CB Exchange Server Sync Online Documentation

Overview

CB Dynamics 365 to SharePoint Permissions Replicator replicates Dynamics 365 permissions as item (folder) level permissions in SharePoint document libraries. This document describes the configuration of CB Dynamics 365 to SharePoint Permissions Replicator.

Login to your account

Please navigate to our SaaS portal (https://saas.connecting-software.com/). You need to login to your SaaS portal account if you have one already or create a new one.

Configuration wizard (initial setup)

The configuration wizard is a new streamlined way of setting up the configuration to get the replication to work.

The configuration wizard guides you through the basic setup, directly after you log in for the first time. However, you can run the configuration wizard at any time via Configurations by clicking on the Create New button.

You can run the configuration wizard at any time via Dashboard quick links section. In case you have one or more configurations, you will be redirected to the Welcome page to choose between creating a new configuration via configuration wizard or activating an existent configuration. Please look into section 3.6 for more information about how activate an existent configuration.

Naming the configuration

You start by specifying a name for your configuration. By giving the configuration a meaningful name, it is easier to find it later in the list.

Click the Next button to proceed to the next step and configure a connection for Dynamics 365.

Configuring Dynamics 365 connection

In this step, you will need to configure Dynamics 365 connection.

NOTE:

If you are unable to connect to Dynamics 365, please try to log in via browser to make sure that you have entered valid information.

To configure Dynamics 365, you can choose between Using Password Authentication or Using Modern Authentication and then set up the following connection properties:

To be able to proceed to the next step, you need to fill in all required fields and then test your server connection.

Click on the Test connection button to test your server connection.

Using Password Authentication

For password authentication, you need a single user, let’s call him “service user”. The user needs to have the necessary privileges in Dynamics 365 (typically a System Administrator role, for more information see section 3.2.3).

Fill in the form with the following (see figure below):

Using Modern Authentication

WARNING:

For a multi-tenant application, whenever someone outside your Azure Active Directory tenant will use your application (App ID), they must first grant consent for your application. You can grant admin consent to an application via the “Grant tenant administrator consent” button.

To setup modern authentication, you’ll need to perform additional steps as described in the following sections.

Fill in the form

Fill in the form with the following (see figure below):

  • Directory (Tenant) ID – The ID of your Azure AD instance.

Click on the Grant tenant administrator consent button to grant admin consent to the application. Only needs to be done once.

Create an application user

WARNING:

For a multi-tenant application, only after an administrator has granted consent, you must then create the application user in Dynamics 365. You can grant admin consent to an application via the “Grant tenant administrator consent” button.

Do the following:

  1. In Dynamics 365, go to Settings > Security > Users and switch the view to Application Users.
  2. Click on New.
  3. Switch to Application User form and type in the Application (client) ID assigned to your app by Azure AD when the app was registered.
  4. Click on Save.
  5. Select Manage Roles.
  6. In the Manage User Roles dialog box, select a security role (see section 3.2.3), and then select OK.

Minimum required Dynamics 365 privileges

CB Replicator requires a user to access Dynamics 365. This user must be assigned a role with certain privileges for CB Replicator to work properly. The easiest way to make sure the user has the necessary privileges is to assign System Administrator role.

It is, however, possible to use a much more restrictive security role, that is, a role with fewer privileges in Dynamics 365.

Table 1 indicates the minimum required privileges that need to be part of the role assigned to the user used to access your Dynamics 365. All the privileges require Organization (global) access level.

NOTE:

In addition to the entities listed in Table 1, all entities that you intend to replicate need to have global read privilege. You can find all these entities listed in Configurations > Settings > Entity filter.

Table 1: Minimum required privileges for Dynamics 365 user / application user

Entity

Privilege

Create

Read

Write

Delete

Tab: Core Records

Document Location

Email Template

SharePoint Sites

Tab: Business Management

Article Template

Contract Template

Tab: Business Management

Business Unit

Field Security Profile

Organization

Position

Security Role

Team

User

User Settings

Read License Info

Tab: Customization

Custom Control

Default Config

Customizations

Entity

Field

Plug-in Assembly

Plug-In Trace Log

Plug-In Type

Publisher

Relationship

SDK Message

SDK Message Step

SDK Message Step Secure Conf.

