Dynamics 365 Security & AAD

I come from an ‘on-premise’ background. I’ve spent years in organisations with on-premise systems such as Dynamics 365. Take me into a server room that’s alive with whirring fans, and I get quite nostalgic. Those were the days…well, in some ways, anyhow. But having recently discovered some quite helpful functionality, I thought I’d share it with others!

See, when it came to Dynamics 365 security, there was no way to automate things. Yes, users had to be created in Active Directory (and also, in a folder that the Dynamics install could refer to within AD!), but they had to be manually added to Dynamics 365. There was no way to automate this (from recollection – then again my memory grows dim with the fog of time).

So what the system administrators needed to do was to manually go to Settings/Security within the system, and there they could either add a single user at a time, or multiple users. They would then assign role/s (for multiple users, all of the users would need to have the same role/s – it wasn’t possible to modify individual users within this process).

One way to slightly speed up time in handling different security roles was to have teams, relating to the business needs. The security role/s would be created, assigned to a team, and then any user added to the team would automatically get all of the permissions that they needed.

Then came the heady world of Dynamics 365 being online! Well, nothing much changed really, at least not for a little while.

But then, things really did change, in May 2019. Functionality for security teams within Dynamics 365 was increased. Notably, there was now something called a ‘AAD Security Group Team’:

So what was this magical new item?

When we create a team, and we set the Team Type to ‘AAD Security Group’, we’re now able to set an AAD Object ID. In fact, it’s required! After we’ve created this object within Dynamics 365, we can then apply security role/s to it directly (as we could to any other team records beforehand):

Let’s take a moment to reflect & think on this. Until now, we’ve had to handle security directly within Dynamics 365. Now, we have the ability to have an Azure Active Directory (for that is what AAD stands for) group, and reference it within Dynamics 365.

Suddenly new possibilities open up. As part of the on-boarding process (for example) we can users to specific AAD security groups, which will then give them access with appropriate permissions within Dynamics 365. We’re also able to have multiple AAD groups, each inheriting a different set of Dynamics 365 roles, and thereby create a multi-layering approach to different business & security needs.

We’re also able to use tools such as PowerShell, LogicApps, Power Apps & Power Automate to carry out automation around this. There’s an Azure AD connector (https://docs.microsoft.com/en-us/connectors/azuread/) which gives the ability to set up & administer these.

We’re actually using this functionality now in some of our COVID-19 response apps. Instead of needing our own support desk to manage the (external) users, we’ve provided an interface where client IT departments can quickly log in, upload a list of users, and assign them to the relevant AAD group/s. It’s very quick, and allows the users to onboard to the Power Apps within minutes!

So with knowing this, how do you feel it might help benefit you? Comment below – I’d love to hear!

Omnichannel for Dynamics 365 – Security

Like all of the other applications and features within Dynamics 365 and the PowerPlatform, the ability to use Omnichannel features requires security role/s to be assigned to users.

These are assigned in the usual way that all security roles are assigned for an environment. A user (with appropriate admin privileges) will need to go to admin.powerplatform.com, select ‘Environments’ in the left-hand navigation bar, select the environment that they’re wanting to set security for, and click the ‘Settings’ menu button

Under the Settings menu, select the option for ‘Users + Permissions’, and then select ‘Users’

You’ll get a screen opening, in which you can manage users and security roles for them. Select the user/s that you’re wanting to assign Omnichannel security roles to, and click the ‘Manage Roles’ menu button (it’s possible to assign the same role/s to multiple users at the same time).

Note: You can also use the search box (not displayed in the image below) to search for a specific user that you’re wanting to add the role/s to)

When the Manage User Roles window opens, you’ll be able to see all security roles that you can apply to the user/s. For Omnichannel, there are 4 specific roles:

  • Customer service app access
  • Omnichannel administrator
  • Omnichannel agent
  • Omnichannel supervisor

Note: All Omnichannel users (agents & supervisors) should be assigned the ‘Customer service app access’ security role

The differences between the three Omnichannel security roles are as follows:

Omnichannel Agent Can view user list / presence list / work stream list/ queue list
Can view quick replies
Omnichannel SupervisorCan view user list / presence list / work stream list / queue list / PBI config list
Can edit default presence and default capacity of a user
Can edit queue assignment of a user
Can add / remove users from presence
Can add / remove agents from queue
Can view / add / edit / delete quick replies
Can view operating hours
Omnichannel AdministratorCan view user list / presence list / work stream list / queue list / PBI config list
Can edit roles of a user
Can edit default presence and default capacity of a user
Can edit queue assignment of a user
Can add / edit / delete presence
Can add / remove users from presence
Can add / edit / delete presence associations
Can add / edit / delete work streams
Can add / edit / delete channel settings, context settings, routing rules
Can add / edit / delete queues
Can add / remove agents from queue
Can view / add / edit / delete quick replies
Can add / edit / delete PBI config
Can view add / edit / delete operating hours
Can view add / edit / delete auth settings

Once role/s have been selected and saved against user records, you’ll be able to see the users show up in the ‘Omnichannel’ user view

You’ll also be able to see these users under the ‘Users section of the Omnichannel Administration application

We’ll look next at how Omnichannel users are managed.

Environments & Security

Following on from my post last week (https://thecrm.ninja/2019/07/05/environments-for-projects/) where I talked about the different environments for projects, I thought it would be good to talk about security relating to it as well.

Image result for security

What I’ll be discussing below is best practise for projects that relate to (external) clients.

However, there are usually some small differences when it’s an internal project for a company – security is can be slightly more relaxed (after all, the dev teams are usually the ones responsible for rolling the project out, providing on-going support, new features, etc). It’s also the case that internal developers (usually) won’t be prevented from seeing what the actual company data is.

The essential principle is as follows: Users should be restricted to only using environments that they are needing to access

This follows Best Practise for system security, as well as some common sense (it’s surprising how many times this can seem to be lacking!)

Access to the environment/s will depend on roles/s of the person, along with infrastructure that is in place. Users should not be granted access to any environment that they have no need to access at all .

DevIntegrationUATStagingTrainingProductionSupport
Team
Developers




Consultants


Clients


Note: There may be exceptional cases people are required to access the Production instance for a client. In such a circumstance, it is vital and absolutely necessary to have a complete audit trail to cover this, setting out the reason/s for it, along with all actions that are taken within the system. This should be ideally be via email, or any other system that may be present to allow a definitive time-stamped communication of request and sign-off

There is an extensive security model within Dynamics365 that can be used to enable and control this, if needed (eg for users to have access to one part of the system, but not another – this could be due to the system holding restricted access data, for example).

Have you come across any cases where this wasn’t followed, and caused issues? Feel free to comment – I’d love to hear about what happened!