> ## Documentation Index
> Fetch the complete documentation index at: https://www.c1.ai/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Set up a Microsoft Dynamics 365 - Finance & Operations connector

> C1 provides identity governance and just-in-time provisioning for Microsoft Dynamics 365 - Finance & Operations. Integrate your Microsoft Dynamics 365 - Finance & Operations instance with C1 to run user access reviews (UARs) and enable just-in-time access requests.

<Warning>
  **This connector is in beta.** This means it's undergoing ongoing testing and development while we gather feedback, validate functionality, and improve stability. Beta connectors are generally stable, but they may have limited feature support, incomplete error handling, or occasional issues.

  We recommend closely monitoring workflows that use this connector and contacting our Support team with any issues or feedback.
</Warning>

## Capabilities

| Resource | Sync                                                          | Provision                                                     |
| :------- | :------------------------------------------------------------ | :------------------------------------------------------------ |
| Accounts | <Icon icon="square-check" iconType="solid" color="#c937ae" /> | <Icon icon="square-check" iconType="solid" color="#c937ae" /> |
| Roles    | <Icon icon="square-check" iconType="solid" color="#c937ae" /> | <Icon icon="square-check" iconType="solid" color="#c937ae" /> |

The Microsoft Dynamics 365 - Finance & Operations connector supports [automatic account provisioning](/product/admin/account-provisioning). The user for whom a new account is provisioned must have an existing Entra account with a valid license.

This connector does not support full account deprovisioning. You can disable accounts using a connector action, but you must deprovision accounts directly in Microsoft Dynamics 365 - Finance & Operations.

### Connector actions

Connector actions are custom capabilities that extend C1 automations with app-specific operations. You can use connector actions in the [Perform connector action](/product/admin/automations-steps-reference#perform-connector-action) automation step.

| Action name   | Additional fields            | Description                                                                   |
| ------------- | ---------------------------- | ----------------------------------------------------------------------------- |
| enable\_user  | `user_id` (string, required) | Enables a disabled Microsoft Dynamics 365 - Finance & Operations user account |
| disable\_user | `user_id` (string, required) | Disables an active Microsoft Dynamics 365 - Finance & Operations user account |

## Gather Microsoft Dynamics 365 - Finance & Operations credentials

Configuring the connector requires you to pass in credentials generated in Microsoft Dynamics 365 - Finance & Operations. Gather these credentials before you move on.

<Warning>
  A user who is an **Application Administrator** (or similar admin role) in Microsoft Entra ID and a **System Administrator** in Microsoft Dynamics 365 - Finance & Operations must perform this task.
</Warning>

### Look up your Microsoft Dynamics 365 - Finance & Operations environment URL

<Steps>
  <Step>
    Log into the [Power Platform Admin Center](https://admin.powerplatform.microsoft.com).
  </Step>

  <Step>
    On the left side of the screen, click **Manage** > **Environments**.
  </Step>

  <Step>
    Click the name of the environment you want to integrate with C1.
  </Step>

  <Step>
    On the environment's details page, carefully copy and save the URL of the environment.
  </Step>
</Steps>

### Create a new Entra application

<Steps>
  <Step>
    In the Entra ID admin center, navigate to **App registrations**.
  </Step>

  <Step>
    Click **+ New registration**.
  </Step>

  <Step>
    Give the application a name, such as "C1", and select the supported account type relevant to your Entra installation (typically **Accounts in this organizational directory only (Default Directory only - Single tenant)**). You do not need to set a redirect URL.
  </Step>

  <Step>
    Click **Register**.
  </Step>

  <Step>
    The new app is created. Carefully copy and save the **Application (client) ID** and the **Directory (tenant) ID** shown on the application summary page.
  </Step>
</Steps>

### Give the new Entra app API permissions

<Steps>
  <Step>
    Click **API permissions**.
  </Step>

  <Step>
    Click **+ Add permissions** and click the **APIs my organization uses** tab.
  </Step>

  <Step>
    Search for "Dynamics ERP".
  </Step>

  <Step>
    Give the app all three available permissions:

