Dynamics CRM on-premise - use Azure Active Directory instead of Azure VM with AD and ADSF

(0) Share

Report

Posted on by Community Member

Hi everyone,

we have Dynamics CRM on-premise with IFD. Our AD server is deployed on separate Azure VM.
We would like to migrate our AD to Azure Active Directory(AAD) and remove our VM with AD server.

I have found the workaround to set up CRM with AAD
teameasi.com/.../dynamics-crm-using-azure-active-direction-instead-of-adfs
but I haven't found any official prove from MS that this configuration is supported.

Does Dynamics CRM support AAD?
Is it possible to do a migration without CRM downtime?

Thank you.

With best regards,
Alexey

*This post is locked for comments

I have the same question (0)

All responses (9)

Answers (0)

Community Member on at

Like (0)

Report

I'm trying to find information on the same. I found that page as well, but it references the Classic Azure Portal and I'm having a hard time translating it into the new portal. maybe it's because I don't have Azure AD premium.

Was this reply helpful? Yes No
Suggested answer

Michel van den Brink 4,697 on at

Like (1)

Report

Hello Alexey,

Yes, you can run Dynamics CRM on-premise with Azure AD.

It's quite a hassle though and there's a small catch, you need an on-premise AD server as well, combined with ADFS (AD Federation Service) and syncing between your Azure AD and on-premise AD.

Your on-premise Dynamics CRM instance will look to the on-premise AD server and not really know about Azure AD at all.

Setting up an on-prem CRM with ADFS:

www.interactivewebs.com/.../how-to-set-up-microsoft-crm-2016-ifd-on-windows-2012-r2-server

Setting up AD Connect (sync) between Azure AD and on-premise AD:

docs.microsoft.com/.../active-directory-aadconnect

Was this reply helpful? Yes No
Community Member on at

Like (1)

Report

That’s how we’re set up now and what I’m familiar with. One of our clients wanted to prevent having ADFS installed, and somehow leverage Azure AD directly as the Security Token Service for authenticating users to CRM. Now that some steps in the article referenced in the original post are deprecated, it seems this setup is not possible. (I’m not surprised since MSFT provides CRM online for organizations that don’t want to maintain infrastructure).

Was this reply helpful? Yes No
Michel van den Brink 4,697 on at

Like (1)

Report

Without ADFS I'm afraid it's going to be rather difficult.

For all our on-premise clients we work with AFDS, I can't say I have a good feeling about consuming the Azure AD STS directly.

Was this reply helpful? Yes No
Community Member on at

Like (0)

Report

Agreed. This was an idea the client came up with in an effort to reduce servers. We’re not behind it, just tryin to gather info and official documentation :-)

Was this reply helpful? Yes No
Suggested answer

Jan Hajek 50 on at

Like (1)

Report

Hi, I would like to point you to an article I wrote - https://blog.thenetw.org/2018/04/03/using-azure-active-directory-for-sso-with-dynamics-365-on-premise/ - about the current options of connecting Dynamics 365 instance directly to Azure AD. Next week, there will be another article more focused on ADFS and using Azure AD as a Claims Provider Trust. Hope it helps.

Was this reply helpful? Yes No
Arpita Saini on at

Like (0)

Report

Try reading below...I haven't gone through it entirely to confirm it is supported or unsupported but nice article with great info :-

https://blog.thenetw.org/2018/04/03/using-azure-active-directory-for-sso-with-dynamics-365-on-premise/

Was this reply helpful? Yes No
Pinesh 20 on at

Like (0)

Report

https://blog.thenetw.org/2018/04/03/using-azure-active-directory-for-sso-with-dynamics-365-on-premise/

Anyone had a success using above article to configure CRM 2016 IFD using Azure AD?

Was this reply helpful? Yes No
Suggested answer

Hüseyin Sahin on at

Like (3)

Report

The approach explained in the Blog Article is unsupported. If Azure AD federation or Azure AD is supported the software requirements documentation will be updated: https://docs.microsoft.com/en-us/dynamics365/customerengagement/on-premises/overview

It also requires direct database updates in the MSCRM_CONFIG database which is unsupported to mention one point. The Browser based login will work but SDK and other parts of CRM will fail.

As already greatly mentioned before, CRM On Premise - ADFS - Azure AD is the way to go.

From another perspective you can use Azure Proxy to publish the CRM URLs via Azure to the outside world to add an additional security layer in-front of the ADFS.

ADFS enabled is the current supported status only for now.

This may change in the future so fingers crossed :)

Was this reply helpful? Yes No