Connect Microsoft Dynamics
You register an app in Azure, give that app a security role inside your Dynamics 365 environment, then paste its three values and your environment address into MarqIQ. MarqIQ reads four tables — accounts, contacts, leads and opportunities — and writes nothing back to Dynamics at any point. If you want to know what you are granting before you start, read How connecting a tool works.
Before you start
Plan required
Dynamics needs Pro or above. On Starter the connect attempt is refused with "Microsoft Dynamics is part of the Pro plan — this workspace is on Starter." Pro includes two connected tools besides Google Tag Manager, and one tool from each category, so a Pro workspace with another CRM already connected has to disconnect it first.
Permissions required
Connecting takes two people, and MarqIQ can do neither step for you. Someone with Azure rights registers the app and creates the secret. A Power Platform admin then adds that app to your environment as an application user and gives it a security role. Plan for both before you start.
Read depth decides whether anything syncs
Every read privilege in Dataverse carries a depth. An application user with User-level read owns no records, so Dynamics returns an empty list, MarqIQ has no error to report, and the sync finishes with "Fully synced — 0 records". Grant Account, Contact, Lead and Opportunity read at Organization depth.
The client secret is the one credential with an end date
Nothing in MarqIQ watches it. The connection card still reads Connected on the day the secret dies; what changes is that the next sync stops with "Azure AD refused to issue a token for this app registration". Put the expiry date you chose in Azure into your own calendar.
- Your Tenant ID — Azure portal → App registrations → your app → Overview → Directory (tenant) ID, at portal.azure.com/#blade/Microsoft_AAD_RegisteredApps/ApplicationsListBlade
- Your Client ID — the same Overview page, as Application (client) ID.
- A Client Secret — the same app, under Certificates & secrets. Copy the Value, not the Secret ID.
- Your Organization URL — Power Platform admin centre → Environments → your environment → Environment URL, at admin.powerplatform.microsoft.com/environments
Register the app in Azure
Open App registrations in the Azure portal at portal.azure.com/#blade/Microsoft_AAD_RegisteredApps/ApplicationsListBlade
Register a new application named MarqIQ.
Dynamics names the application user on anything the app does, so a named app is easier to recognise later.
Copy the Directory (tenant) ID and the Application (client) ID from the app’s Overview page.
Create a client secret under Certificates & secrets.
Copy the Value, not the Secret ID. The Value is shown once and cannot be read again.
Choose an expiry you can live with.
MarqIQ stores the secret encrypted and re-uses it for every token it mints, so you are never asked for it again until you replace it. It also never warns you that the date is near.
Write that expiry date in your own calendar.
Give the app a security role in Dynamics 365
An app registration on its own reaches nothing. Dynamics has to know the app as a user of your environment.
Open the Power Platform admin centre at admin.powerplatform.microsoft.com/environments
Open your environment.
Go to Settings → Users + permissions → Application users.
Click New app user.
Pick the app you registered.
Give the app user a security role that reads Account, Contact, Lead and Opportunity at Organization depth.
Accounts are walked first, so one table the role cannot read stops the run before contacts, leads or opportunities are reached. Dynamics reports that refusal as a token problem rather than a permission one, which is why it is worth getting right now.
MarqIQ issues no write of any kind against Dynamics, but the token it holds is not read-only. Choose the role as though the token could write.
Include Organization read, if your role is built from scratch.
This is what makes the connection read "Dynamics 365 — Contoso" instead of a bare web address. It is cosmetic: MarqIQ catches the refusal and carries on.
Include read access to table metadata (EntityDefinitions).
Two screens need it: the UTM Field Validation check on the Dynamics page, which lists the Contact table’s text columns, and the Field discipline analysis, which asks each column whether auditing is switched on. Most standard roles carry it; a role built from scratch may not.
Add the View Audit History privilege, under Miscellaneous privileges, if you want Field discipline.
Auditing can be switched on everywhere and a record’s history still comes back empty without this privilege.
