Walkthrough: Configure Microsoft Azure (ACS alternate method)

Applies To: Dynamics 365 (online), Dynamics 365 (on-premises), Dynamics CRM 2016, Dynamics CRM Online

This walkthrough guides you through configuring the Microsoft Azure Active Directory Access Control Service (ACS) issuer, scope, and rules to allow a listener application to read the Microsoft Dynamics 365 messages posted to the Microsoft Azure Service Bus. This walkthrough applies to integration with any deployment type of Microsoft Dynamics 365.

As a prerequisite to this walkthrough, if you’re running Microsoft Dynamics 365 (on-premises or IFD), configure Microsoft Dynamics 365 for Microsoft Azure integration. For more information, see Walkthrough: Configure Dynamics 365 for integration with Microsoft Azure. Microsoft Dynamics 365 (online) is pre-configured for Microsoft Azure integration.

In This Topic

Create a new service namespace

Create a service identity (issuer)

Create a rule group and a rule

Configure the scope

Create a new service namespace

If you have an existing ACS service namespace that you want to use, continue with the next section named Create a service identity (issuer).

Use PowerShell commands to create a new service namespace

1. Download and install the Microsoft AzurePowerShell module. More information: How to install and configure Azure PowerShell

2. From the Start menu, open the Microsoft AzurePowerShell program and enter the following commands.

   > Add-AzureAccount
   > New-AzureSBNamespace –Name YOUR_NAMESPACE -Location "YOUR_LOCATION" -CreateACSNamespace $true
   

   Note

   Version 0.8.9 or later of AzurePowerShell supports the –CreateACSNamespace parameter in the New-AzureSBNamespace command. If your installed version of AzurePowerShell doesn’t support the –CreateACSNamespace parameter, install the latest version. To see the version of AzurePowerShell that you’re using, enter the command Get-Module Azure.

   Newer versions of the command may support a –NamespaceType parameter. If so, use –NamespaceType Messaging.

   After you enter Add-AzureAccount, you’ll be prompted to provide the sign-in credentials for your Azure subscription. Substitute an appropriate namespace name for YOUR_NAMESPACE and an approximate location for YOUR_LOCATION. The supported locations are: Central US, East US, East US 2, North Central US, South Central US, West US, North Europe, West Europe, East Asia, Southeast Asia, Brazil South, Japan East, and Japan West.

After you enter these commands, the namespace is created and you should see output that looks similar to the following text.

Name                  : mynamespace
Region                : Central US
DefaultKey            : 1eKDTIYEACFP7Geiy5QV/hqJnWHeroJyKk/PBzv42Rw=
Status                : Active
CreatedAt             : 8/25/2014 3:36:47 PM
AcsManagementEndpoint : https://mynamespace-sb.accesscontrol.windows.net/
ServiceBusEndpoint    : https://mynamespace.servicebus.windows.net/
ConnectionString      : Endpoint=sb://mynamespace.servicebus.windows.net/;SharedSecretIssuer=owner;SharedSecretValue=1
                        eKDTIYEACFP7Geiy5QV/hqJnWHeroJyKk/PBzv42Rw=

Create a service identity (issuer)

1. If you haven’t already done so, go to the Microsoft Azure Management Portal and sign in.

2. In the management portal, click Service Bus and then select your existing namespace in the list.

3. Click Connection Information.

4. At the bottom of the form, click Open ACS Management Portal.

5. Under Service Settings, select Service identities, and then click Add.

6. On the Add Service Identity page, enter a name for the issuer identity. This must be the same issuer name that Microsoft Dynamics 365 is configured with. You can find this issuer name in the Dynamics 365 web application by choosing Settings > Customizations > Developer Resources.

7. Select a credential type of X.509 Certificate.

8. Browse to the location of the certificate on your local computer. Obtain the certificate by clicking the Download Certificate link on the Developer Resources page of the Dynamics 365 web application.

9. Click Save.

If you’re working with Microsoft Dynamics 365 (online) and see an indication that the certificate you obtained from that server is expired, you can ignore that warning.

Create a rule group and a rule

Create a rule for the target scope that will allow Microsoft Dynamics 365 to send or “post” to the Microsoft Azure Service Bus. You do this by configuring ACS to map the input “Organization” claim from Microsoft Dynamics 365 to the output “Send” claim of the Microsoft Azure Service Bus.

First, create a rule group by following these steps.

1. Below Trust relationships, select Rule groups.

2. Click Add.

3. Enter a name for the rule group and select Save.

Next, add a claim rule to the rule group.

1. On the Edit Rule Group page, click Add.

2. In the If section of the page, select Access Control Service.

3. For the input claim type, select Enter type and then enter https://schemas.microsoft.com/xrm/2011/Claims/Organization.

4. For the input claim value, select Enter value, and then enter the name of a Microsoft Dynamics 365 organization.

   For an Internet-facing or on-premises deployment, enter the unique name of the desired organization in lowercase characters. You can find this name on the Developer Resources page of the Dynamics 365 web application next to the Organization Unique Name label. To navigate to that page in Dynamics 365, click Settings > Customizations > Developer Resources.

   For a Microsoft Dynamics 365 (online) deployment, specify the complete hostname part of the Web service URL. For example, given a URL of https://myorg.crm.dynamics.com/main.aspx, the host name part is myorg.crm.dynamics.com.

5. In the Then section, for the output claim type, click Select type and then select the http://docs.oasis-open.org/wsfed/authorization/200706/claims/action item from the drop-down list.

6. For the output claim value, select Enter value, and enter a value of Send for the output claim.

7. Add a description of the rule (optional). For example, you could type: “Allow the Contoso organization to send to the Microsoft Azure Service Bus.”

8. Click Save.

Configure the scope

The following steps describe how to configure the Microsoft Azure Service Bus scope of ACS for a normal mode post by Microsoft Dynamics 365. Defining a scope provides more restricted access to the service namespace.

1. Below Trust relationships, select Relying party applications, and then click Add.

2. On the Add Relying Party Application page, enter a display name for the relying party. For example, enter internal. This name is the scope name.

3. Enter the realm URI of your Microsoft Azure service endpoint and append the scope name, for example, https://crmsdkdemo.servicebus.windows.net/internal.

4. Enter the return URL, which can be the same value as the realm URI you just entered.

5. Select a token format of SAML 2.0.

6. You may optionally increase the token lifetime value.

7. Make sure the Windows Live ID identity provider is selected.

8. Select the name of the rule group you created previously. If the check box next to your rule appears ghosted, first clear the check box that is currently checked, and then select the check box for your rule.

9. Click Save.

See Also

Azure extensions for Microsoft Dynamics 365
Walkthrough: Configure Dynamics 365 for integration with Microsoft Azure
Configure Azure integration with Microsoft Dynamics 365
ACS Management Portal

Microsoft Dynamics 365

© 2016 Microsoft. All rights reserved. Copyright