    * AX.FullAccess
    * CustomService.FullAccess
    * Odata.FullAccess
  </Step>

  <Step>
    Click **Add permissions**.
  </Step>

  <Step>
    Navigate to **Identity** > **Applications** > **Enterprise applications** > **All applications**.
  </Step>

  <Step>
    4. Click **Grant admin consent for ...** at the top of the permissions list, and confirm your action.
  </Step>
</Steps>

### Create a client secret

<Steps>
  <Step>
    Next, we'll generate a client secret for your app. Navigate to the app and click **Certificates & secrets**.
  </Step>

  <Step>
    Click **+ New client secret**.
  </Step>

  <Step>
    Give the client secret a description and set its expiration.
  </Step>

  <Step>
    Click **Add**.
  </Step>

  <Step>
    The client secret is shown in the **VALUE** field. Carefully copy and save the **Secret Value**.
  </Step>
</Steps>

### Link the new application to your Finance & Operations user

Make sure you have a Finance & Operations user with the **System administrator** role complete this task.

<Steps>
  <Step>
    Sign in to your Finance & Operations environment and navigate to **Microsoft Entra ID applications**.
  </Step>

  <Step>
    Add a new register to the table, filling in:

    * The app's client ID
    * Your user ID
    * A name that identifies this entry, such as "C1 integration"
  </Step>

  <Step>
    Click **OK**.
  </Step>
</Steps>

**Done.** Next, move on to the connector configuration instructions.

## Configure the Microsoft Dynamics 365 - Finance & Operations connector

<Warning>
  To complete this task, you'll need:

  * The **Connector Administrator** or **Super Administrator** role in C1
  * Access to the set of Microsoft Dynamics 365 - Finance & Operations credentials generated by following the instructions above
</Warning>

<Tabs>
  <Tab title="Cloud-hosted">
    **Follow these instructions to use a built-in, no-code connector hosted by C1.**

    <Steps>
      <Step>
        In C1, navigate to **Integrations** > **Connectors** and click **Add connector**.
      </Step>

      <Step>
        Search for **Microsoft Dynamics 365 - Finance & Operations** and click **Add**.
      </Step>

      <Step>
        Choose how to set up the new Microsoft Dynamics 365 - Finance & Operations connector:

        * Add the connector to a currently unmanaged app (select from the list of apps that were discovered in your identity, SSO, or federation provider that aren't yet managed with C1)

        * Add the connector to a managed app (select from the list of existing managed apps)

        * Create a new managed app
      </Step>

      <Step>
        Set the owner for this connector. You can manage the connector yourself, or choose someone else from the list of C1 users. Setting multiple owners is allowed.

        If you choose someone else, C1 will notify the new connector owner by email that their help is needed to complete the setup process.
      </Step>

      <Step>
        Click **Next**.
      </Step>

      <Step>
        Find the **Settings** area of the page and click **Edit**.
      </Step>

      <Step>
        Enter the Microsoft Dynamics 365 - Finance & Operations credentials into the relevant fields.
      </Step>

      <Step>
        **Optional.** If desired, click to enable **Sync only enabled role assignments**. When this option is enabled, C1 will ignore all roles that do not have the `enabled` status.
      </Step>

      <Step>
        Click **Save**.
      </Step>

      <Step>
        The connector's label changes to **Syncing**, followed by **Connected**. You can view the logs to ensure that information is syncing.
      </Step>
    </Steps>

    **Done.** Your Microsoft Dynamics 365 - Finance & Operations connector is now pulling access data into C1.
  </Tab>

  <Tab title="Self-hosted">
    **Follow these instructions to use the Microsoft Dynamics 365 - Finance & Operations connector, hosted and run in your own environment.**

    When running in service mode on Kubernetes, a self-hosted connector maintains an ongoing connection with C1, automatically syncing and uploading data at regular intervals. This data is immediately available in the C1 UI for access reviews and access requests.

    ### Resources

    [Contact C1's support team](mailto:support@c1.ai) to download the latest version of the connector.

