustee
The German Data Trustee controls access to Customer Data by anyone except the customer or the customer’s end
users. This means that access to Customer Data or the infrastructure on which Customer Data resides for
performing operational tasks must be granted and supervised by the German Data Trustee, or else directly by the

customer.
The German Data Trustee may also perform non-data specific tasks related to day-to-day datacenter operations.

Germany Service Delivery
The following describe current and planned service availability. We will continue to add more services as they
become available.
Dynamics 365 Germany offers the following online services:
Microsoft Dynamics 365 for Sales
Dynamics 365 for Customer Service
Dynamics 365 Customer Engagement Plan
Customer Engagement Plan is a user subscription that includes Microsoft Dynamics 365 for Sales, Dynamics 365
for Customer Service, Field Service, Project Service, and Team Members. Please note that Dynamics 365 for Field
Service and Dynamics 365 for Project Service Automation cause location data to be transmitted to Bing Maps
outside of Germany.
Coming soon:
Azure ExpressRoute
Some online services or add-ons are not yet offered, such as:
Online services:
Dynamics 365 for Finance and Operations
Dynamics for Financials
Microsoft Flow
Microsoft Social Engagement
Add-ons and Integration
Dynamics 365 - Gamification
Mobile offline synchronization
Relevance Search
Azure Machine Learning integration
Bing Maps integration
Office 365 Groups integration

Power BI integration

Compliancy and certifications
Microsoft Dynamics 365 Germany is built in adherence to the cloud security and compliance standards and
commitments of Dynamics 365.
Microsoft Dynamics 365 Germany is planned to be covered under existing audits.
Uses the same security and controls
Includes ISO 27001, 27018, and SOC 1 and 2
Data centers undergo audits like any other expansion.
The additional Data Trustee controls in Microsoft Dynamics 365 Germany will be evaluated by independent
assessors as part of our annual ISO and SOC.
Microsoft Dynamics 365 Germany includes client software applications that are installed and run on an end user’s
device (“client software applications”), such as Dynamics 365 for Outlook, Dynamics 365 for phones and
Dynamics 365 for tablets, and the Unified Service Desk for Dynamics 365. Client software applications do not
operate exclusively in German data centers and may enable an end user to access online services that are not
German Online Services. For purposes of your agreement with Microsoft, client software applications are not
German Online Services. German Data Residency commitments and access control by German Data Trustee apply
only to the German Online Services.
Apps available in a Microsoft app store are provided by either Microsoft or a third-party app publisher and these
are subject to a separate privacy statement and terms and conditions. Data provided through the use of a
Microsoft app store and any app may be accessible to Microsoft or the third-party app publisher, as applicable,
and transferred to, stored, and processed in the United States or any other country or region where Microsoft or
the app publisher and their affiliates or service providers maintain facilities. Please work with the app publisher to
make sure it meets requirements for your Microsoft Dynamics 365 Germany deployment.

Privacy notice
Mapping functions for Dynamics 365 Customer Engagement Plan
Field Service and Project Service Automation have key functions that rely on location. For example, the location of
Service Accounts (which define where services or tasks take place) or the starting/ending location of Resources
(people performing services or tasks). In order for the system to show these on a map - or to calculate distances
between points - it's necessary to use a mapping service (in this case Bing Maps).
Following is the workflow to and from the Bing Maps service:
FROM DYNAMICS 365

BING MAPS RETURNS

NOTE

Address (account or resource)

Latitude and longitude of the address
(location)

This is referred to as "geo-coding" of an
address.

Set of locations (latitude/longitude)

Distance between locations

This can be used to find optimal routes
for resources or to calculate travel
times.

Set of locations (latitude/longitude)

Map view with the locations as pins on
the map

This is used to view the accounts and
resources in a map view.

NOTE
Aside from the data referenced above, no other data is sent to the Bing Maps service.

