Integrating with Microsoft Dynamics 365 and Power Apps

Integrating your ServiceNow instance with the Microsoft Dynamics 365 and Power Apps service enables you to track your software subscriptions and to reclaim unused licenses.

Important:

This integration retrieves user subscription details for all Microsoft Dynamics 365 and Power Apps products. Furthermore, Software Asset Management provides license compliance for the products using user subscription-based models.

For optimization, Software Asset Management automatically tracks the last activity date and identifies low-usage for the following applications:

• Dynamics 365 for Sales (Professional, Premium, Enterprise)

• Dynamics 365 for Customer Service (Professional, Enterprise, Enterprise for Government, Professional Attach to Qualifying Dynamics, Sales and Customer Service Enterprise)

• Dynamics 365 for Team Members

• Microsoft Relationship Sales (MRS)

For more information about the Microsoft 365 service, see Microsoft 365 frequently asked questions.

Important: Minimize security risks and protect information by granting access only to the necessary user or API permissions.

<table id=“table_box”><thead><tr><th>

Process

</th><th>

Required user role in Microsoft Dynamics 365 and Power Apps for Delegated permissions

</th><th>

Authentication scopes for Delegated permissions

</th><th>

Required user role in Microsoft Dynamics 365 and Power Apps for Application permissions

</th><th>

Authentication scopes for Application permissions

</th></tr></thead><tbody><tr><td>

Download subscriptions

</td><td>

Global Reader

</td><td>

• LicenseAssignment.Read.All

• User.Read.All

</td><td>

Application developer

</td><td>

• LicenseAssignment.Read.All

• User.Read.All

</td></tr><tr><td>

Pull user activity

</td><td>

Dynamics 365 administrator, or a custom security roleFor details, see Create a custom security role for the Microsoft Dynamics 365 integration.

</td><td>

user_impersonation

</td><td>

Not supported by Microsoft

</td><td>

Not supported by Microsoft

</td></tr></tbody> </table>## Set up Microsoft Azure Active Directory

Set up Microsoft Azure Active Directory (AD).

Before you begin

Role required: Global administrator

Procedure

1. Log in to the Microsoft Azure portal using an admin account and navigate to Azure Active Directory.

2. Navigate to the App registrations section and select App registration under + Add.

3. On the Register an application form, fill in the fields.

<table id=“table_oqq_3cy_y2c”><thead><tr><th>

Field

</th><th>

Description

</th></tr></thead><tbody><tr><td>

Name

</td><td>

Name of the application that you want to register.

</td></tr><tr><td>

Supported account types

</td><td>

The account with the required organizational directory.

</td></tr><tr><td>

Redirect URI

</td><td>

URL that accesses Azure. Typically the URL of the ServiceNow instance.Important: You must select Web in the Select a platform drop-down list because Azure AD app must be a web application in App registration for this setup.

</td></tr></tbody> </table>4. Select Register.

1. Open the application that you registered and navigate to the Overview section.

2. Collect the Application (client) ID and Directory (tenant) ID.

3. Navigate to the Certificates and Secrets section.

4. Create a client secret by selecting New client secret and collect the client secret key.

   You need the client secret key while configuring your ServiceNow instance.

5. Under API Permission, select Add a permission and then select APIs my organization uses.

6. Select Microsoft Graph and add the required scopes for Delegated permissions or Application permissions.

   • Organization.Read.All

   • User.Read.All

   • Offline_access

7. Select Dynamics CRM and add the following scope.

   user_impersonation

   Note: User_impersonation scope is offered only as a Delegated permission in Microsoft Dynamics CRM.

8. Grant admin consent for your application by selecting Grant admin consent.

9. In the Authentication section, under the Redirect URI, enter the redirect URI of the ServiceNow instance.

Set up Microsoft Dynamics 365 and Power Apps

Set the system-level settings for Microsoft Dynamics 365 and Power Apps.

Before you begin

Role required: admin

Procedure

1. Go to https://admin.powerplatform.microsoft.com/.

2. Under Environments, select the environment for which you want to pull the dynamics activities.

3. From the top ribbon, select Settings.

4. Select Audit and logs.

5. Select the following check boxes.

   • Start Auditing

   • Log access

   • Read logs

6. Select Additional Audit Settings.

7. From the Settings list, select Auditing.

8. Select Global Audit Settings.

9. Select the following check boxes.

   • Start Auditing

   • Audit user access

   • Start Read Audit

   • Common Entities

   • Sales Entities

   • Customer Service Entities

10. Select OK.

Create a custom security role for the Microsoft Dynamics 365 integration

Create a custom role in the Power Platform admin center that grants only the privileges required by the Microsoft Dynamics 365 and Power Apps integration. You can use this custom role for the minimum permissions instead of using the Dynamics 365 administrator role.

Before you begin

Role required: Global administrator

About this task

The Microsoft Dynamics 365 and Power Apps integration requires read access to user, activity, and metadata tables to pull user activity data. Rather than assigning the Dynamics 365 administrator role, you can create a custom security role with only these privileges.

