One of the benefits of the new CRM Online identity platform is the ability to federate user identities so that end users can use their Active Directory (AD) credentials to logon to CRM Online without having to use a separate set of username and password. This is also referred to as single sign-on (SSO) wherein a user signs in once and can access many applications including CRM Online, Office 365, local on-premises applications and more.

I often get asked how can one setup a demo/test environment to showcase this functionality with CRM Online so I spent a little bit of time putting together the list of steps required to have a CRM Online demo environment with federated identity. In the end, it is a "no drama" demo as all you are doing is just signing in but there are plenty of things happening behind the scenes to enable this magic!

The list of steps might seem long because I cover everything from setting up active directory from the ground up to adding users in AD. End-to-end, it'll take about 2 to 3 hours to setup. . I pretty much followed the video walkthrough by Planky to put together my demo environment however there are few steps missing in planky's videos that I've included here. Please note that these instructions are strictly for demo environments and not recommended for production environments. In typical production environments, much of this would be done in advance and you'd need backup/redundant servers for failover, etc. In short, you're better off following the official documentation for production environment setup

The post assumes that you have already created a new CRM Online trial and have a fair bit of knowledge on Windows Server and Active Directory setup. If you don't have that background, you can easily search the terms I mention on your favorite search engine and you can find plenty of articles to help.

CRM Online Identity Federation Demo Setup Steps

1. Create a Window Server Hyper-V Virtual Machine with external network connectivity. I generally use the Windows Server evaluation VMs provided by the Windows team. In this setup, I'm running the VMs locally on my machine but you could also host the VMs in the cloud with Windows Azure
   1. Rename the machine appropriately, say CRMOFedDC
   2. I generally disable Internet Explorer Enhanced Security Configuration (IE ESC) for administrators & users within the server manager for my demo VMs.
   3. Run windows updates to install all the updates
2. While the updates are installing, register for a new domain name at your favorite provider. In this example, I'm using godaddy.com and the new domain name I registered for the purpose of this demo is crmpmg.com
3. Promote the VM to domain controller using dcpromo
   1. Pick an FQDN of the forest domain. The one I use in this guide is crmpmg.com and you need to pick your own. Optionally you can also use crmpmg.local but you'll have to add the .com UPN suffix at a later step.
   2. Chose Windows Server 2008 R2 and above only
4. Add the "Active Directory Certification Services" role and set up the VM as the Enterprise Root Certification authority as per the instructions here: http://technet.microsoft.com/en-us/library/cc772393(v=ws.10).aspx#BKMK_AS1
   1. Choose "Certificate Authority" in Role Services screen
   2. Choose "Enterprise" in setup type
   3. Choose "Root CA" in CA type
   4. Choose all the defaults in Private Key and database locations screens and finish the wizard to configure the machine as the enterprise root certification authority.
5. Download 64-bit ADFS 2.0 setup for Windows Server 2008 R2 (RTW\W2K8R2\amd64\AdfsSetup.exe) and install as a stand-alone federation server
   1. This will automatically install IIS, PowerShell, Windows Identity Foundation (WIF) and other required components
   2. Restart the machine at the end of the ADFS 2.0 setup if prompted.
6. Open "ADFS 2.0 Management" under administrative tools and run the ADFS 2.0 federation server configuration wizard.
   1. Choose " Create a new federation service"
   2. Choose "Stand-alone federation server" since this is a demo environment.
   3. New SSL certificate will automatically be created and displayed for you since the same machine is the certificate authority. Click next a couple of times and complete the wizard.
7. Download and install the Microsoft online services sign-in assistant: http://www.microsoft.com/en-us/download/details.aspx?id=28177
8. Download and install the Microsoft Online Services Module (64-bit): http://onlinehelp.microsoft.com/en-us/office365-enterprises/ff652560.aspx
9. If you used a local name for the AD forest domain (like yourdomain.local) and haven't added yourdomain.com (for example crmpmg.com) as the forest domain in dcpromo setup earlier, go to "Active Directory Domains and Trusts"
   1. Follow this article (http://technet.microsoft.com/en-us/library/cc772007.aspx) and add a UPN suffix for crmpmg.com

   Note: Do the above setup only if you haven't added yourdomain.com as the forest domain in AD. For example if you added crmpmg.local during dcpromo, this UPN addition is necessary, otherwise not required.

