Using Rest API calls to access another company environment instance

(0) Share

Report

Posted on by Jmwest

Hi there

i need a question answered. We want to setup the sharing of CRM data between our suppliers environment to our own dynamics CRM. (Completely different tenants). The company in question are not guest or external users in our AAD as far as I know. (However They have teams guest accounts)

I have registered dynamics CRM in AAD and added api permissions as user.impersonation. I have also added the client ID to each dynamics environment we are using as application user.

The way the suppliers will be able to call our dynamics environment will be via Rest API calls using their own datverse api too. Which means they are using POSTMAN to get an access token. We were going to setup a gateway vpn from my azure environment to the supplier environment.

however they were able to get an access token without using the gateway vpn at all. They have our client Id and secret from our app registration. They also have tenant id and the dynamics environment url.

my question is should they be able to get an access token without having a vpn into our environment.

cheers

I have the same question (0)

All responses (3)

Answers (0)

Suggested answer

PerezAguiar Microsoft Employee on at

Like (1)

Report

If there's a user/app created in AzureAD, it has permissions in Dynamics, Connection is possible. Adding the VPN is only required if you have another component (for example, Conditional Access Policy or some sort of API Gateway).

This link offers an interesting approach: https://dynamics-chronicles.com/article/step-step-connect-d365-clientsecret-use-apis basically, is exactly what you've done (register app, create client/secret, get token using postman). As you can see from there, no gateway is involved (and this is the behaviour you're getting).

Using Conditional Access Policies you can then go one step forward, as requiring a specific location or range of IPs. You can read more on https://learn.microsoft.com/en-us/power-platform/admin/restrict-access-online-trusted-ip-rules and learn.microsoft.com/.../howto-conditional-access-apis

Regards,

Was this reply helpful? Yes No
Jmwest 5 on at

Like (0)

Report

Thank you so much for confirming my thoughts.

I think we will go down the Conditional Access Policy route to whitelist their IPs.

We have a current CAP that excludes untrusted locations but I imagine I would need to create one specific to the external users we are testing this to?

Thanks again

Was this reply helpful? Yes No
PerezAguiar Microsoft Employee on at

Like (0)

Report

You can either create a new CAP or modify the current existent one.

Was this reply helpful? Yes No

Join the conversation

Community site session details

Using Rest API calls to access another company environment instance

Helpful resources

Quick Links

Responsible AI policies

Neeraj Kumar – Community Spotlight

Congratulations to the November Top 10 Community Leaders!

Leaderboard > Customer experience | Sales, Customer Insights, CRM

Featured topics

Product updates

Community site session details

Using Rest API calls to access another company environment instance

Helpful resources

Quick Links

Responsible AI policies

Neeraj Kumar – Community Spotlight

Congratulations to the November Top 10 Community Leaders!

Subscribe to this forum!

Select categories

Leaderboard > Customer experience | Sales, Customer Insights, CRM

Featured topics

Product updates