Solution

System Form

View

Web Resource

Import Customizations

CB Replicator Configuration

CB Replicator Event

CB Replicator Log

Configuring SharePoint connection

In this step, you will need to configure SharePoint connection.

NOTE:

If you are unable to connect to SharePoint, please try to login via browser to make sure that you have entered valid information.

To configure Dynamics 365, you can choose between Using Password Authentication, Using ADFS or Using Modern Authentication and then set up the following connection properties:

To be able to proceed to the next step, you need to fill in all required fields and then test your server connection. Keep in mind that when you click on the Next button you won’t be able to go back and change your configuration, everything will be already created.

Click on the Test connection button to test your server connection.

Using Password Authentication

For password authentication, you need a single user that is Site Collection Administrator, let’s again call him “service user”.

Fill in the form with the following (see figure below):

Using AD FS authentication

For AD FS authentication, similarly, you need a single user that is Site Collection Administrator, let’s again call him “service user”.

Fill in the form with the following (see figure below):

  • User – The login of the user who is Site Collection Administrator. Examples:
  • Password – The password of the SharePoint user.
  • ADFS URL – The base URL of the ADFS 2.0 service endpoints (e.g. https://adfs.contoso.com).
  • Realm URN – The uniform resource name (URN) of the security realm federated with the given ADFS server (e.g. urn:sharepoint.contoso).

Using Modern Authentication

WARNING:

For a multi-tenant application, whenever someone outside your Azure Active Directory tenant will use your application (App ID), they must first grant consent for your application. You can grant admin consent to an application via the “Grant tenant administrator consent” button.

To setup modern authentication, you’ll need to do some additional actions as described in the following sections.

Fill in the form with the following (see figure below):

  • Directory (Tenant) ID – The ID of your Azure AD instance.

Click on the Grant tenant administrator consent button to grant admin consent to your application.

Token Activation

In this step, you can choose to activate the service at this time or skip activation.

NOTE:

You can activate the service later via Configurations > Activate service.

If you purchased a trial or a regular subscription you should have received an activation code via e-mail.

To activate the service, copy the activation code from the e-mail you received and paste it into the Activation Code field and click on the Activate Token button (see figure below).

A confirmation message will be displayed confirming that the service was activated successfully.

Once done, you can proceed to the final step.

Starting Replication

In the final step, you can choose whether to start replicating the permissions on the configuration immediately after clicking on the Finish button.

You can start the replication process anytime later by clicking on Start button at Configurations page.

Activating an existent configuration

In this step, if you click on the Activate code on an existent Configuration, you need to select the Configuration Name that you wish to activate from the selection box and then click on the Activate button.

You will be requested to type in the Activation Code (see image below).

If you purchased a trial or a regular subscription you should have received the activation code via e-mail. The Activation Code field should be automatically pre-filled. If that is not the case, copy the activation code from the e-mail you received and paste it into the Activation Code field and click on the Activate button. A confirmation message will be displayed confirming that the service was activated successfully.

Configurations

A configuration represents a single Dynamics 365 connection and one or more SharePoint connections. The configurations are independent from each other and each has its own settings

you can manage all the configurations via Configuration > CB Dynamics 365 to SharePoint Permissions Replicator on the navigation bar

After creating a configuration, you can start the replication process. To do so, click on the button.

NOTE:

There could be a delay before the permissions are replicated to SharePoint as the “CB Dynamics 365 to SharePoint Permissions Replicator” is relying on service queues for its execution.

The Status column indicates the status of the replication process. The possible statuses are:

  • Starting – The replication process is starting. This is an intermediate state after clicking the Start button.
  • Started – The replication process is running. The Dynamics 365 permissions are being replicated into SharePoint.
  • Stopping – The replication is stopping. This is an intermediate state between Started and Stopped state after clicking the Stop button.
  • Stopped – The replication process is stopped. Dynamics 365 permissions are not being replicated into SharePoint.
  • Initial Loading – Initial processing.