10. Login to the Microsoft Online services portal (portal.microsoftonline.com) with the administrator credentials of your demo account. This is typically the first user that was used to provision the trial such as admin@crmpmg.onmicrosoft.com.
11. Add the yourdomain.com (e.g., crmpmg.com) domain name to the "Domains" under Management.
    1. This can be done using the portal web UI or using PowerShell command New-MsolFederatedDomain: http://onlinehelp.microsoft.com/en-us/office365-enterprises/ff637620.aspx
    2. See godaddy specific steps here: http://onlinehelp.microsoft.com/en-us/office365-enterprises/gg584185.aspx.
    3. A visual walkthrough of this specific step is available in this youtube video: http://www.youtube.com/watch?v=JQbdWXFTJfw
    4. Create a TXT entry in the zone file within godaddy.com with the values provided for your subscription in the portal.

       

    5. Wait for a few minutes and go back to the Microsoft online portal and click "Verify" button at the bottom of the instructions page.
    6. Select Exchange Online & Lync Online in the "Specify domain services" step.
    7. If you choose SharePoint Online, it is primarily for the public website hosting on office365.com as explained here. http://onlinehelp.microsoft.com/en-us/office365-enterprises/jj128104.aspx?CompanyType=CompanyTenant&DapEnabled=0&HasLiteSKU=0&HasAdminPermissions=1
    8. Also see "Specify the services you'll use with your domain name" within http://onlinehelp.microsoft.com/en-us/office365-enterprises/f86db0a2-5713-4106-b90a-edd09ff898a2#bkmk_intent?CompanyType=CompanyTenant&DapEnabled=0&HasLiteSKU=0&HasAdminPermissions=1
12. Add a user in the Active Directory Users and Computers ensuring that the UPN suffix is the FQDN suffix (for example testuser@crmpmg.com).
13. Enable Remote Desktop on the box and add the above user to Remote Desktop users.
14. Open Group Policy Editor (gpedit.msc) and allow login through terminal services for remote desktop users as shown in the screenshot below.

    

15. Go into the online services portal and manually add domain users like girishr@crmpmg.com. It will provide a temporary password but you won't use it as you'll use the domain credentials after next step.
    Note: Manually adding domain users is not recommended however the reason we're doing this is because we can test and verify identify federation with just one box without setting up directory synchronization. If you don't add this user now, the only way to add domain users after federation conversation is through directory synchronization.
16. Next step is to convert the domain name to federated (Convert-MsolDomainToFederated -DomainName crmpmg.com) by running the set of commands in http://onlinehelp.microsoft.com/en-us/office365-enterprises/ff652560.aspx.
17. Remote desktop into the VM using CRMPMG\testuser and login to CRM or the portal (portal.microsoftonline.com). When a domain user tries to sign-in, the office365 login page, automatically redirects to the federated login page.

    

18. Active directory then prompts for credentials
    
19. Once you sign-in using AD, you'll immediately login to the portal/CRM.
20. You can disable this secondary authentication prompt by doing the below steps.
    1. Disable Anonymous Authentication and enabling Windows Authentication in IIS as shown in the below screenshot. Restart IIS to ensure the changes have been refreshed.

