> For the complete documentation index, see [llms.txt](https://docs.openiam.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.openiam.com/connector-configuration/microsoft/12-dynamics365fo.md).

# Dynamics365 Finance\&Operations connector

This page describes how to use the OpenIAM Dynamics 365 Finance & Operations connector

Dynamics365 Finance\&Operations connector integrates Dynamics365 Finance\&Operations environment with OpenIAM allowing to manage system users and security roles. This is the basic set of the functionality that goes out of the box. However, it could be extended and fit your needs.

Out of the box Dynamics365 connector can:

* Retrieve information about system user objects
* Retrieve information about system roles in Dynamics365 Finance\&Operations environment
* Retrieve information about memberships of a system users inside system roles
* Assign/revoke system roles from system users
* Set and modify basic system user information

| Operation                | Supported                                                                   |
| ------------------------ | --------------------------------------------------------------------------- |
| Create / update (Save)   | ✅                                                                           |
| Search                   | ✅                                                                           |
| Suspend / resume         | ✅ — writes the `Enabled` property                                           |
| Delete                   | ✅ — removes the user from Dynamics 365 F\&O                                 |
| Reset password           | ❌ — refused: the account is Azure-linked, so its password lives in Entra ID |
| Check a password (Login) | ❌ — returns a failure result, for the same reason                           |
| Validate a password      | ❌ — the connector has no case for it and refuses the request                |
| Test connection          | ❌ — see the note below                                                      |

## Use cases

* **Provisioning system users into Finance & Operations** with the security roles their job requires.
* **Keeping role assignment in step** as people move between functions, which in F\&O is what access amounts to.
* **Deactivating leavers** by writing the `Enabled` property, and removing the user when the retention period ends.
* **Reading users and security roles back into OpenIAM** for reconciliation and certification.

## Versions and compatibility

The connector talks to the Dynamics 365 Finance & Operations Web API over HTTP, so there is no product version to match on its side. It builds the endpoint from the **Host URL** on the managed system with `/data/` appended — note that this differs from the Dynamics 365 customer-engagement connector, which uses a versioned `api/data/v9.2/` path.

## Prerequisites

* The connector host can reach your Dynamics 365 Finance & Operations tenant address.
* An application registration whose **client ID**, **tenant ID** and **client secret** the connector can use.

## Installing the connector

All PowerShell connectors are installed in the same way, which is described in the document: [PowerShell connector installation](/connector-configuration/microsoft/1-powershellconnectorinstallation.md)

Only requirement specific to this connector is being able to connect to your Dynamics365 Finance\&Operations tenant address.

## Starting, stopping, and restarting

The installer registers a pair of Windows services named after the connector name you supply. See [Installing PowerShell connectors](/connector-configuration/microsoft/1-powershellconnectorinstallation.md#starting-stopping-and-restarting).

## Command-line parameters and properties

All PowerShell connectors are used in the same way, which is described in the document: [PowerShell connector usage](/connector-configuration/microsoft/2-powershellconnectorsusage.md)

Queues, concurrency, logging and simulation mode all live in `Connector.config`, documented for the whole family in [Using PowerShell connectors](/connector-configuration/microsoft/2-powershellconnectorsusage.md#working-with-the-connector-configuration).

## Verifying the connector is running

{% stepper %}
{% step %}
Confirm the connector's Windows services are running on the host.
{% endstep %}

{% step %}
Check the connector's request queue in RabbitMQ has a consumer.
{% endstep %}

{% step %}
Run a search — `Get-SecurityRoles` is a cheap one — to prove the path end to end.
{% endstep %}
{% endstepper %}

{% hint style="warning" %}
This connector does not support **Test Connection** — it refuses the request rather than answering it. OpenIAM's periodic health check against the managed system therefore fails permanently until you set `DisableManSysHealthcheckRequests` to `True` in the connector's `Connector.config`. The installer also offers this as the end-to-end managed system check, which you can leave unticked.
{% endhint %}

## Troubleshooting

Troubleshooting for the whole family, including where the logs are and how to replay a request, is in [Using PowerShell connectors](/connector-configuration/microsoft/2-powershellconnectorsusage.md). What is specific to this connector:

| Symptom                                                              | Likely cause                                                                                                                                                | Resolution                                       |
| -------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------ |
| The managed system is permanently unhealthy although operations work | Test Connection is not supported — see the note above                                                                                                       | Set `DisableManSysHealthcheckRequests` to `True` |
| Reset password or login is refused                                   | Neither is possible here. The account is Azure-linked, so its password lives in Entra ID                                                                    | Change the password in Entra ID                  |
| Every request fails on the endpoint                                  | The **Host URL** is missing the `operations` subdomain that a Finance & Operations tenant carries. The connector appends `/data/` to whatever is configured | Add the `operations` subdomain to the Host URL   |

## Registering the connector in OpenIAM

The connector's request queue name in OpenIAM has to match the queue in the connector's own `Connector.config` exactly. Getting the connection parameters out of OpenIAM and into the installer is covered in [Installing PowerShell connectors](/connector-configuration/microsoft/1-powershellconnectorinstallation.md#getting-connection-parameters-with-openiam).