After starting the replication process, the Process Queues column indicates the status of the queues. The possible statuses are, from left to right:

  • Event queue holds Dynamics 365 events to be processed by CB Replicator. Events are processed one by one. An event can trigger a request to update permissions that is forwarded to the evaluation queue.
  • Evaluation queue holds SharePoint Document locations for evaluating permissions. The queue items are processed by Evaluation Workers. Workers calculate permissions for a document location and check permission changes. If there are changes, the item is forwarded to the Write queue.
  • Write queue holds SharePoint Document locations for writing permissions. The queue items are processed by Writer workers that are responsible for writing the unique permissions to the SharePoint item.

You can modify an existing configuration by expanding the burger icon next to any configuration and then click on the Edit option as shown in the figure below.

The Edit configuration page allows you to edit configuration details such as its Name as shown in figure below.

You can delete an existing configuration by expanding the burger icon next to any configuration and then click on Delete option (see figure below). You will be asked to confirm.

NOTE:

When deleting a configuration, it will be permanently deleted with all activated subscriptions (even paid ones). These subscriptions are not transferable to other configurations.

To manage the existing connections, click on the icon next to any configuration. To start, you will have a Dynamics 365 connection and a SharePoint connection configured via Configuration Wizard. Refer to section 6 for more information.

To help you with basic troubleshooting, the service keeps track of the replication process. To view activity log, click on the icon next to any configuration. You will be redirected to the History Logs page to view detailed logs of the activity. Refer to section 6 for more information.

After permissions are set on a SharePoint document location based on Dynamics 365 access rights, the service will no longer modify them unless a change in Dynamics 365 security is made. That said, after starting the replication process, you can manually overwrite permissions of any SharePoint document location at any time by clicking on the icon next to any configuration.

You can quickly perform commonly used actions in an existing configuration by expanding the burger icon next to any configuration (see image below).

After starting the replication process, the service goes through the entire security model and checks all SharePoint document locations. This process is known as full replication iteration. After the initial full iteration, and while the replication process is running, only events occurred in Dynamics 365 will be processed. You can manually force full replication iteration at any time, by clicking on Force full iteration option.

NOTE:

In some cases, the full iteration can be started automatically during replication process if the algorithm evaluates that it is easier to run a full iteration rather than to perform all the changes.

In case you want to delete the CB Replicator solution from Dynamics 365, when the replication process is stopped, and unregister SDK message processing steps by clicking on Clear Sdk message processing steps option.

To clear local SharePoint permission cache, click on Clear SharePoint permission cache option while the replication process is stopped. This action will force overwrite of SharePoint permissions even when there is no change from the Dynamics 365 side.

Alternatively, you may want to only clear SharePoint group cache. To do so, click on Clear SharePoint group cache option. This action will force check of SharePoint groups and memberships even when there is no change from the Dynamics 365 side.

You can customize your configuration by expanding the burger icon next to any configuration and then click on Settings option (see figure below). You will be redirected to the Settings page. Refer to section 11 for more information.

You can also activate/extend any configuration at any time by expanding the burger icon next to any configuration and then click on Activate service option (see figure below). You will be prompted to enter your Activation Code.

Activate a configuration

To start replicating permissions, you need to activate the configuration via the activation code received after purchasing the service from the shop (https://www.connecting-software.com/dynamics-crm-sharepoint-permissions-replicator-pricing/).

If you already have the activation code, navigate to Configuration page, expand the burger icon next to any configuration and then click on Activate service option. You will be prompted to enter your Activation Code.

Paste the activation code into the Activation Code field in the Service Activation window and click on the Activate button (see figure below). The Activation Code has the following format: f305ca9c-4ee6-448c-8f34-aa9cacdbf307.

Once token is activated, a confirmation message will be displayed confirming that the service was activated successfully (see image below) and then you can close the Service Activation window.

Connections

Through the Connections page, you can add new connections or modify the connections that you have already created.

To access the Connections page, navigate to Configurations page and then click on the Connections icon next to any configuration.

WARNING:

The connections can only be edited when the replication process is stopped by an authenticated tenant administrator.

Dynamics 365 connection

Click on to view details of your connection to Dynamics 365. You will be redirected to View Dynamics 365 connection page (see figure below).

