Microsoft Dynamics 365
Connect Microsoft Dynamics 365 to Safeguard: what it provides, how to set it up, and the frameworks it provides evidence for.
Connect Microsoft Dynamics 365 to collect crm evidence with automated compliance tests, switched on per workspace.
| Category | CRM |
| Connect with | API token |
| What a connection produces | Automated compliance tests |
| Microsoft Dynamics 365's guide | learn.microsoft.com |
Connect with an API token
-
In Microsoft Dynamics 365:
- Register an application in Microsoft Entra ID (Microsoft Entra admin center › App registrations) for Safeguard.
- In App registrations, select the app, then Certificates & secrets › Client secrets › New client secret. Add a description, select an expiration (24 months at most; Microsoft recommends under 12), and select Add. Record the secret Value now; it is never displayed again after you leave the page.
- Sign in to the Power Platform admin center (admin.powerplatform.microsoft.com), select Manage, then Environments, and select the Dynamics 365 environment.
- Select Settings › Users + permissions › Application users, then + New app user.
- Select + Add an app, choose the Entra app registration, and select Add. Under Business Unit, select a business unit from the dropdown list, then enter an Email address.
- Select the edit icon to select security roles for the new application user, select Save, confirm the role assignment with Save, then select Create.
Where to find the other values:
- Instance URL: The environment URL of your Dynamics 365 organization (https://<org>.crm.dynamics.com or your regional equivalent), the host you open Dynamics 365 apps on.
Microsoft Dynamics 365 shows the secret only once, so copy it before you leave the page.
Microsoft Dynamics 365's public documentation does not cover every step.
The access token comes from an API call (client credentials) and expires after about an hour, so a pasted token goes stale; client-credential support would be more durable. Creating a custom security role with prvReadUser and prvReadRole was not covered by the fetched pages. one_time_display refers to the Entra client secret. Microsoft recommends certificates over client secrets in production. Verification removed the prvReadUser/prvReadRole role names, the root business unit choice and the token-request step because the fetched pages do not support them.
Source: learn.microsoft.com, learn.microsoft.com, checked 2026-10-07.
The permissions Safeguard needs:
prvReadUser,prvReadRole. Safeguard's compliance tests for Microsoft Dynamics 365 need the credential on the API token tab: an OAuth connection cannot read everything they check. -
On Compliance › Connectors, open Microsoft Dynamics 365, click Connect, choose API token and fill in:
Field What to enter Instance URL Required. For example: https://acme.crm.dynamics.com Access token Required. Stored encrypted and never shown again. -
Click Connect with token.
Frameworks
Safeguard's automated tests read Microsoft Dynamics 365 and map to the controls below. When a test passes, the result is evidence toward each control it maps to, in every framework listed. It is evidence toward a control, not proof that the control is met on its own.
| Framework | Evidence | Controls | Tests |
|---|---|---|---|
| SOC2 | Automated tests | CC6.2, CC6.3 | 3 |
| ISO/IEC 27001 | Automated tests | A.5.16, A.5.18, A.6.5, A.8.2 | 3 |
| HIPAA Security Rule | Automated tests | 164.308(a)(3), 164.308(a)(4) | 3 |
| PCI DSS | Automated tests | 7.2.2, 7.2.4, 8.2.5 | 3 |
| NIST CSF 2.0 | Automated tests | PR.AA-01, PR.AA-05 | 3 |
These tests are switched on per workspace by the Safeguard team.
Related
- CRM connectors
- Compliance connectors: how connecting works, card statuses and multiple accounts
- Connector setup reference: every connector in one table
- Frameworks and connectors: how connectors provide evidence for frameworks