Two table settings that are not privileges
Change tracking, switched on per table in Power Apps → Tables → the table → Settings, is what lets MarqIQ mark a record deleted in Dynamics as gone in its own copy. Auditing, switched on for the environment, the table and each column, is what gives Field discipline anything to read. Both are settings you change in Dynamics, not scopes you grant here, and auditing history starts the day you switch it on, never before it.
Connect it in MarqIQ
Open Integrations in MarqIQ and click the Microsoft Dynamics card.
The catalogue calls it Microsoft Dynamics. The page it opens is headed Microsoft Dynamics 365.
Paste your values into Tenant ID, Client ID and Client Secret.
Paste your environment address into Organization URL.
The https root and nothing else —
https://myorg.crm.dynamics.com, not a page inside it. MarqIQ refuses an address that is not https, or that carries a path, a query string, a fragment, or a username and password.Your region lives inside this address (crm.dynamics.com, crm4, crm11 and so on). MarqIQ assumes nothing about it and calls exactly the host you give.
Click Connect Dynamics 365.
MarqIQ asks Azure for a token, then calls WhoAmI against your environment. Nothing is saved unless both answer. Your organisation’s name is read separately, and the connection is still saved when the security role will not give it.
If Dynamics is already connected the button reads Update credentials instead.
Check the Org ID on the connection card against the environment you meant.
The card shows your organisation’s name, the Org URL and the Org ID that Dynamics itself returned. A right-looking address for the wrong environment fails in no other way.
Leave the tab open while the first sync runs.
Connecting starts the sync on its own. It runs in bounded chunks of about 40 seconds and picks up where it left off, so the first load of a large environment takes several runs rather than one. Close the tab and the run stops where it is; the next sync carries on from the saved position.
Read the result line.
A first load finishes with "Fully synced — N records". Later runs say "Up to date — N changes since your last sync". N is the people in MarqIQ’s copy, contacts and leads together — compare it against an Advanced Find on Contacts plus Leads, not against your whole database. Accounts and opportunities are pulled in the same run and are in no count on screen.
Connecting with an access token instead
Click Only have an access token? Connect temporarily and paste any Azure AD bearer token for your environment into Access Token. MarqIQ records 55 minutes of life for it and cannot renew it. It also keeps sending the token past that mark until Dynamics refuses it, so the way this ends is a sync that stops with "Dynamics 365 rejected the token (401) — reconnect the integration", with no warning before it and the connection still showing as connected. Connecting this way answers with a warning of its own: “Connected with a temporary access token: it expires within the hour and scheduled syncs will stop. Reconnect with an Azure app registration for a lasting connection.” Use it to look around, then reconnect with the app registration. Click Use an app registration instead to go back.
What comes across
- Accounts, contacts, leads and opportunities — every column of every record, not a chosen list. Those four tables are the whole of it.
- Labels rather than raw codes. Option sets, yes/no fields, money and lookups are all asked for with their display values, so the label is what lands in reports and the raw code stays reachable.
- Owner, currency and parent-company names, which arrive as labels on the records themselves. MarqIQ never calls the systemuser or transactioncurrency tables.
- Leads kept alongside contacts as people. A lead whose status reads "Qualified" is marked converted; everything else reads as a lead.
- Who the connection is — a user id, an organisation id and a business unit id, returned by WhoAmI.
- The ids of records that have gone from Dynamics, for tables with change tracking switched on.
- The Contact table’s text columns, for the UTM Field Validation check.
- Which contact, lead and opportunity columns have auditing switched on, and a record’s change history one record at a time — up to 60 people and 60 deals spread across the period.
What MarqIQ writes to Dynamics
Nothing. No record is created, changed or removed, no column is created, and no flow or classic workflow is touched. The only write anywhere in the Dynamics path is the token request to Azure.
Map your UTM columns
MarqIQ cannot create columns in Dynamics as it can in HubSpot: creating one needs a publisher prefix and Metadata API calls. You make the columns yourself and tell MarqIQ their logical names.
Open the Power Apps maker portal at make.powerapps.com
Go to Tables → Contact → Columns → New column.
Create a Single line of text column for each UTM field you want, for example `new_utm_source`.
Come back to the Dynamics page in MarqIQ.