Click on to edit your connection to Dynamics 365. You will be redirected to Edit Dynamics 365 connection page (see image below). Refer to section 3.2 for more information about how to configure Dynamics 365 connection.

SharePoint connections

In case you have group storage set to SharePoint, you can configure multiple SharePoint connections. To do so, click on Create new and fill in the form. Refer to section 3.3 for more information about how to configure SharePoint connection.

Click on to view/edit user mapping (see section 7).

Click on to view/edit permission mapping (see section 8).

Click on to view/edit explicit folder permissions (see section 6.3)

Click on to delete a SharePoint site collection. You will be asked to confirm.

Click on to edit a SharePoint connection. You will be redirected to Edit SharePoint connection page (see figure below).

Azure Active Directory connection

In case you have group storage set to Azure Active Directory, you need to configure a connection to Azure AD. Kindly note that you can only have a single SharePoint connection configured.

WARNING:

When using Azure AD as group storage, the AAD office group teams are not fully supported due to technical limitation in design of office groups. The office groups cannot be nested.

Click on the Configure button to configure a connection to Azure AD (see image below).

Fill in the form with the following (see figure below):

  • Directory (Tenant) ID – The ID of your Azure AD instance.

Click on the Grant tenant administrator consent button to grant admin consent to your application. This is only needed if you have not granted admin consent during the app registration or if your application is multi-tenant.

Click on the Test connection button to test your server connection.

User mapping (optional)

Use this page to view or modify the mapping of Dynamics 365 users to SharePoint users.

To access the User Mapping page, go to Configurations page, click on the Connections icon next to any configuration and in the SharePoint connections table click on the User Mapping icon next to any connection. Each connection has its own user mapping.

In top box, you can see the number of user licenses required for your Dynamics 365 organization.

To modify default user mapping settings, click on the Settings button on the top right corner of the page. The User mapping settings dialog will open (see image below). You’re able to choose between Automatic and Manual user mapping mode. The default is automatic.

For automatic mode, an automated algorithm is in place to map (match) Dynamics 365 users to SharePoint users. The algorithm uses login name to map users and so it is important that Dynamics 365 and SharePoint are connected to the same Active Directory domain or Office 365 organization. In the User mapping settings dialog, you can set up the following properties:

  • Auto-refresh – Indicates whether to automatically reload (refresh) the user mapping at a set interval
  • Refresh interval – The interval of time (in seconds) between checks for users to be automatically mapped. This will make sure that new users will be mapped.

For manual mode, you’ll need to manually create the mapping. No user will be automatically mapped. Kindly note that when you change from automatic mode to manual mode, all existing mappings will be lost.

NOTE:

When using Azure Active Directory as group storage, you can only use automatic mode and you cannot edit any mapping.

You can check as many checkboxes as you want, and then click on one of the following buttons:

  • “Block mapping” to exclude all selected from automated mapping. Pick only mapped (no custom) mappings. Kindly note that blocked mappings do not contribute to your user license count.
  • “Unblock mapping” to include all selected to automated mapping. Pick only blocked mappings.
  • “Remove mapping” to remove all selected custom mappings. Pick only mapped (custom) mappings.

The Status column indicates the status of the mapping. The possible statuses are:

Indicates that the user is mapped (automated mapping or custom).

Indicates that the user has not been mapped.

Indicates that the user is excluded from automated mapping (intentionally).

The Custom column indicates whether the mapping was automatically or manually created.

Click on the icon to edit the mapping. The Custom user mapping dialog will open (see image below). You’re able to select one or more SharePoint users to be associated to a single Dynamics 365.

Permission mapping (optional)

Use this page to view or modify the mapping of Dynamics 365 access rights to SharePoint permissions.

To access the Permission Mapping page, go to Configurations page, click on the Connections icon next to any configuration and in the SharePoint connections table click on the Permission Mapping icon next to any connection. Each connection has its own permission mapping.

As Dynamics 365 and SharePoint security models differ, a mapping between them needs to be established. To do so, the service automatically creates certain permission levels in SharePoint. Table 2 shows the default mapping between Dynamics 365 and SharePoint that should be suitable for most deployments.