See also
Microsoft Azure Germany
New datacenter regions for Dynamics 365 (online)

About the Microsoft Cloud India datacenter
8/24/2018 • 7 minutes to read • Edit Online

Applies to Dynamics 365 (online), version 9.x
Applies to Dynamics 365 (online), version 8.x

New Microsoft Cloud Services in India
What is Microsoft announcing?
We’re announcing the general availability of Dynamics 365 (online) served from new datacenter regions in Pune
and Chennai, joining Azure and Office 365 in providing the trusted Microsoft Cloud in India.
Built on foundational principles of security, privacy and control, compliance, and transparency, the Microsoft Cloud
delivers trusted cloud services to enable people and organizations to achieve more. Providing flexible platform and
productivity solutions Azure, Office 365, and now Dynamics 365 (online), the local Microsoft Cloud is designed to
fuel innovation and accelerate India’s digital transformation.
What is the benefit to customers?
The new local Microsoft Cloud enables data residency for customers in India, bringing enterprise-grade reliability
and performance to regulated industries and other businesses. This includes data replication in multiple regions
within India for business continuity, reduced network distance, and the option of a private connection to the cloud
with Azure ExpressRoute. The Microsoft Cloud in India comes with the same deep commitment to high availability
as our other regions, including a financially backed service level agreement of 99.9%.
For Dynamics 365 (online), data residency means that most customer data will be kept within India, except for
Azure Active Directory data. For the definition of customer data and details on our data flow maps in Geo, see the
Microsoft Dynamics 365 Trust Center.
Where are the Microsoft Cloud India regions?
The Dynamics 365 (online) India Geo will consist of datacenters in Central India (Pune) and South India (Chennai).
How do I find what country or region my account is under?
1. Sign in to https://portal.office.com.
2. In the upper-right corner of the Office 365 admin center menu bar, click your organization.

3. On the Company profile page, your account country/region is listed under Country or region.

Dynamics 365 (online) service overview
Will multi-geo instances be available to customers in India?
Yes, multi-geo instances will be supported for India as long as the tenant is provisioned in India. For customers not
located in India who want to provision an instance of Dynamics 365 (online) within the India datacenter, they must
first purchase a tenant for an organization located in India and then the tenant can be provisioned in India.
Availability of multi-geo instance support will be limited in the initial rollout to a fixed number of eligible
customers. We'll continue to expand this capacity over time. Read more on how to create and edit multi-geo

instances.
Will the standard Dynamics 365 Online service level agreements be offered?
Yes, the standard Dynamics 365 (online) service level agreements (SLAs) will apply to the India regions, just as
they do in our other regions around the world.
NOTE
The SLA for Dynamics 365 (online) doesn't cover Microsoft Social Engagement.

Will Microsoft Dynamics Marketing, Social Engagement, and Parature be available in the India datacenters?
These services are available for purchase in India, however, these services are provisioned regionally at this time.
What is the customer experience if I use both Dynamics CRM Online from the India regions while using
Microsoft Dynamics Marketing, Microsoft Social Engagement, and Parature from other regions?
The customer experience will be unchanged, the workloads for the other services will simply be provisioned from
other regions.
When will ExpressRoute be available in India for Dynamics 365 Online customers, and through which partners?
ExpressRoute is currently available in India. View a current list of ExpressRoute locations and partners. Microsoft is
currently working to enable customers to use ExpressRoute with Dynamics 365 (online) from the India regions.
Where can I find more about Microsoft Dynamics 365 (online ) security, data privacy, and compliance?
You can find more information at the Microsoft Dynamics 365 Trust Center.
Where can I find out more about the physical infrastructure for Dynamics 365 (online )?
These services are hosted in the Microsoft cloud infrastructure comprising more than 100 globally distributed
datacenters, edge computing nodes, and service operations centers. This infrastructure is supported by one of the
world’s largest multi-terabit global networks, with an extensive dark fiber footprint that connects them all.
Microsoft provides cloud services to customers 24x7x365, and the Microsoft Cloud Infrastructure and Operations
team designs, builds, operates and helps secure every facet of the infrastructure. Since opening our first datacenter
in 1989, we’ve invested more than $15 billion on our infrastructure and remain focused on delivering reliable,
scalable, and secure online services.

Migration
You may request migration to the India datacenter by submitting a technical support request. If you’re an existing
Dynamics 365 (online) customer with a billing address mapping to India, review the information in this topic to
understand the move process.
How do I request my instance to be moved to India?
You can request a move to the new India datacenter by submitting a technical support request through the
Dynamics 365 admin center or by calling Microsoft Support. Please select the Data Management topic and Data
Center Migration Request sub-topic to ensure your request receives the best possible routing. A Dynamics 365
(online) support engineer will assist you in verifying required prerequisites and provide guidance throughout the
move process.