    ### Step 1: Set up a new Microsoft Dynamics 365 - Finance & Operations connector

    <Steps>
      <Step>
        In C1, navigate to **Integrations** > **Connectors** > **Add connector**.
      </Step>

      <Step>
        Search for **Baton** and click **Add**.
      </Step>

      <Step>
        Choose how to set up the new Microsoft Dynamics 365 - Finance & Operations connector:

        * Add the connector to a currently unmanaged app (select from the list of apps that were discovered in your identity, SSO, or federation provider that aren't yet managed with C1)

        * Add the connector to a managed app (select from the list of existing managed apps)

        * Create a new managed app
      </Step>

      <Step>
        Set the owner for this connector. You can manage the connector yourself, or choose someone else from the list of C1 users. Setting multiple owners is allowed.

        If you choose someone else, C1 will notify the new connector owner by email that their help is needed to complete the setup process.
      </Step>

      <Step>
        Click **Next**.
      </Step>

      <Step>
        In the **Settings** area of the page, click **Edit**.
      </Step>

      <Step>
        Click **Rotate** to generate a new Client ID and Secret.

        Carefully copy and save these credentials. We'll use them in Step 2.
      </Step>
    </Steps>

    ### Step 2: Create Kubernetes configuration files

    Create two Kubernetes manifest files for your Microsoft Dynamics 365 - Finance & Operations connector deployment:

    #### Secrets configuration

    ```yaml expandable theme={"theme":{"light":"css-variables","dark":"css-variables"}}
    # baton-microsoft-dynamics-fo-secrets.yaml
    apiVersion: v1
    kind: Secret
    metadata:
      name: baton-microsoft-dynamics-fo-secrets
    type: Opaque
    stringData:
      # C1 credentials
      BATON_CLIENT_ID: <C1 client ID>
      BATON_CLIENT_SECRET: <C1 client secret>
      
      # Microsoft Dynamics 365 - Finance & Operations-specific credentials
      BATON_ENVIRONMENT_URL: <Environment URL of your Microsoft Dynamics 365 - Finance & Operations instance>
      BATON_DYNAMICS_CLIENT_ID: <Client ID of the Entra app created to authenticate with the Dataverse API>
      BATON_DYNAMICS_CLIENT_SECRET: <Client secret of the Entra app created to authenticate with the Dataverse API>
      BATON_TENANT_ID: <Tenant ID for your account>

      # Optional: include if you want C1 to provision access using this connector
      BATON_PROVISIONING: true

      # Optional: include if you only want C1 to sync enabled roles 
      BATON_SYNC_ONLY_ENABLED_ROLE_ASSIGNMENTS: true
    ```

    See the connector's README or run `--help` to see all available configuration flags and environment variables.

    #### Deployment configuration

    ```yaml expandable theme={"theme":{"light":"css-variables","dark":"css-variables"}}
    # baton-microsoft-dynamics-fo.yaml
    apiVersion: apps/v1
    kind: Deployment
    metadata:
      name: baton-microsoft-dynamics-fo
      labels:
        app: baton-microsoft-dynamics-fo
    spec:
      selector:
        matchLabels:
          app: baton-microsoft-dynamics-fo
      template:
        metadata:
          labels:
            app: baton-microsoft-dynamics-fo
            baton: true
            baton-app: microsoft-dynamics-fo
        spec:
          containers:
          - name: baton-microsoft-dynamics-fo
            image: ghcr.io/conductorone/baton-microsoft-dynamics-fo:latest
            imagePullPolicy: IfNotPresent
            env:
            - name: BATON_HOST_ID
              value: baton-microsoft-dynamics-fo
            envFrom:
            - secretRef:
                name: baton-microsoft-dynamics-fo-secrets
    ```

    ### Step 3: Deploy the connector

    <Steps>
      <Step>
        Create a namespace in which to run C1 connectors (if desired), then apply the secret config and deployment config files.
      </Step>

      <Step>
        Check that the connector data uploaded correctly. In C1, click **Apps**. On the **Managed apps** tab, locate and click the name of the application you added the Microsoft Dynamics 365 - Finance & Operations connector to. Microsoft Dynamics 365 - Finance & Operations data should be found on the **Entitlements** and **Accounts** tabs.
      </Step>
    </Steps>

    **Done.** Your Microsoft Dynamics 365 - Finance & Operations connector is now pulling access data into C1.
  </Tab>
</Tabs>