Table 2: Mapping between Dynamics 365 and SharePoint

D365 access right

SharePoint permission level

SharePoint permissions

ReadAccess

cbreplicator_crm_ReadAccess

ViewListItems; Open; OpenItems; ViewVersions; ViewFormPages; BrowseDirectories; BrowseUserInfo; UseClientIntegration; UseRemoteAPIs; CreateAlerts

WriteAccess

cbreplicator_crm_WriteAccess

AddListItems; EditListItems; DeleteListItems; DeleteVersions

To modify default permissions mapping settings, click on the Settings button on the top right corner of the page. The Permission mapping settings dialog will open (see image below). You’re able to choose between Automatic and Manual user mapping mode. The default is automatic.

You can check as many checkboxes as you want, and then click on the Remove button to delete a custom permission mapping (see image below). Only custom mappings can be removed. Look at the Custom column to identify if the mapping is manually created by the user or pre-configured by the application.

Click on the Add button to create a custom permission mapping. The Create mapping settings dialog will open.

For SharePoint as group storage, you will need to choose an appropriate Dynamics 365 Access Right, a SharePoint Permission Level and, optionally, an Entity filter. Finally click on the Save button.

For Azure Active Directory as group storage, you will need to choose an appropriate Dynamics 365 Access Right and, optionally, an Entity filter, as well as type in a SharePoint Permission Level Name and, optionally, SharePoint Permissions to be assigned.

Explicit folder permissions (optional)

Use this page to add additional SharePoint permissions besides the ones calculated for the Dynamics 365 security roles. In Addition, you may want to grant access to SharePoint for users who do not belong to Dynamics 365.

To access the Explicit folder permissions page, go to Configurations page, click on the Connections icon next to any configuration and in the SharePoint connections table click on the Permission Mapping icon next to any connection. Each connection has its own explicit folder permissions.

You can check as many checkboxes as you want, and then click on the Remove button to delete all selected explicit folder permissions (see image below).

Click on the Add button to create an explicit folder permission. The Create explicit folder permission dialog will open. In this dialog, you will need to choose an appropriate Filter Type, a Principal Type, a Principal Value and a Permission Level.

Replication logs

To help you with basic troubleshooting, the service keeps track of the replication process. To view activity log, navigate to Configurations page and then click on the icon next to any configuration.

During replication process, the service generates a message (Log) for each step along the way. Each Log has a Log Type, which refers to how detailed the generated message is. The following log types are generated:

  • Debug – Internal information that could be used to troubleshooting.
  • Info – General information from the CB Replicator service.
  • Warning – Warning messages
  • Error – Error messages
  • Event – Events received from Dynamics 365
  • Permission Write – Permissions written to SharePoint

History logs

Use this page to view or monitor detailed logs of the activity.

NOTE:

By default, activity logs are stored in a database. This can be configured via Settings > Logs in “Save the Replicator logs in the database” or “Save the Replicator logs in Dynamics 365” settings.

In this page, you can search for logs stored in a database or in Dynamics 365, filter logs by type or date, navigate to older pages and search for a specific text in Message or Additional Info columns.

NOTE:

Be aware that search in SQLite database is case-sensitive while for Microsoft SQL Server or Dynamics 365 is case-insensitive.

NOTE:

You can delete logs from Dynamics 365 by using Bulk delete.

Overwrite folder permissions

After permissions are set on a SharePoint document location based on Dynamics 365 access rights, the service will no longer modify them unless a change in Dynamics 365 security is made.

Use this page to manually overwrite permissions of any SharePoint document location.

To access Overwrite folder permissions, navigate to Configurations page and then click on the icon next to any configuration.

NOTE:

This option is unavailable when the replication process is stopped.

In this page, you can filter locations by entity and search for a specific text in URL, Location ID or Object ID columns as shown in figure below.

You can check as many checkboxes as you want, and then click on the Overwrite selected locations button. You will be prompted with a list of all SharePoint document locations queued for overwriting permissions as shown in figure below.

Settings

The Settings page allows you to easily customize your configuration’ default settings.

To access Settings, navigate to Configurations page, expand the burger icon next to any configuration and then click on Settings option.

NOTE:

Some settings are only available via the XML configuration file.

Click on the Save button to save all your changes for that page at once.