Find the field under UTM Field Validation.
Click Map existing beside it.
Type the logical name into the box.
Type the logical name, not the display label.
Click Save.
Click Save with the box empty and MarqIQ answers "customFieldName required".
Click Refresh to re-read the Contact table.
The fields are the seventeen MarqIQ tracks: nine under Most Recent UTM Fields and eight under First Touch UTM Fields. A green tick means Dynamics already has a matching column, a blue tick means MarqIQ has a mapping saved, and a red cross means neither.
Take care
The check looks only at text columns on the Contact table — the single-line kind. A UTM value held in a multi-line column, in a column of another type, or on the Lead or the Opportunity, reads as missing even though it is there.
What connecting Dynamics unlocks, and what it does not
Six of MarqIQ’s nine analyses can run on Dynamics 365: Source truth, Field discipline, Audience health, Lead scoring, Funnel and Form fills.
- Forecast accuracy cannot run. It needs the history of a deal’s stage, forecast category and close date in a shape MarqIQ reads, and no Dynamics reader exists for it.
- Email cannot run. A CRM does not send marketing email, and the Sales Web API reports no sends.
- Automations cannot run. Power Automate flows and classic workflows are managed in Power Apps and are not exposed through the Sales Web API — the section says so and names make.powerapps.com.
- Field discipline runs only on audited columns. MarqIQ leaves an unaudited column out rather than reading it as never-changed, and names the ones you would want switched on.
In the Integration Audit Report, the Deals section is built from MarqIQ’s synced copy of your opportunities, as of the last sync. Email sends, marketing pages, form submissions and web visits each say that they live in Dynamics 365 Customer Insights – Journeys, a separate product with its own API, rather than showing an empty chart.
HubSpot and Marketo are the pairing for hidden form fields and a built source-tracking workflow. Dynamics does none of that: it is a read-only CRM connection, so run the guided source tracking setup on a form tool and report on Dynamics.
If it did not work
"Microsoft Dynamics is part of the Pro plan — this workspace is on Starter."
Why: Dynamics has a Pro floor in the catalogue, and the connect route checks it before it reads anything you typed.
Fix: Move to Pro or above. Reconnecting a tool this workspace already has is never refused for a plan, so rotating an expired secret works at any limit.
"Pro allows 1 tool from this category, and HubSpot is already connected. Business and above allow more than one from the same category."
Why: Dynamics is a CRM, and Starter and Pro each allow one tool per category. The name in the message is whichever CRM you already have.
Fix: Disconnect the other CRM, or move to Business or above. A separate message — "Pro includes 2 tools besides Google Tag Manager, and this workspace has connected 2" — means you are at the total instead, and any one of the named tools can go.
"This workspace is read-only. Renew the subscription to connect tools."
Why: The subscription has expired. An expired workspace connects nothing, whatever the tool.
Fix: Renew the subscription, then connect Dynamics again.
"Organization URL must be the https root of your environment, like https://myorg.crm.dynamics.com"
Why: What you pasted is not https, or carries a path, a query string, a fragment, or a username and password. A copied address from inside Dynamics almost always carries a path.
Fix: Copy the Environment URL from the Power Platform admin centre at admin.powerplatform.microsoft.com/environments and paste that. Trim everything after the host.
"Enter the Azure app registration (Tenant ID, Client ID, Client Secret) — or, for a temporary connection, an access token."
Why: One of the three app fields reached MarqIQ empty. All three are needed together; two of them is the same as none.
Fix: Fill in Tenant ID, Client ID and Client Secret, then click Connect Dynamics 365 again. To connect with a token instead, click Only have an access token? Connect temporarily and paste it into Access Token.
"Azure AD refused to issue a token — check the Tenant ID, Client ID and Client Secret, and that the app is registered as an application user with a security role in Dynamics 365."
Why: Azure would not mint a token from those three values against that environment. A wrong tenant, a wrong client, an expired or mistyped secret, and a Secret ID pasted in place of the Value all read the same way. So does a Tenant ID that is not a plain id — MarqIQ checks its shape and never sends it. A badly wrong Organization URL fails here too, because the address is also what MarqIQ asks Azure for a token against.