*Customers will be required to go through more steps depending on the type of transition.
How will Microsoft engage with me on the migration?
Once you have been scheduled for migration, a member of the Microsoft Support team will work directly with you
to discuss scheduling and any other issues that may come up during the migration.
If I am scheduled for an update to CRM Online 2015 Update or CRM Online 2015 Update 1, will Microsoft apply
the update at the same time as their migration to the India datacenter?
You must be updated to Microsoft Dynamics CRM Online 2015 Update or later prior to migrating to the India
datacenter. Customers can schedule their update. For more information, see Manage Microsoft Dynamics CRM
Online Updates.
If I have both Office 365 services and Dynamics 365 (online ), how will migration be handled?
The migration of each service will be handled separately. For Dynamics 365 (online), you’ll be able to choose their
migration date and time. Microsoft will work with you to schedule the migration. For Office 365 scheduling and
migration, see New datacenter regions for Office 365.
Can I move Office 365 and Dynamics 365 (online ) at the same time?
The move process for each service is handled separately. The Dynamics 365 (online) move can be requested to
coincide with the Office 365 Admin Center move.
If my content is stored in the India datacenters, can I access my content for work from locations outside of
India?
Yes. If you're outside of India and sign in to Dynamics 365 (online) as an authenticated user, you'll be able to access
the relevant data.

Licensing and pricing
Will all versions of Dynamics 365 (online ) be available?
Customers will be able to purchase all licenses that are currently available in the market today. Please see local
availability at Microsoft Dynamics CRM Solutions. Global pricing can be found at Microsoft Dynamics Pricing List.
How will a customer who has an existing volume license agreement outside of India be billed if they add a new
tenant to their agreement that resides in India?
The additional seats will be invoiced at the same rate on the customer’s invoice. The business desk will need to
provide a multi-tenant amendment to provide an additional tenant in India.
If I started a trial outside of India and before general availability, will I be moved to the India datacenter after
general availability?
No. Trials will remain in the geography where they were initiated. You may choose to start a new trial that will
provision in the India datacenter.
If I choose to convert a trial to a paid subscription, where the trial was created in a geographic region outside of
India prior to general availability, will my subscription tenant and instance be moved to the India datacenter?
No. If you choose to convert a trial that was created in a geographic region outside of India before general
availability, your trial will be converted and billed in the geography where it was initiated. If the trial was originally
deployed in India and converted to a paid subscription, it will continue to be deployed in India.

If a customer creates a trial in the India datacenter after general availability, will they be taxed for the trial?
No. Trials are free for 30 days.
See also
Announcing the availability of Office 365 from local datacenters in India
New datacenter regions for Dynamics 365 (online)

About the Microsoft Cloud Japan datacenter
8/24/2018 • 7 minutes to read • Edit Online

Applies to Dynamics 365 (online), version 9.x
Applies to Dynamics 365 (online), version 8.x
You may request migration to the Japan datacenter upon datacenter availability (March 2015).
If you’re an existing Dynamics 365 (online) customer with a billing address mapping to a new data center region,
review the information in this topic to understand the move process:

Japan GEO expansion announcement
What is Microsoft announcing?
Dynamics 365 (online) is now available as a service within the Japan datacenters.
In addition, Dynamics 365 (online) is currently available in 130 markets and 44 languages enabling us to sell sideby-side with Office 365 in the majority of the markets worldwide. With the inclusion of Japan, our global
customers will now be served from datacenters in 5 global regions around the world.
This marks an important step for on our cloud journey to serve our customers and partners in Japan (Japan GEO ).
By bringing Dynamics 365 (online) to the local region we will be able to serve our customers more effectively and
with better performance while also ensuring compliance with local requirements.
What prompted Microsoft to undertake this geographic expansion of Dynamics 365 (online )?
In order to better serve customer needs for data residency and reduced latency, we continually evaluate where we
should expand availability around the world. We are committed to long-term investment in Dynamics 365 (online)
and expansion over time.
Dynamics 365 (online) is currently available in 130 markets and 44 languages enabling us to sell side-by-side with
Office365 in the majority of the markets around the globe.
This global expansion will enable us to deliver on the promise of increasing sales productivity while allowing our
customers to sell effectively, market smarter, and provide care everywhere to offer amazing experiences to their
customers.
What are the future geographic expansion plans for Dynamics 365 (online )?
Geographic expansion of Dynamics 365 (online) is a high priority and we’re constantly evaluating market needs.
While we have no additional information or specifics on future plans to announce at this time, we will update if and
when we have something to share.

