Create users and assign Microsoft Dynamics CRM Online security roles

Applies To: CRM Online

[This topic is pre-release documentation and is subject to change in future releases.]

You use the Office 365 admin center to create user accounts for every user who needs access to CRM Online. The user account registers the user with Microsoft Online Services environment. In addition to registration with the online service, the user account must be assigned a license in order for the user to have access to the service. Note that when you assign a user the global administrator or the service administrator role in the Microsoft Online Services environment, it automatically assigns the user the System Administrator security role in Microsoft Dynamics CRM. More information: Differences between the Microsoft online services environment administrative roles and CRM Online security roles

In This Topic

Create a user account

Add a license to a user account

Assign a security role to a user

(Optional) Assign an administrator role

Enable or disable users

Create a non-interactive user account

Create a user account

When you create a user account in the Office 365 admin center, the system generates a user ID and temporary password for the user. You have the option to let the service send an email message to the user as clear text. Although the password is temporary, you may consider copying the information to send to the user through a more secure channel, such as from an email service that can digitally encrypt the contents. For step-by-step instructions for creating a Microsoft Online Services user account, see Create or edit users in Office 365.

Add a license to a user account

You can license the user when you create the user account, or you can license the user later. You must assign a license to every user account that you want to access the online service.

For step-by-step instructions, see Assign, reassign, or remove licenses.

About user licenses

• Microsoft Dynamics CRM Online uses user licenses to provide access to your organization. You need one user license per person with an active user record who logs into your organization.

• When you add a new person, the Create new user account form displays the number of user licenses available. If you reach your limit, the Create button is no longer available. You can add additional licenses by choosing Purchase Services from the left-side menu in the Office 365 admin center.

• An unaccepted invitation requires a user license until the invitation expires two weeks after it was issued.

• If you have more user licenses than you are using, contact support to reduce the number of licenses. You cannot reduce the number of licenses to less than you are currently using or less than your offer allows. Any changes are reflected in your next billing cycle.

• Each user license requires a unique Microsoft account, and every user who logs on to Microsoft Dynamics CRM needs a license. Most CRM subscriptions include a specific number of user licenses.

Assign a security role to a user

Security roles control a user’s access to data through a set of access levels and permissions. The combination of access levels and permissions that are included in a specific security role sets limits on the user’s view of data and on the user’s interactions with that data.

Microsoft Dynamics CRM Online provides a default set of security roles. If necessary for your organization, you can create new security roles by editing one of the default security roles and then saving it under a new name.

You can assign more than one security role to a user. The effect of multiple security roles is cumulative, which means that the user has the permissions associated with all security roles assigned to the user.

Security roles are associated with business units. If you have created business units, only those security roles associated with the business unit are available for the users in the business unit. You can use this feature to limit data access to only data owned by the business unit.

For more information about the difference between Microsoft Online Services administrator roles and CRM Online security roles, see Grant users access to Microsoft Dynamics CRM Online as a Microsoft Online service.

In CRM Online:

1. Go to Settings > Security. (How do I get there?)

2. Choose Security > Users.

3. In the list, select the user or users that you want to assign a security role to.

4. Choose Manage Roles.

   Only the security roles available for that user's business unit are displayed.

5. In the Manage User Roles dialog box, select the security role or roles you want for the user or users, and then choose OK.

(Optional) Assign an administrator role

You can share Microsoft Online Services environment administration tasks among several people by assigning Microsoft Online Services environment administrator roles to users you select to fill each role. You might decide to assign the global administrator role to a second person in your organization for times when you are not available.

There are five Microsoft Online Services environment administrator roles with varying levels of permissions. For example, the password reset administrator role can reset user passwords only; the user management administrator role can reset user passwords as well as add, edit, or delete user accounts; and the global administrator role can add online service subscriptions for the organization and can manage all aspects of subscriptions. For detailed information about Microsoft Online Services administrator roles, see Assigning Admin Roles.

Enable or disable users

To enable a user, assign a license to the user and add a user to the security group that is associated with an instance of CRM Online. If you enable a user that was disabled, you must send a new invitation for the user to access the system.

To disable a user, remove a license from the user or remove the user from the security group that is associated with an instance of CRM Online. Removing a user from the security group doesn’t remove the user’s license. If you want to make the license available to another user, you have to remove the license from the disabled user.

You must be a member of an appropriate administrator role to do these tasks. More information: Assigning Admin Roles

Enable a user by assigning a license to the user and adding a user to the security group

1. Browse to the Office 365 admin center and sign in.

2. Choose Users > Active users and select the user.

3. In the right-side menu, under Assigned license, choose Edit.

4. In Assign Licenses, check the Microsoft Dynamics CRM Online check box. Choose Save.

5. In the Office 365 admin center, choose Groups.

6. Choose the security group that is associated with your CRM Online organization.

7. In the right-side menu, under Security group, choose Edit Members.

8. Choose Add Member, enter and select the names of members to add to the security group, and then choose Add.

   To add multiple users, see: bulk add users to Office365 groups.

Disable a user by removing a license from the user

1. In the Office 365 admin center, choose Users > Active Users and select a user.

2. In the right-side menu, under Assigned License, choose Edit.

3. Clear the Microsoft Dynamics CRM Online check box, and then choose Save.

Disable a user by removing the user from the security group that is associated with an instance of CRM Online

1. In the Office 365 admin center, choose Groups.

2. Choose the security group that is associated with your CRM Online organization.

3. In the right-side menu, under Security group, choose Edit Members.

4. Select members to remove from the security group, and then choose Remove From Group.

Create a non-interactive user account

The non-interactive user is not a ‘user’ in the typical sense – it is not a person but an access mode that is created with a user account. It is used for programmatic access to and from CRM between applications. A non-interactive user account lets these applications or tools, such as a CRM to ERP connector, authenticate and access Microsoft Dynamics CRM Online, without requiring a Microsoft Dynamics CRM Online license. For each instance of Microsoft Dynamics CRM Online, you can create up to five non-interactive user accounts.

You need to have the System Administrator security role or equivalent permissions in Microsoft Dynamics CRM to create a non-interactive user. First, you’ll create a user account in Office 365 and then in Microsoft Dynamics CRM Online, select the non-interactive access mode for the account.

1. Create a user account in the Office 365 admin center.

   Be sure to assign a CRM Online license to the account.

2. Go to CRM Online.

3. Go to Settings > Security. (How do I get there?)

4. Choose Users > Enabled Users, and then click or tap a user’s full name.

5. In the user form, scroll down to the Client Access License (CAL) Information section and select Non-interactive for Access Mode.

   You then need to remove the CRM Online license from the account.

6. Go to the Office 365 admin center.

7. Select Users > Active Users.

8. Choose the non-interactive user account and in the right-side menu under Assigned license, choose Edit.

9. Clear the box for the CRM Online license and choose Save.

10. Go back to CRM Online and confirm that the non-interactive user account Access Mode is still set for Non-interactive.

See Also

Concepts

Manage subscriptions, licenses, and user accounts
Manage Microsoft Dynamics CRM Online licenses
Add an instance to your subscription

Other Resources

Control data access
Assigning Admin Roles

Send comments about this topic to Microsoft.
© 2015 Microsoft. All rights reserved.