Rajeev Pentyala – Microsoft Power Platform

Other day I was asked a question “What are the options to create/migrate users in Dynamics 365 application with no license consumption”

The options are

• Create a User of type ‘Stub User’ which does not consume license
• Sync a User from O365 to Dynamics 365 and remove the license later. This approach deactivates the User in D365 and free up the license.
• Create an Application User
• Create an Administrative User account
• Create a Non-Interactive User account

To know different options is crucial, especially, when you are migrating the Users from legacy systems and the Users are not expected to access the D365 application which should not cost any licenses.

In this article, I am going explain the different type of Users and how they consume the licenses.

Administrative User Account:

• An Administrative user is a user, who has access to the Settings and Administration features but has no access to any of the customer engagement functionality.
• Since the administrative user does not have access to customer data and any of the customer engagement functionalities, it does not require a Dynamics 365 (online) license.
• To create an ‘Administrative User’
  • Create a User in Office 365; (Admin Center -> Users -> Active users -> Add a user)
• 
  • Assign a Dynamics 365 license under ‘Product licenses’ tab.
• 
  • Go to D365 application and open the User record
  • On the User form, under ‘Administration’ tab, ‘Client Access License (CAL) Information’ section and select “Administrative” for Access Mode.
• 
  • Final step is, remove the Dynamics 365 license of the User from Office 365, so that you can free the license and still the User can login to the application as ‘Administrative’

Non-interactive User Account:

• Non-interactive user is not a physical User and It is used for programmatic access  to push or pull the data to/from Dynamics 365 applications.
• Non-interactive user let applications (i.e., Consoles, SSIS packages or ERP connector etc.) authenticate and access Dynamics 365 (online), without requiring a Dynamics 365 (online) license.
• Creation of Non-interactive user account is same as Administrative User Account, except setting the Access Mode to ‘Non-interactive’
• There is a limit of five non-interactive user accounts

Application User Account:

• ‘Application User’ is used while establishing server-to-server (S2S) authentication
• ‘Application User’ with conjunction of Azure Active Directory (Azure AD) will establish S2S authentication.
• ‘Application User’ does not consume license.
• Application users are created with a non-interactive user account, however they are not counted towards the 5 non-interactive user accounts limit.

Stub User:

• Stub user cannot log in, cannot be enabled, and cannot be synchronized to Office 365 and will not consume license.
• Stub Users are designed for records that have been imported that refer to this user but the user does not exist in Dynamics 365 (online).
• Stub users are user records that are created in Dynamics 365 using Data Import or using the Create or Create Requests methods of the SDK.

Licensed User:

• Licensed user is an User whom gets created in O365 with license and synced to D365.
• Licensed users must be assigned at least one Dynamics 365 security role to access Dynamics 365 (online).
• The service does not allow access to users who do not have at least one security role.
• Removing all security roles from the user prevents the user from signing into and accessing Dynamics 365 (online). However, it doesn’t remove the license from the user.

Refer article for more details.

Notes:

Following are points to consider before Importing Users

• Imported Users will be in Disabled state in CRM. You have to run a follow up logic to enable Users or you can Bulk Enable users.
• Users’s Business Unit cannot be set during the import. Users will be assigned to the root business unit.
• ‘Salesperson’ will be the default role for all imported users. Import will fail if ‘Salesperson’ role is either deleted or renamed.

🙂