Datacenter overview
Where are the datacenters located in the Japan Geo?
The Dynamics 365 (online) Japan Geo will consist of datacenters in the Japan East and Japan West.
Will the standard Dynamics 365 (online ) SLA be offered at general availability launch?
Yes, on the date of general availability, the standard 99.9% financially backed SLA for Dynamics 365 (online) will
apply, just as it does in our other regions around the world. Note: the SLA for Dynamics 365 (online) does not
cover Microsoft Social Engagement.
Do existing Dynamics 365 (online ) customers have the choice to keep their service from being moved to the

Japan Datacenters?
Existing Dynamics 365 (online) customers will remain in the datacenters where they are currently deployed unless
they request to be moved. Microsoft reserves the right to make a unilateral decision to migrate accounts based on
multiple conditions. All new customers purchasing Dynamics 365 (online) in Japan will be provisioned within the
Japan datacenter.
How do I request my instance to be moved to the Japan datacenter?
You can request a move to the new Japan datacenter by submitting a technical support incident through the Office
365 Admin Center.
1. Sign in to https://portal.office.com.
2. Go to Support > Service Requests > +
3. Choose More > Dynamics 365 Online
4. For Feature, select Data Management. For Symptom, select Data Center migration request.
5. Fill in the rest of the information to submit a service request.
A Dynamics 365 (online) support engineer will assist you in verifying required prerequisites and provide guidance
throughout the move process.
How will Microsoft engage with me on the migration?
Once you have been scheduled for migration, a member of the Microsoft Support team will work directly with you
to discuss scheduling and any other issues that may come up during the migration.
If I am scheduled for an update to Microsoft Dynamics CRM Online 2015 Update or CRM Online 2015 Update 1,
will Microsoft apply the update at the same time as their migration to the Japan datacenter?
You must be updated to Microsoft Dynamics CRM Online 2015 Update or later before migrating to the Japan
datacenter. Customers can schedule their update. For more information, see Manage Microsoft Dynamics 365
(online) Updates.
If I have both Office 365 services and Dynamics 365 (online ), how will migration be handled?
The move of each service will be handled separately and customers will be fully supported even if one service has
been moved and the other has not. For Dynamics 365 (online), customers will be able to choose their move date
and time. Microsoft will work with the customer to schedule the move. For Office 365, customers will be notified
through the message center about the move timeline, but the large number of existing customers means that
individual scheduling is not possible. For Office 365 scheduling and migration, see New datacenter regions for
Office 365.
Can I move Office 365 and Dynamics 365 (online ) at the same time?
The move process for each service is handled separately, but the Dynamics 365 (online) move can be scheduled to
coincide with the Office 365 Admin Center move if requested.
Will multi-geo instances be available to customers in Japan?
Multi-geo instances will be supported for Japan. Availability of multi-geo instance support will be limited in the
initial rollout to a fixed number of eligible customers upon request, and we’ll continue to expand over time.
For additional guidance regarding multiple tenants and multiple instances, see Multiple online instances or
tenants. This link will be updated with the Microsoft Dynamics CRM Online 2015 Update launch.
How will this affect Dynamics 365 (online ) users or partners?
Regardless of where Dynamics 365 (online) is provisioned, you’ll have the ability to determine which of your users
will have access to those services based on how you configure Dynamics 365 (online).
Will Dynamics 365 (online ) be available on Azure Infrastructure as a Service (IaaS ) in Japan?

At this time Dynamics 365 (online) is only available for dev/test scenarios and isn’t supported for production use
cases. Developers can leverage their MSDN subscription and Azure credits for dev/test scenarios. Note: we
recently announced intent to support Dynamics 365 (online) on Azure IaaS but we are dependent on Azure
Premium Storage availability being available in each geographic region. Azure’s Limited Public Preview will only
be available in the U.S. and part of Europe. We do not have any additional information regarding other geos or
general availability at this time.
Where can I find more about Dynamics 365 (online ) security, data privacy, and compliance?
The Dynamics 365 (online) Trust Center will be updated as needed when the Japan datacenters launch into general
availability. To see the current version of the Trust Center, see: Microsoft Dynamics 365 Trust Center.
Will Microsoft Dynamics Marketing, Social Engagement, and Parature, from Microsoft be available in the Japan
datacenters?
These services will be available for purchase in the local market but will be delivered outside of the Japan
datacenters at this time. Note: Dynamics 365 (online) leverages Azure Active Directory and Multi-Factor
Authentication, which don’t offer a region choice to customers.