## Configuring the managed system

While configuring managed system you should have following properties set:

* Host URL - your resource address, for example `https://your-company.sandbox.operations.dynamics.com/`. The connector appends `/data/` to it to reach the API
* Login Id - uses format client\_id\@tenant\_id that is used to access your API
* Password - should be set to client\_secret value.

### Custom handlers

Search, delete, password, suspend and resume can each be routed to a script of your own instead of the connector's built-in path, by setting `searchHandler`, `deleteHandler`, `passwordHandler`, `suspendHandler` or `resumeHandler` on the managed system. Note the spelling: this connector uses camel case for these names, where most of the family uses `SEARCH_HANDLER` and the like.

A handler takes over that operation entirely, and `passwordHandler` is the only way to make reset password or login do anything here, since the connector's own versions refuse them. Validating a password has no handler hook at all.

## Attribute mapping and policy map

To be able to run provisioning requests to Dynamics365 F\&O API, you need to configure policy map.

| Property           | Description                                                                                                                                                                  | Required                         |
| ------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------- |
| UserID             | Unique identifier of system user in Dynamics365 F\&O. Please keep in mind that if we create a user - we can give our own UserID value, so we could track this user in future | Yes                              |
| UserName           | Username of this user.                                                                                                                                                       | Yes (required for creating user) |
| NetworkDomain      | Should uniquely identify network domain for the user. Can be set like "<https://sts.windows.net/>".                                                                          | Yes (required for creating user) |
| Alias              | Sets alias parameter of the system user. Usually it is the same as user email address or UPN in Azure                                                                        | Yes (required for creating user) |
| UserInfo\_language | Info language in culture format like 'en-us'                                                                                                                                 | Yes (required for creating user) |
| Helplanguage       | Help language in culture format like 'en-us'                                                                                                                                 | Yes (required for creating user) |
| AccountType        | Could be either Claims user, Claims Group, AD Group, AD User. By default - `ClaimsUser`. Claims\* - are Azure objects, while AD\* are belong to on-premises Active Directory | Yes (required for creating user) |
| Company            | String that contains company information of the user.                                                                                                                        | No                               |
| Email              | Email address of the user.                                                                                                                                                   | No                               |
| PersonName         | Name of the person, which is usually equal to UserName.                                                                                                                      | No                               |
| Enabled            | Specifies if user is enabled (True) or Disabled (False)                                                                                                                      | No                               |

### Add vs Update operations difference

Due to Dynamics365 limitations, not every attribute can be set during the update process. Some attributes are only allowed when you add a new user. If attribute that is not allowed for update operation is passed - OpenIAM connector would ignore it.

**Attributes allowed for ADD operation:** `UserID`,`Company`,`Alias`,`Email`,`PersonName`,`Enabled`,`UserName`,`NetworkDomain`,`UserInfo_language`,`Helplanguage`,`AccountType`

**Attributes allowed for UPDATE operation:** `UserID`,`Company`,`Alias`,`Email`,`PersonName`,`Enabled`,`UserName`,`UserInfo_language`,`Helplanguage`

### Suspend and resume operations

When OpenIAM sends Suspend operation, connector modifies `Enabled` property of a given user. Resume operation sets the same property back to `True` state.

### Deleting users

Delete operation fully removes user from D365 F\&O system.

## Reconciliation and synchronization

Dynamics365 F\&O connector can synchronize System users, system roles and their memberships. It can synchronize all of them or a single record by a given identifier.

Search query for synchronizing all systemusers:

```powershell
Get-SystemUser
```

Search query for synchronizing single systemuser:

```powershell
Get-SystemUser -Systemuserid 'e5f759c2-cde2-4396-a153-53a53d2cf172'
```

Search query for synchronizing all roles:

```powershell
Get-SecurityRoles
```

Search query for synchronizing single role:

```powershell
Get-SecurityRoles -RoleID 'e5f759c2-cde2-4396-a153-53a53d2cf172'
```

Search query for synchronizing all memberships of the system users towards system roles:

```powershell
Get-SecurityUserRoles
```


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.openiam.com/connector-configuration/microsoft/12-dynamics365fo.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.