Procedure

1. Log in to the Power Platform admin center.

2. Under Environments, select the environment that you want to integrate with your ServiceNow instance.

3. Select Settings.

4. Under Users + permissions, select Security roles.

5. Select New role.

6. Enter a name for the security role.

   For example, SaaSIntegrationDynamics.

7. On the Tables tab, assign the following table privileges.

   Table Name Record ownership Read User systemuser Business Unit Organization Activity activitypointer User or Team Organization SharePoint Document sharepointdocument User or Team Organization Attribute attribute None Organization Entity entity None Organization Relationship Entity relationship None Organization

   Note: The integration requires read access only, so you set the Create, Write, and Delete privileges to None for all tables.

8. On the Miscellaneous privileges tab, assign the View Audit Summary privilege (prvReadAuditSummary) at the Organization level.

What to do next

Assign the custom security role to the user account with which the Microsoft Dynamics 365 and Power Apps integration authenticates.

Set up ServiceNow instance for Microsoft Dynamics 365 and Power Apps

Set up ServiceNow instance for Microsoft Dynamics 365 and Power Apps to track your software subscriptions and to reclaim unused licenses.

Before you begin

Role required: sam_integrator

Important: You must select the Microsoft Dynamics 365 Spoke check box for this integration while installing optional features on the Application Manager page. For more information about choosing the required SaaS applications, see Request SaaS License Management.

About this task

If you’re using Software Asset Workspace, the option to create the Microsoft Dynamics 365 and Power Apps integration profile in Core UI is inactive.

Procedure

1. Navigate to the integration profile.

<table id=“choicetable_o3p_z3k_qtb”><thead><tr><th align=“left” id=“d140201e1046”>

Interface

</th><th align=“left” id=“d140201e1049”>

Action

</th></tr></thead><tbody><tr><td id=“d140201e1055”>

Core UI

</td><td>

1. Navigate to All > Software Asset > SaaS License > Direct Integration Profiles.

2. Select New.

3. Select Microsoft Dynamics 365 and Power Apps Integration Profile.

</td></tr><tr><td id=“d140201e1097”>

Software Asset Workspace

</td><td>

1. Navigate to License operations > User Subscriptions > Direct integration profiles.

2. Select New.

3. Select Microsoft Dynamics 365 and Power Apps from the drop-down list.

4. Select Continue.

</td></tr></tbody> </table>2. In the Display name field, enter a name of your choice.

1. Under the Calculate Activity Subflow tab in the Analyze user activity from field, select the date since when you want to pull the activity.

2. Select Save.

   A draft integration profile is created. In the Download Subscription Subflow tab, the Connection & Credential field appears and is automatically set to sn_ms_365_spoke.Microsoft_365_Graph. In the Calculate Activity Subflow tab, the Connection & Credential field appears and is automatically set to sn_ms_365_spoke.Microsoft_365_Dynamics.

3. Under the Download Subscription Subflow tab, beside the Connection & Credential field, select the preview icon [Omitted image "preview-icon.png"] and then select Open Record in the record preview.

4. On the Connection & Credential Aliases form, select the Create New Connection & Credential related link.

5. In the Create Connection and Credential dialog box, fill in the fields.

<table id=“table_h1c_3p1_vjc”><thead><tr><th>

Field

</th><th>

Description

</th></tr></thead><tbody><tr><td>

Connection name

</td><td>

A meaningful name for the connection.

</td></tr><tr><td>

Connection URL

</td><td>

The URL of your Microsoft Dynamics 365 environment. For example, https://graph.microsoft.com.

</td></tr><tr><td>

Permission type

</td><td>

The type of permission for the integration profile to access data correctly and securely. Values include:

• Application Permissions: Enable the application to access any data without a signed-in user.

• Delegated Permissions: Enable the application to act in place of a signed-in user. Note: If you have selected Delegated permissions while setting up Microsoft Entra ID, you must select Delegated Permissions as the permission type. Similarly, if you have selected Application permissions while setting up Microsoft Entra ID, you must select Application Permissions as the permission type.

</td></tr><tr><td>

Tenant ID

</td><td>

The Directory (tenant) ID that you copied in Set up Microsoft Azure Active Directory.

</td></tr><tr><td>

OAuth Client ID

</td><td>

Application (client) ID for the application you created in the Azure portal.

</td></tr><tr><td>

OAuth Client Secret

</td><td>

Client secret for the application you created in the Azure portal.

</td></tr><tr><td>

OAuth Redirect URL

</td><td>

https://<instance-name>.service-now.com/oauth_redirect.do, where <instance-name> is the name of your ServiceNow instance.This field is visible when you select Delegated Permissions as the permission type. This value is automatically populated.

</td></tr></tbody> </table>8. Select Create and Get OAuth Token.

**Important:** For the role required to perform this step, refer to the [Minimal user permissions](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/it-asset-management/saas-license-management/integrating-with-microsoft365.md) table.