Pricing
How will billing be handled for customers whose instances are moved from an existing tenant located outside of
Japan to a new tenant in Japan?
Billing is related to the country/region where the customer signs up for the Dynamics 365 (online) service, not
where the service is deployed.
Will all versions of Dynamics 365 (online ) be available?
You’ll be able to purchase all licenses that are currently available in the market today. For more information, see:
Microsoft Dynamics 365 Pricing List.
See also
Office 365 now available from datacenters in Japan
Japan datacenter - Office 365 FAQ
New datacenter regions for Dynamics 365 (online)

Geo to geo migrations
8/24/2018 • 3 minutes to read • Edit Online

Applies to Dynamics 365 (online), version 9.x
Applies to Dynamics 365 (online), version 8.x
We continue to open new datacenter regions for Dynamics 365 (online) for business services, and to add
datacenters to existing regions.
The Geo Migration feature for Dynamics 365 (online) will allow customers to move their instances in a single
tenant from one region to another. There are no user-interface changes or version changes as part of this move. In
the case of a Dynamics 365 (online) instance residing in an Office 365 instance in a single tenant, moving the
Dynamics 365 (online) instance doesn’t move the Office 365 instance; they are separate services. Your Dynamics
365 (online) instance will still appear in your tenant alongside the Office 365 instance.
IMPORTANT
For versions prior to Dynamics 365 (online), version 9.0, you can move individual Dynamics 365 (online) instances from one
geographical region to another. When you do so, your tenant becomes a multiregional tenant. Regional features are enabled
in the Dynamics 365 admin center.
To request a regional migration, please contact your account manager or see Technical Support.
Dynamics 365 (online), version 9.0 does not currently support regional migration. Check back later for availability.

Impact of migrating
Moving an instance to a different region changes your tenant to be multiregional - enabling regional features in
the Dynamics 365 admin center.
The other significant change is to your organization URL. Each of the Dynamics 365 (online) regional datacenters
has a unique identifier in the URL. When your organization is moved from one regional datacenter to another this
identifier will change. For example:
South America (LATAM/SAM ) = .crm2.dynamics.com
Canada (CAN ) = .crm3.dynamics.com
Europe, Middle East, Africa (EMEA) = .crm4.dynamics.com
Asia Pacific (APAC ) = *.crm5.dynamics.com
Australia (OCE ) = *.crm6.dynamics.com
Japan (JPN ) = *.crm7.dynamics.com
India (IND ) = *.crm8.dynamics.com
United Kingdom (UK) = *.crm11.dynamics.com
More information: Direct sign in to Dynamics 365 (online) and Discover the URL for your organization using the
Organization Service
For example, if your existing organization URL is https://myorg.crm5.dynamics.com and you request it to be
moved to Australia, the new organization URL will be https://myorg.crm6.dynamics.com.

You’ll need to update any direct references to your Dynamics 365 (online) organization URL.
NOTE
Organization URLs must be unique. If your organization name has already been reserved in the destination datacenter, it
won’t be available. In the unlikely event this happens, we will work with you to decide how to proceed.

To see the datacenter regions, go to Where is my data? and then click Select Your Region.
The following topics have information that could be helpful to understand the move process:
New datacenter regions for Dynamics 365 (online)
About Microsoft Cloud Australia
About Microsoft Cloud Canada
About the Microsoft Cloud Germany datacenter
About Microsoft Cloud Japan
About Microsoft Cloud India

How the move works
You’ll be provided with a list of prerequisites and post-requisites for your migration. For more information,
download Geo to geo migration information for CRM Online. The following table describes what Microsoft does
before, during, and after your move.

What Microsoft does

BEFORE THE MOVE

DURING THE MOVE

AFTER THE MOVE

Notification

Cut-over

Notification and support

Your support representative
or Account Manager will
work with you to request a
move and scheduling.

Cut-over times for each
service depend on the
number of users and the
amount of data. This step
can take 1 to 6 hours for
smaller organizations, but
may take up to 48 hours for
large organizations. The cutover is done during the
evening or over a weekend.