     

    1. Add https://crmofeddc.crmpmg.com to the "Local Intranet Zone" within IE for the windows credentials to be passed automatically.
    2. Now if you visit the portal (or CRM), you just enter your username and you'll be automatically signed-in using your domain credentials.
21. You can also create single sign-on URL that allows users to login to CRM directly without even entering the username. This is done by appending the CRM URL with whr query string: https://crmpmg0.crm.dynamics.com/?whr=http://crmofeddc.crmpmg.com/adfs/services/trust

DirSync

1. Note that once you've enabled federation, you cannot add AD users through the portal UI. AD users have to be synchronized from AD to the online portal through a tool called DirSync.
2. Visit https://portal.microsoftonline.com/DirSync/DirectorySynchronization.aspx and click "Activate" (step 3) to active directory synchronization.
3. Create a second virtual machine (Windows Server 64-bit image) and join the VM to the CRMPMG AD domain. As always it is certainly a good idea to install all the latest windows updates before proceeding further.

   Note: In Hyper-V, you might want to create an additional network switch (Internal or Private) to bridge the VMs together to able to domain join. This network setup is similar to the 2010 IW VM.

4. Install the pre-requisites for dirsync tool
   1. .NET 3.5 SP1
5. In the second VM, install the DirSync tool: http://onlinehelp.microsoft.com/en-us/office365-enterprises/ff652545.aspx

   Note: Office 365 supports synchronization of up to 50,000 objects (users, groups, etc). To synchronize more than 50,000 objects, contact Office 365 Support.

6. At the end of the install, make sure that the configuration wizard checkbox is selected to start the configuration right after the install.
7. Enter the online services tenant administrator credentials (admin@crmpmg.onmicrosoft.com) followed by domain admin credentials (CRMPMG\administrator).
8. Leave the "Synchronize directories now" checkbox as check and finish the wizard.
9. After a few minutes, you can see that users from Active Directory are now available within the Microsoft Online Services users. You can also verify directory synchronization by following the steps here: http://onlinehelp.microsoft.com/en-us/office365-enterprises/ff652541.aspx. You can easily distinguish domain users as they have a special "Refresh" icon next to them. Select the synchronized users and active them. You'd also want to assign them security roles with CRM for those users to access CRM Online.

   

10. You will also see an error email regarding testuser@crmpmg.com stating that there is conflict during directory synchronization. This is expected since we manually added testuser instead of synchronizing from the directory. You can delete the user within the portal and it'll get added back to CRM after a few hours via synchronization.
11. You can also force directory synchronization using PowerShell (Start-OnlineCoexistenceSync) or using configuration wizard as per the instructions here: http://onlinehelp.microsoft.com/en-us/office365-enterprises/ff652557.aspx.

    

12. And you're done! You now have CRM Online demo environment with federated identity and directory synchronization.

     

Since July 19th 2012, all new sign-ups for Dynamics CRM Online have been switched over to the Microsoft online services environment which is the same subscription/billing platform used by Office 365 and many other services from Microsoft. Among many new things with this switch over, one significant technical change is that it allows CRM Online customers and partners to use the same identity platform as Office 365. This means that users of CRM Online & Office 365 will have the same set of username/password to access various services and it also helps administrators to manage their users in an effective way.

If you are a Dynamics CRM developer or partner developing with the CRM Online web services, you might want to update your code to support the new identity platform (now called as Windows Azure Active Directory - WAAD in short)

For .NET developers, this page on MSDN shows you all the details on updating your code: http://msdn.microsoft.com/en-us/library/hh670628. Also the downloadable SDK code samples have been updated to reflect the various authentication options.

For those that are writing code in platforms other than .NET, you might want to checkout the updated SOAP-only web services sample posted here: http://blogs.msdn.com/b/girishr/archive/2011/02/04/connecting-to-crm-online-2011-web-services-using-soap-requests-only.aspx

You can sign-up for a trial account in the new platform at http://crm.dynamics.com and manage your subscription at the Microsoft Online Services Portal – https://portal.microsoftonline.com. Existing users of CRM Online using Microsoft account (formerly Windows Live ID) will eventually be migrated to the new environment and the timelines for this migration is still TBD.