Scenario 5: Manage user account synchronization between Microsoft Dynamics CRM Online and Office 365
You add and manage your Microsoft Dynamics CRM Online users in the Microsoft Office 365 Admin Portal. If you attempt to add users in Microsoft Dynamics CRM Online, you’ll be redirected to the Microsoft Office 365 Admin Portal. Each time you add a user in Office 365 and license the user for Microsoft Dynamics CRM Online, the user is automatically created in Microsoft Dynamics CRM Online. You must then assign a security role in Microsoft Dynamics CRM Online for the user so the user can access your Microsoft Dynamics CRM organization.
For more information, see Manage Subscriptions, Licenses, and User Accounts.
Deciding on a synchronization approach
Early in your Office 365 and Microsoft Dynamics CRM Online deployment, you’ll need to make an important decision: “How will I manage users and credentials between my on-premises and online environments?” Consider the benefits and limitations of the three methods available to you in Office 365.
To see this page in your subscription:
On the Admin Overview page, under Setup, click Custom Plan.
Click Create a deployment plan.
Select either the Pilot or Deployment plan and then click Next.
Confirm Exchange is selected and then click Next.
Select We don’t have email or I don’t want to use my existing environment for this plan and then click Next.
This selection may not match your email environment. Make this choice to quickly get to the Users and credentials page.
Task 1: Consider synchronization with single sign-on (Existing users, same set of credentials)
Synchronization with single sign-on with Office 365 is covered in the following Office 365 content: Prepare for single sign-on.
The benefit of this approach is users in your organization can use corporate credentials to access the services in Office 365 that your company subscribes to such as Microsoft Dynamics CRM Online. Users sign in once and don’t have to sign in again to access a different service. An additional benefit - there’s a single password to manage.
This approach requires careful planning for redundancy and failover. Authentication for any Office 365 service is done with on-premises Active Directory Federation Services (AD FS) 2.0. Should any part of the AD FS authentication flow be down (for example, a server is shutdown or a trenching tool cuts your Internet connection), both on-premises and off-premises users will be unable to access the federated services. No Office 365 and Microsoft Dynamics CRM Online access even for users who have an Internet connection such as remote users. This is because access to cloud-based Office 365 and Microsoft Dynamics CRM Online must authenticate through the on-premises AD FS server.
The infrastructure needed to deploy synchronization with single sign-on can be complex and requires multiple servers. Therefore, this approach may be more suited to enterprise deployments with a large number of users. For planning guidance, see Plan for and deploy AD FS 2.0 for use with single sign-on.
A sample deployment using federation server proxies.
Task 2: Consider synchronization with Active Directory synchronization (Existing users, two sets of credentials)
Synchronization with Active Directory synchronization and Office 365 is covered in the following Office 365 content: Active Directory synchronization: Roadmap.
Active Directory synchronization (also referred to as DirSync) sets up a one-way synchronization relationship between your on-premises Active Directory server and Office 365.
Synchronization is from on-premises to Office 365 and occurs every 3 hours.
New user, group, and contact objects that are added to on-premises are added to Office 365 and Microsoft Dynamics CRM Online.
Existing user, group, and contact objects that are deleted from on-premises are deleted from Office 365 and Microsoft Dynamics CRM Online.
Existing user objects that are disabled from on-premises are disabled from Office 365 and Microsoft Dynamics CRM Online.
Existing user, group, and contact objects attributes (those that are synchronized) that are modified on-premises are modified in Office 365 and Microsoft Dynamics CRM Online.
Passwords modified on-premises are not modified in Office 365 and Microsoft Dynamics CRM Online.
Active Directory synchronization is a good alternative to the single sign-on approach for smaller and medium-sized organizations. You get the benefit of easing the burden of maintaining user accounts without significantly adding to your hardware and failover requirements. However, you will need to maintain two sets of passwords for your on-premises Active Directory accounts and your Office 365 accounts.
Task 3: Consider no synchronization (New users, new credentials)
The no synchronization option is covered in the following Office 365 content: Create or edit users.
For smaller organizations with few users or no on-premises Active Directory users, the no synchronization method might be the best choice. This is the simplest approach but can require more long-term administrative effort. Every time you create a new user account, you will need to create the user in two locations: on-premises Active Directory and in Office 365. Likewise, name and password changes will require editing the accounts in both locations.
For users, the no synchronization option means separate logons for on-premises services and Office 365 services such as Microsoft Dynamics CRM Online.