You will be alerted by email
or telephone when your
instance is migrated to the
new datacenter.

There is a step that will
require your involvement,
which is to re-enter the
encryption key in Dynamics
365 (online). This can
happen at a time that suits
you but the migration
process will be on hold until
you complete this action.

After your geo has migrated
you can perform the post
requisite steps - primarily
changing your new URLs
with any associated
Dynamics 365 plugins or
services.

We will adhere to the terms of the Microsoft Online Services Service Level Agreement for all moves.
See also
Dynamics 365 (online) terminology
Add and edit multiregional instances
Manage Microsoft Dynamics 365 (online) instances

Set up an organization
9/27/2018 • 2 minutes to read • Edit Online

Applies to Dynamics 365 (online), version 9.x
Applies to Dynamics 365 (online), version 8.x
This section describes how to set up your Dynamics 365 organization. You will learn about managing business
units and sites, adding resources and selecting language options.
See also
Terminology used in the product and documentation

Regional and other business management settings
8/24/2018 • 2 minutes to read • Edit Online

Applies to Dynamics 365 (online), version 9.x
Applies to Dynamics 365 (online), version 8.x
This section covers configuring regional settings for everyone in your organization.

Customize regional options
8/24/2018 • 2 minutes to read • Edit Online

Applies to Dynamics 365 (online), version 9.x
Applies to Dynamics 365 (online), version 8.x
You can customize how numbers, currencies, times, and dates appear to everyone in your organization.
1. Make sure you have the System Administrator security role or equivalent permissions in Microsoft
Dynamics 365.
Check your security role
a. Follow the steps in View your user profile.
b. Don’t have the correct permissions? Contact your system administrator.
2. Go to Settings > Administration.
3. Click System Settings.
4. Click the Formats tab.
5. From the Current Format list, select the language and country or region, and then click Customize.
6. In the Customize Regional Options dialog box, you can change the default settings for the selected
format. View how the changes will look in the preview boxes.
Click the Number tab to change the decimal symbol, digit grouping symbol, digit groups, and
negative numbers.
Click the Currency tab to change the currency format, negative currency amounts, and number of
decimal places.
Click the Time tab to change the time format, time separator, and notation for morning and
afternoon.
Click the Date tab to set the type of calendar, first day of the week, first week of the year, formats for
long and short dates, and whether or not to show week numbers in calendar views.
Click Apply to apply the changes and continue working in the dialog box, or click OK to save the
changes and close the dialog box.
7. Click OK.
See also
System Settings dialog box - Formats tab

Manage transactions with multiple currencies
8/24/2018 • 2 minutes to read • Edit Online

Applies to Dynamics 365 (online), version 9.x
Applies to Dynamics 365 (online), version 8.x
Currencies determine the prices for products in the product catalog and the cost of transactions, such as sales
orders. If your customers are spread across geographies, add their currencies in Dynamics 365 to manage your
transactions. Add the currencies that are most appropriate for your current and future business needs.

Add a currency
1. Make sure you have the System Administrator security role or equivalent permissions in Microsoft
Dynamics 365.
Check your security role
Follow the steps in View your user profile.
Don’t have the correct permissions? Contact your system administrator.
2. Go to Settings > Business Management.
3. Click Currencies.
4. Click New.
5. Fill in the information, as required.
FIELD

DESCRIPTION

Currency Type

- System - Select this option if you want to use the
currencies available in Dynamics 365. To search for a
currency, click the Lookup button
next to Currency
Code. When you select a currency code, Currency Name
and Currency Symbol are automatically added for the
selected currency.
- Custom - Select this option if you want to add a
currency that's not available in Dynamics 365. In this case,
you must manually enter the values for Currency Code,
Currency Precision, Currency Name, Currency
Symbol, and Currency Conversion.

Currency Code

Short form for the currency. For example, USD for United
States Dollar.

Currency Precision

Type the number of decimals that you want to use for the
currency. You can add a value between 0 and 4. Note: If
you’ve set a precision value in the System Settings dialog
box, that value will appear here. More information: System
Settings dialog box - General tab.

FIELD

DESCRIPTION

Currency Name

If you selected a currency code from the list of available
currencies in Dynamics 365, the currency name for the
selected code is displayed here. If you selected Custom as
the currency type, type the name of the currency.

