Overview:

Microsoft takes a holistic approach to providing a highly secure environment for Microsoft Dynamics CRM Online. After an overview of the inherent risks to three key areas of the service, the remaining sections of this paper describe how Trustworthy Computing, Microsoft’s core commitment to build software and services that better help protect customers and the industry, is reflected in the design and operation of Microsoft Dynamics CRM Online.

But first, a bit of background from Jon’s article:

A non-interactive user is a user account in Microsoft Dynamics CRM Online that can access the system but only via the web service layer. Essentially, that user can not use the user interface. Service accounts are used to access CRM Online using the service to service model. A service account is a non-interactive user account with the proxy role assigned to it. Microsoft Dynamics Online allows 5 free non-interactive user accounts. To make the user account a non-interactive account, you need to change the access mode. The access attribute is not visible in the UI by default.  The attribute is “access modeâ€?, you can either customize the form to show it, or manipulate it by an SDK call.  Setting the access mode to non-interactive simultaneously frees up a license and prevents that identity from logging in interactively.

He goes on to tell you how to add the Access Mode field to the System User Entity form so that this field can be changed by the administrator.

You may also find it useful to put the Access Mode on the Active Users View, so that it displays when you are reviewing your user list:

Interesting Observation

Last week I was discussing non-interactive users with a colleague when I noticed a rather interesting situation:  If you are out of user licenses for CRM Online you can’t create a non-interactive user through the CRM user interface. Curious, but understandable.

In a nutshell, the New User wizard will inform you that you are out of licenses and not allow you to continue.

You can circumvent the issue by performing these steps:

1. Temporarily disable a user
2. Create a new user and change their Access Mode setting to Non-Interactive
3. Re-enable the user disabled in step 1.

That should do it.

Programmatic User Creation

Nothing, however, will stop you from creating a user programmatically.  You just need to supply the proper values.  Here’s some sample code:

systemuser user = new systemuser();

user.accessmode = new Picklist(SystemUserAccessMode.NonInteractive);
user.firstname = "system";
user.lastname = "integration";
user.businessunitid = new Lookup("businessunit", new Guid("{C9694BD7-C0C4-DE11-B95D-02BF0A0679DB}"));

service.Create(user);

As you can see, you only need four properties:

Access Mode

In this case, we’re going to supply NonInteractive as the value, since that is the purpose of our discussion.

First Name

First name of the user.

Last Name

Last name of the user

Business Unit ID

This is the ID of the business unit the user belongs to.

Calling the CrmService.Create method to actually create the user.

Afterwards, any connection that you need to make to CRM Online can use the new non-interactive user instead of a fully-licensed person.

The customizations include the following features:

• Donation and pledge management
• Basic membership management
• Basic volunteer tracking
• Campaign management
• Excel dashboard reports
• Payment solution for online donations

Unfortunately, at this point it looks like the solution is for CRM Online only due to the fact that CRM Online has a feature called “Visualizations,â€? which are charts, and CRM OnPremise does not.  Since the customizations were created and exported from CRM Online, they will not import into CRM OnPremise.

As a curiosity this morning, I created a test organization and tried importing the customizations (found below) but the CRM OnPremise thought the customization file was invalid because of the extra visualization elements.

Links of Interest

• Original ZDNet article by Mary Jo Foley
• Microsoft Press Release
• Signing up for a Non-Profit CRM Online account
• Documentation, customizations, and other information

Technically, there are four sets of these assemblies in the SDK:

• One set for CRM On-premise
• One set for CRM Online. 
• 32-bit versions
• 64-bit versions

It turns out that Windows Azure is a 64-bit operating system.  Here is how I had to configure Visual Studio to properly generate my new web site:

Platform Target

This needs to be set to Any CPU, which will create code that can be run on either 32-bit or 64-bit operating systems.

Microsoft.crm.sdk.dll Assemblies

You need to reference the 64-bit assemblies.  Otherwise, you’ll end up with the yellow screen of death and a message about unable to load assembly because of an invalid format.

I hope that helps.  Good luck with your own Azure development

If you navigate to Settings, Customization, Download Web Service Description Files, you're presented with the following set of links:

The Discovery Web Service link is:

https://crm.dynamics.com/MSCrmServices/2007/Passport/CrmDiscoveryService.asmx

when it should be:

https://dev.crm.dynamics.com/MSCRMServices/2007/Passport/CrmDiscoveryService.asmx

A minor issue but hopefully this note will save a little confusion. Microsoft has been advised of the issue as well.

Final note: The CRM 4.0 SDK documentation clearly states the correct URL in the walk-throughs and other sample code.  It is only this one link on the actual CRM Online site that is a problem.