Fix: Re-check all three values rather than only the one you changed last, and check the Organization URL with them. If the secret is old, create a new one in Azure and copy the Value.
"Dynamics 365 rejected the credentials. Check the token or app registration, and that the app user has a security role."
Why: Azure issued a token and Dynamics refused it. The app has not been added to the environment as an application user, or the app user has no security role.
Fix: In the Power Platform admin centre, open your environment, go to Settings → Users + permissions → Application users, add the app with New app user, and give it a role that reads Account, Contact, Lead and Opportunity at Organization depth.
"Organization URL resolves to a blocked (internal) address", "Organization URL host could not be resolved", or "Organization URL returned an unexpected redirect — refusing to follow"
Why: MarqIQ refuses a host that resolves to a private address, and refuses to follow a redirect away from the address you gave. An environment reachable only inside your own network cannot be connected.
Fix: Use the environment’s public address. If the host does not resolve at all, check the spelling of the region in it — crm.dynamics.com, crm4.dynamics.com, crm11.dynamics.com and the rest are different hosts.
The sync reports "Fully synced — 0 records" on an environment full of people
Why: The security role reads at User depth. The application user owns no records, so Dynamics returns an empty list and MarqIQ has no error to report.
Fix: Change the role to read Account, Contact, Lead and Opportunity at Organization depth, then click Sync now.
The sync stops saying Dynamics rejected the token, but the credentials are right
Why: A missing table privilege reads as a token problem. Accounts are walked first, so a refusal there stops the run before contacts, leads and opportunities are reached.
Fix: Check the role grants read on all four tables — Account, Contact, Lead and Opportunity — before you replace the secret.
The connection worked for weeks and now every sync fails at the token step
Why: The client secret expired in Azure. The connection card does not turn red for this: it still reads Connected, and only the sync stops.
Fix: Create a new client secret in Azure, copy the Value, paste it into Client Secret in MarqIQ and click Update credentials. Then click Sync now.
"Dynamics 365 rejected the token (401) — reconnect the integration", on a connection made with an access token
Why: A bare access token cannot be renewed. MarqIQ keeps sending it until Dynamics refuses it, so there is no warning before this.
Fix: Click Update credentials, fill in Tenant ID, Client ID and Client Secret, and reconnect. Scheduled syncs stay stopped until you do.
Field discipline says auditing is not switched on for any contact, lead or opportunity column, and you know it is
Why: The role may lack read access to table metadata (EntityDefinitions). MarqIQ swallows that refusal and reports no audited columns, which sounds true and is not.
Fix: Add that privilege to the security role before you touch your audit settings. If the privilege is already there, switch auditing on in Power Platform admin centre → the environment → Settings → Audit, then for the tables and columns you want checked.
A sync note reads "deletions cannot be tracked — the change-tracking token expired; re-seeding on the next run"
Why: The position in Dataverse’s change feed ages out on your organisation’s ExpireChangeTrackingInDays setting, seven days by default.
Fix: Nothing. The lane re-seeds itself on the next run rather than failing forever. A note naming a different reason means change tracking is off for that table — switch it on in Power Apps → Tables → the table → Settings.
A record deleted in Dynamics is still counted in MarqIQ
Why: Change tracking is off for that table. MarqIQ says so for the table and leaves its own copy alone — a record is never assumed gone because it stopped appearing.
Fix: Switch change tracking on for that table in Power Apps → Tables → the table → Settings, then click Sync now.
A column you created in Power Apps this morning is not listed under UTM Field Validation
Why: The list is read when the page loads, and only single-line text columns on the Contact table are in it.
Fix: Click Refresh. If it is still missing, check the column’s type in Power Apps — a multi-line text column is not in this list.
Owners come back blank on a tightly scoped role
Why: Owner names arrive as labels on the records themselves rather than from a separate lookup, so no extra table privilege covers them.
Fix: Check that the role reads the record’s own table at Organization depth. That is what carries the owner label with it.
Next steps
Related articles
Was this article helpful?