Currency Symbol

If you selected a currency code from the list of available
currencies, the symbol for the selected currency is
displayed here. If you selected Custom as the currency
type, enter the symbol for the new currency.

Currency Conversion

Type the value of the selected currency in terms of one US
dollar. This is the amount at which the selected currency
converts to the base currency. Important: Make sure you
update this value as frequently as required to avoid any
inaccurate calculations in your transactions.

6. When you’re done, on the command bar, click Save or Save and Close.
TIP
To edit a currency, click the currency, and then enter or select the new values.

Delete a currency
1. Click Settings > Business Management.
2. Click Currencies.
3. From the list of currencies displayed, select the currency to delete.
4. Click Delete .
5. Confirm the deletion.
IMPORTANT
You can’t delete currencies that are in use by other records; you can only deactivate them. Deactivating currency records
doesn’t remove the currency information stored in existing records, such as opportunities or orders. However, you won’t be
able to select the deactivated currency for new transactions.

See also
System Settings dialog box - General tab

Regional and language options for your organization
8/24/2018 • 3 minutes to read • Edit Online

Applies to Dynamics 365 (online), version 9.x
Applies to Dynamics 365 (online), version 8.x
Enable languages in your organization to display the user interface and Help in a language that’s different from the
base language.
IMPORTANT
If you’re running Dynamics 365 for Outlook, you must download one or more Language Packs before you can enable
additional languages.

The following table shows tasks that are associated with changing regional and language options for your
organization.
TASK

DESCRIPTION

Set the base language

The base language determines default settings for regional
and language options in Dynamics 365. After the base
language is set, you can’t change it.

Enable or disable languages

You can enable or disable available languages in the Settings
area.

Add and remove currencies

Similar to setting the base language, you select your
organization's base currency during the purchasing process for
a subscription to Dynamics 365. After the base currency is set,
you can’t change it.
However, if your organization uses more than one currency to
track financial transactions, you can add currencies.

Deactivate or activate currency records

You can’t delete currency records that are being used by other
records, such as opportunities or invoices. However, you can
deactivate currency records so they won’t be available for
future transactions.

Enable the language
Before users can start using a Language Pack to display a language, the Language Pack must be enabled in your
Dynamics 365 organization.
1. Start the Dynamics 365 web application. You’ll need a System Administrator security role or equivalent
privileges for the Dynamics 365 organization that you want to provision a Language Pack for.
2. Go to Settings > Administration.
3. Click Languages to open the Language Settings dialog box. Here you’ll see each Language Pack installed
in your Dynamics 365 deployment, with a check box to the left of each listed Language Pack
4. For each Language Pack that you want to provision (enable), select the check box next to it. For each

Language Pack that you want to unprovision (disable), clear the check box.
5. Click Apply.
6. Click OK on any confirmation dialog boxes that open.
NOTE
It may take several minutes for Dynamics 365 to provision or unprovision the languages.

7. To close the Language Settings dialog box, click Close.
Repeat the previous steps for each organization in your Dynamics 365 deployment.

Select the language to display the user interface and Help
Each user selects the language to display in both the Dynamics 365 web client and Dynamics 365 for Outlook
applications.
IMPORTANT
For Microsoft Dynamics 365 for Outlook, you must download and install the Language Packs before you can select them.

1. Sign in to Dynamics 365 and open the Set Personal Options page, as follows:
If you’re using the Dynamics 365 web client, click the Settings button

, and then click Options.

If you are using Dynamics 365 for Outlook, on the top menu bar, choose Dynamics 365, and then
click Options.
2. Choose the Languages tab.
3. In the User Interface Language list, select the language in which you want to display Dynamics 365.
4. In the Help Language list, select the language in which you want to display Microsoft Dynamics 365 Help.
5. To save your changes and close the dialog box, click OK.
NOTE
In Dynamics 365 for Outlook, the user language settings only apply to Dynamics 365 for Outlook features, such as the user
interface display of the Dynamics 365 menu, and don’t affect other areas of Office Outlook. To display all of the Dynamics
365 for Outlook user interface or Help in multiple languages, you need to install one or more Microsoft OfficeLanguage
Packs. More information: Office 2013 Language Options.

Administrator Guide (Dynamics 365 Customer Engagement) | MicrosoftDocs For Dynamics Engagement

Navigation menu

Versions of this User Manual:

Views

Navigation