Skip to main content

Dynamics 365 Client Credentials

tip

Dynamics 365 Client Credentials is no longer available when selecting Add Application on the Managed SaaS Applications page. Use instead the Microsoft 365, Microsoft 365 Certificate Based Authentication, or Microsoft 365 Client Credentials integration to view your organization’s Office 365 Client Credentials, Dynamics 365 Client Credentials, Power BI Client Credentials, Project Client Credentials, and Visio Client Credentials license usage data. To deactivate an existing integration, see Avoiding Duplicate Microsoft 365 Client Credentials Licenses between SaaS Management and IT Asset Management.

Dynamics 365 is an Enterprise Resource Planning (ERP) software that connects and manages an entire business, from financial and supply chain management and from manufacturing to operations.

info

This Dynamics 365 integration requires the authentication method OAuth2 with client credentials.

The following sections explain prerequisites, resources, and instructions for integrating with SaaS Management.

Stored Dynamics 365 Client Credentials Information​

The following table describes the available integration tasks and stored data within SaaS Management.

Available Integration TasksInformation Stored
Application RosterUser ID (User Principal Name)
Email
First Name
Last Name
Active Date
Application AccessUser ID (User Principal Name)
Occurred Time
note

The information stored is subject to change as enhancements are made to the SaaS application.

Required Minimum Permissions for Dynamics 365 Client Credentials​

The minimum API required permissions are based on the Required Application Permissions for Dynamics 365 Client Credentials and the Required User Role for Dynamics 365 Client Credentials.

Required Application Permissions for Dynamics 365 Client Credentials​

Application PermissionDescriptionIntegration Task Name
Directory.Read.AllEnables you to read the list of users in your Microsoft account.Application Roster
AuditLog.Read.AllEnables you to read the audit log details in your Microsoft account.Application Access

Required User Role for Dynamics 365 Client Credentials​

note

The following SaaS application user role is not applicable to Flexera One roles.

User RoleDescription
Global AdministratorTo grant the application permissions, the user must have Global Administrator access. For more information, see Microsoft’s documentation topic, Microsoft Entra Built-In Roles.
note

To fetch Dynamics 365 sign-in events:

  • You must have an Azure AD Premium P1 or Premium P2 license assigned per tenant. For more information, see Microsoft’s documentation topic, Microsoft Entra Plans & Pricing.

  • You must ensure the Office 365 audit log is turned on. For more information, see Microsoft’s documentation topic, Turn Auditing On or Off.

Dynamics 365 Client Credentials Authentication Method​

The required authentication method is OAuth 2.0 With Client Credentials. For more information, see Microsoft’s documentation topic, Microsoft Identity Platform and the OAuth 2.0 Client Credentials Flow.

Required Credentials for Dynamics 365 Client Credentials​

The following credentials are required:

  • Client ID

  • Client Secret

  • Tenant ID.

Obtaining Client Credentials and Tenant ID for Dynamics 365 Client Credentials​

Before Integrating Dynamics 365 Client Credentials With SaaS Management, you need to obtain the client credentials and tenant ID from your Microsoft account by completing the following steps.

  1. Sign in to your Microsoft Azure Portal.
  2. In the Search box at the top of the page, enter App registrations and click App registrations in the search results to select it. The App registrations page opens.
  3. Click New Registration. The Register an application page opens.
  4. Enter a Name and choose the Accounts in this organizational directory only option.
  5. Click Register.
  6. On the Overview tab, copy and paste the Application (client) ID and Directory (tenant) ID values to a file you can access later. You will need these values in Integrating Dynamics 365 Client Credentials With SaaS Management.
  7. To generate a Client secret, do the following:
    1. Click the Certificates & secrets tab.
    2. Under Client secrets, click New client secret. The Add a client secret dialog box opens.
    3. In the Description field, enter a name for the new secret.
    4. Under Expires, choose an expiration value.
    5. Click Add.
    6. Under Client secrets, copy and paste the client secret value to a file. You will need this value in Integrating Dynamics 365 Client Credentials With SaaS Management.
  8. Click the API permissions tab and do the following:
    1. Click Microsoft Graph. The Request API permissions panel opens.
    2. Click Application permissions.
      note

      Do not select Delegated permissions. Delegated permissions will not work.

    3. In the Select permissions search box, enter AuditLog and then click the arrow to expand AuditLog, and select the AuditLog.Read.All permission checkbox.
    4. In the Select permissions search box, enter Directory and then click the arrow to expand Directory, and select the Directory.Read.All permission checkbox.
    5. Click Update permissions.
  9. After the permissions are added, grant admin consent.
  10. Continue to Data Anonymization for Dynamics 365 Client Credentials.

Data Anonymization for Dynamics 365 Client Credentials​

Data anonymization is the processing technique that removes or modifies identifiable information. After the process is complete, data cannot be associated with a specific user. It helps protect private and sensitive data as well as private activities while maintaining its integrity.

info

Before Integrating Dynamics 365 Client Credentials With SaaS Management, you must complete the following task to ensure that anonymized users are not imported from Dynamics 365 Client Credentials into SaaS Management. You will need to access reports that provide information about your organization’s use of applications and services.

Ensure that data anonymization is disabled in your Microsoft account. Otherwise, all activity data will end up in Suspicious SaaS Activities. For more information, see Microsoft’s documentation topic, Microsoft 365 Reports Show Anonymous User Names Instead of Actual User Names. If anonymized user data has been imported after integrating Azure with SaaS Management, submit a Flexera Support Case.

To view reports with anonymized user data:

  1. Sign in to the Microsoft 365 Portal Admin Center.
  2. In the menu, go to Settings > Org settings and click the Services link at the top.
  3. Scroll down and click Reports.
  4. In the window that is displayed, clear the Display concealed user, group, and site names in all reports box.
  5. Proceed to Integrating Dynamics 365 Client Credentials With SaaS Management.

Integrating Dynamics 365 Client Credentials With SaaS Management​

note

If you are using both a stand alone Dynamics 365 Client Credentials license and an Office 365 enterprise package license, SaaS Management is not able to differentiate user activities between the two licenses due to the Microsoft Graph API limitations. As a result, Office 365 activities display as Suspicious Activities.

Complete the following steps to integrate Dynamics 365 Client Credentials with SaaS Management.

  1. Complete the steps in the prerequisite sections:

  2. Add the Dynamics 365 Client Credentials application in SaaS Management. For more information, see Adding an Application.

  3. In the Add Application page for Dynamics 365 Client Credentials:

    1. Select the Application Roster and Application Access checkboxes located under Integration Tasks.
    2. Copy and paste the values for Client ID, Client Secret, and Tenant ID from Obtaining Client Credentials and Tenant ID for Dynamics 365 Client Credentials into SaaS Management.
    3. Click Authorize.
      note

      All blocked users will be displayed as normal users in SaaS Management.

Dynamics 365 Client Credentials API Endpoints​

Application Roster​

https://graph.microsoft.com/v1.0/users

Application Access​

https://graph.microsoft.com/v1.0/auditLogs/signIns