Click on the Discard button to discard all your changes for that page at once.

In current product version, you can only reset Event Priority settings to their original defaults. You will be asked to confirm. Kindly note that this action cannot be reversed.

General

This General Settings screen is the default screen in the Settings page and controls some of the most basic configuration settings for your configuration.

Group storage

Indicates the target system for creating and maintaining groups and memberships.

By default, SharePoint is used. In this case, groups are created on the SharePoint side.

Maintaining groups on the SharePoint side is a very time costly process especially when you use multiple SharePoint connections or site collections. For each SharePoint, a set of groups needs to be maintained, and a single Dynamics 365 operation might cause a great number of write operations at the SharePoint side.

Alternatively, you can select Azure Active Directory as group storage for creating and maintaining groups.

NOTE:

Be aware that when changing the target system, custom user mapping, permission mappings and explicit folder permissions will become invalid and will need to be removed.

In this case, groups are created on the directory side. These groups only need to be adjusted once per operation to then be used in each affected SharePoint site collection. This can significantly improve performance in some scenarios.

NOTE:

AAD Office Group teams are not fully supported with group storage Azure Active Directory due to technical limitation in design of Office groups (the Office groups cannot be nested).

Automatically delete events from Dynamics 365 after processing

Indicates whether events will be automatically deleted from the queue in Dynamics 365 after being processed.

Behavior

This Behavior Settings screen controls how the service behaves when replicating permissions. Only the first are visible in the figure below, for other options you will need to scroll down.

Replicate record state code

Indicates whether the status of a record in Dynamics 365 will be applied to secured SharePoint objects. When the status of a record is set to Inactive (Closed, Won, Lost, Cancelled, etc.), the record is read-only in Dynamics 365. If enabled (On), all the users will have read-only access in SharePoint as well. The default is disabled (Off).

Replicate user access mode

Indicates whether Dynamics 365 users access mode will be replicated. The default is disabled (Off).

  • Read-write access mode – Read and write access to SharePoint location.
  • Read access mode – Read access to SharePoint location.
  • Administrative, Support User, Non-Interactive – No access to SharePoint location.

Automatic SharePoint user creation

Indicates whether a SharePoint user should be added for each Dynamics 365 user that is not present in SharePoint. To do so, the user must belong to Active Directory domain or Office 365 organization. No retries are made in case of error. The default is disabled (Off).

Skip disabled document locations

If enabled (On), SharePoint document locations that are inactive (or disabled) or are using relativeurl and its parent location is inactive (or disabled), will be skipped/ignored. The permissions will not be replicated for these document locations. The default is disabled (Off).

Access team templates as SharePoint groups

Indicates whether the Dynamics 365 access team templates (record access teams) will be replicated as SharePoint groups. Otherwise, permissions will be granted per user.

Access teams as SharePoint groups

Indicates whether Dynamics 365 access teams will be replicated as SharePoint groups. Otherwise, permissions will be granted per user.

Skip broken links

If enabled (On), when a SharePoint document location is identified as a broken link it will be remembered in the local database. There will be no more attempts to write permissions for this SharePoint document location.

You can clear the cache at any time by clicking on the Clear broken link cache button.

NOTE:

When using Azure Active Directory as group storage, any mention of SharePoint group will be applied to directory groups.

Multiple link resolution type

Indicates the permission resolution type in case of multiple document locations pointing to same SharePoint object.

  • None – No handling for this case.
  • Oldest Wins – The permissions for oldest document location will be set.
  • Newest Wins – The permissions for newest document location will be set.
  • Logical And – The logical conjunction of all related permissions will be set.
  • Logical Or – The logic disjunction of all related permissions will be set.

Microsoft Teams

WARNING:

Make sure you have enabled Microsoft Teams support in Dynamics 365. The following link contains more information about Microsoft Teams integration with Dynamics 365: https://docs.microsoft.com/en-us/dynamics365/teams-integration/teams-integration

Each Team has a pre-created SharePoint site where files are uploaded (via Teams or directly). For each channel a dedicated SharePoint folder is created. You can link one or multiple Dynamics 365 records for each team channel. When Dynamics 365 records are linked to some team channel, the team channel related documents are visible also in Dynamics 365.