1. If you’re prompted to log in to your Microsoft 365 account, enter your Microsoft 365 credentials and log in to your account.

2. Under the Calculate Activity Subflow tab, beside the Connection & Credential field, select the Preview icon [Omitted image "preview-icon.png"].

3. On the Connection & Credential Aliases form, select the Create New Connection & Credential related link.

4. In the Create Connection and Credential dialog box, fill in the fields.

   Field Description Connection name A meaningful name for the connection. Connection URL The URL of your Microsoft Dynamics 365 environment. For example, https://myorg.crm.dynamics.com. OAuth Client ID Application (client) ID for the application you created in the Azure portal. OAuth Client Secret Client secret for the application you created in the Azure portal. OAuth Redirect URL https://<instance-name>.service-now.com/oauth_redirect.do, where <instance-name> is the name of your ServiceNow instance.

5. Select Create and Get OAuth Token.

   Important: For the role required to perform this step, refer to the Minimal user permissions table.

6. On the integration profile form, select Validate Connection to verify the connection and credential details of this integration.

   Validating the connection verifies the Download Subscriptions and Calculate Activity APIs, but not the Reclaim Subscriptions APIs.

7. After the connection is verified, select Publish.

8. In the Publish Confirmation dialog box, select OK.

   Note: If you clear the Download Activity check box after the integration profile is published, you must revalidate the connections and then republish the integration profile because the following events occur:

   • The Status field on the integration profile form changes to Draft.

   • The Validate connection button shows up on the form.

   • The current SAM - Refresh <displayname> Activity job gets deleted.

What to do next

After the integration connects, your ServiceNow instance automatically creates software models, reclamation rules, and software subscriptions that are refreshed daily.

After creating an integration profile, view information about the profile in the Software Asset Workspace by navigating to License operations > User subscription > Direct integration profiles. You can select an integration profile to view the following related lists. If all of the following related lists aren’t visible for an integration profile in the default view, you can select the custom integration view from the Details tab:

• Software Models

• Unrecognized Subscription Identifiers

• Scheduled Jobs

• Scheduled Job Results

• Software Subscriptions

• Subscription Identifier Exclusion Rule

• Subscription User Exclusion Rule

After creating an integration profile, you can define subscription exclusion rules to keep certain subscriptions from license cost calculations. For more information, see Subscription exclusions for SaaS and SSO applications.

If you want to set up multiple integration profiles with unique connections, create child aliases to manage different configurations and settings for each integration profile. For more information, see Create a child alias to set up multiple integration profiles.

Review all automatically generated reclamation rules to reclaim user subscriptions. For more information, see Review a software reclamation rule.

Create software entitlements for the automatically generated software models to track used software against owned software.

• For more information on creating software entitlements in the Software Asset Management Core UI, see Create entitlements in Software Asset Management Core UI.

• For more information on creating software entitlements in the Software Asset Workspace, see Create entitlements in workspace.

• For more information on creating software entitlements using the Software Asset Management Playbook, see Create entitlements using the guided walk-through.

Reconciliation also runs on your subscriptions as a scheduled job or on-demand. You can view your reconciliation results in the License Workbench (Software Asset Management classic application) or the License usage view (Software Asset Workspace). Use these results to determine your license compliance position and to remediate any non-compliance.

• For more information on running reconciliation in the Software Asset Management classic application, see Run software reconciliation in Software Asset Management classic.

• For more information on running reconciliation in the Software Asset Workspace, see Run software reconciliation in the workspace.

Optimizing Microsoft Dynamics 365 subscriptions

Evaluating the software usage activity of Microsoft Dynamics 365 subscriptions helps you monitor license usage, optimize license allocation, and potentially reduce costs for the assigned licenses. Software usage activity refers to how software products are being used.

Based on the software usage activity and the incurred cost, Software Asset Management generates optimization recommendations for your software subscriptions that include the following:

• Low usage subscriptions

  Software Asset Management recommends reclaiming the low usage subscriptions. For example, if the last activity date is 60 days prior to the current date, the subscription is considered a low usage subscription.

• Consolidated subscriptions

  If a user has multiple base licenses for different Microsoft Dynamics 365 applications, Software Asset Management recommends consolidating the subscriptions to optimize licensing. This approach involves purchasing one base license and obtaining the rest as attached licenses, ensuring compliance with Microsoft's licensing terms while being more cost-effective.

  For example, if Dynamics 365 Commerce, Dynamics 365 Finance, and Dynamics 365 Human Resources base license subscriptions are purchased for a user, Software Asset Management recommends using Dynamics 365 Commerce as base license and Dynamics 365 Finance and Dynamics 365 Human Resources as attached licenses to the base license. For more information, you can download the Dynamics 365 Licensing Guide from the Dynamics 365 pricing overview page.

After completing the Integrating with Microsoft Dynamics 365 and Power Apps integration, you can view the usage activity information in the Software Subscription [samp_sw_subscription] table.

Related topics

Reclamation rules for SaaS and SSO applications