The Dynamics 365 users can access files directly within the Dynamics 365 user interface. These files in SharePoint are accessible following the security permissions defined by the Team itself, however security is not matching with linked Dynamics 365 records. This is the out-of-the-box functionality that brings the described security issue.

CB Replicator deals with the security of files stored within Microsoft Teams. Technically, these files are stored in dedicated SharePoint site collections:

  • 1 Microsoft Team = 1 SharePoint site collection (e.g. /sites/team)
  • 1 Microsoft Team channel = 1 SharePoint folder within the mentioned site collection (e.g. /sites/team/Shared Documents/General)

CB Replicator secures just the folders referenced by Microsoft Teams location (e.g. /sites/team/Shared Documents/General). It does not secure the whole site collection.

By enabling Microsoft Teams support (Settings > Microsoft Teams > Enable Microsoft Teams support), the following behavior will be added to the default logic:

  • Team files will get permissions based on linked Dynamics 365 record(s), when Append default permissions for Teams location is disabled
  • Team files will get permissions based on linked Dynamics 365 record(s) + permission based on team, when Append default permissions for Teams location is enabled

If there are multiple Dynamics 365 records linked to a single team, the security logic in place is the one set in Settings > Behavior and in Multiple link resolution type setting.

The Microsoft Teams support can work in parallel with existing document locations and in combination with the standard Dynamics 365 – SharePoint integration.

Enable Microsoft Teams support

If enabled (On), it will ensure that Dynamics 365 security will be applied to files stored at related site based on linked Dynamics 365 record(s). Otherwise, Microsoft Teams document locations will be skipped.

Append default permissions for Teams locations

If enabled (On), the following permissions will be added to the location linked to the team:

  • Team’s site Visitors – Read
  • Team’s site Members – Edit
  • Team’s site Owners – Full control

Otherwise, some users (in Teams) may not have access to files. This is to make sure that all owners/members (in Teams) have proper access to Microsoft Teams files.

NOTE:

If Microsoft Teams support is enabled, you must use Azure Active Directory as group storage. Go to Settings > Target System and then select Azure Active Directory (see section 0). Please note that a connection for Azure Active Directory must be configured.

The reason behind this is that each Microsoft Teams is creating dedicated site collection in background and we need to use Azure Active Directory groups instead of SharePoint groups as internal group storage to reduce number of groups handled by our software. Azure Active Directory groups can be used across site collection, SharePoint groups cannot.

NOTE:

Microsoft offers also Enhanced Collaboration Experience with Microsoft Teams. If enabled, you can create a Team directly from Dynamics 365, using the Collaborate button. However, in this case, the document location in Dynamics 365 is created, but not the folder in SharePoint. The SharePoint folder will be created on the first attempt to access the Files tab in Microsoft Teams.

This behavior will lead to an expected warning. You should follow its indications: SharePoint folder '{name}’ was not found. Once the folder is created, our software will not recognize it automatically. You must force full iteration (Quick Actions > Force full iteration) or overwrite folder permission (Connections > SharePoint connection > Edit overwrite folder permissions).

Event priority

This Event Priority screen allows you change the order in which events that are triggered from Dynamics 365 will be processed, as shown in the figure below.

The events with higher priority will be processed before events with lower priority. The available priorities are: Highest, Above normal, Normal, Below normal, and Lowest. Do not set all events with a high priority, the goal is to indicate an order for event processing.

Entity Filter

This Event Priority screen allows you to select which Dynamics 365 entities you want to have permissions automatically replicated.

If Process all entities is enabled (On), all Dynamics 365 entities will be automatically replicated. Otherwise, only the selected entities will have permissions replicated.

NOTE:

Only entities with enabled Document Management will be listed.

Security role filter

This Event Priority screen allows you to select which Dynamics 365 security roles are going to be replicated.

The behavior depends on what is set in the Security filter mode option:

  • None: No filter is applied. All roles are replicated.
  • Include: Only the selected roles will be replicated.
  • Exclude: The selected roles will be excluded from replication.

Logs

This Logs screen allows you to define where logs will be stored in a database or Dynamics 365 or both.