Microsoft Dynamics 365 Integration

The Dynamics 365 integration pulls Sales opportunities into ScopeStack to pre-populate projects with deal data, and syncs won/lost status back to the opportunity.

Prerequisites

• Azure access with permissions to register applications in Microsoft Entra ID
• ScopeStack Connected Apps permission at the Manage level

Setting Up in Microsoft Entra ID

1. From the Microsoft 365 Admin Center, navigate to Microsoft Entra ID (under Admin Centers, or via All Services > Identity > Microsoft Entra ID).
2. Click + Add > App Registration.
3. Fill in the registration form:
   • Name: A meaningful name for the app (e.g., “ScopeStack Integration”).
   • Supported account types: Select Accounts in any organizational directory.
   • Redirect URI: Select Web and enter https://app.scopestack.io/admin/dynamics/callback.
4. Click Register.
5. On the app overview page, note your Application (Client) ID and Directory (Tenant) ID — you will need both in ScopeStack.

Add API Permissions

1. In the app’s Manage menu, click API Permissions.
2. Click + Add a Permission and select Dynamics CRM.
3. Select Delegated Permissions, check user_impersonation, and click Add permissions.

Create a Client Secret

1. In the app’s Manage menu, click Certificates & secrets.
2. Click + New client secret, give it a name, select an expiration term, and click Add.
3. Copy the Value immediately — this is the only time it will be displayed. If you navigate away, you must create a new secret.

Configuring in ScopeStack

Navigate to Settings > Connected Apps and click the Microsoft Dynamics tile.

On this screen: The Connected Apps page lists available integrations as tiles. Locate the Microsoft Dynamics tile and click it to open the integration setup page.

Enter your Application (Client) ID, Directory (Tenant) ID, and Client Secret, then click Submit.

On this screen: The Microsoft Dynamics setup form prompts you for your Application (Client) ID, Directory (Tenant) ID, and Client Secret. Fill in the values you noted during app registration.

You will be redirected to Dynamics to authenticate. After authorizing, Dynamics will sync opportunities at the next scheduled sync interval.

Configuration Options

Opportunity Product Type

A comma-separated list of product type identifiers. When set, only opportunities that include at least one of these product types will appear in ScopeStack. Leave blank to include all opportunities regardless of product type.

Should Mark Won?

Check this box if an opportunity marked Won in Dynamics should also be marked Won in ScopeStack. When enabled, ScopeStack updates the project status to reflect a closed-won outcome whenever the connected Dynamics opportunity is won.

Worth knowing before you enable it: this applies to every project linked to that opportunity, including any that are part-way through an approval workflow. Those projects are moved straight to Won and the remaining approval levels never run. The approval requests already raised are left outstanding rather than cancelled, so if an approver acts on one afterwards the project can move back out of Won. If your team relies on approvals completing, leave this off, or make sure opportunities are not marked Won in Dynamics until ScopeStack approvals have finished.

This setting also changes status on the next scheduled sync rather than immediately, so expect a delay between the salesperson closing the opportunity and the project status changing.

Should Mark Lost?

Check this box if an opportunity marked Lost in Dynamics should also be marked Lost in ScopeStack. When enabled, ScopeStack updates the project status to reflect a closed-lost outcome whenever the connected Dynamics opportunity is lost.

Verifying the Connection

After authenticating, check for synced opportunities under the CRM Opportunities section of any project. If no opportunities appear after the first sync interval, confirm that the user_impersonation permission was granted and the Client Secret has not expired.

Troubleshooting

The connection shows Connection Error and syncing has stopped

Most token expirations never reach you. ScopeStack refreshes the Dynamics token automatically as part of each sync using the stored refresh token, so an ordinary expiry is handled without anyone doing anything.

A revoked grant is different, and it is what a Connection Error usually means. Consent being withdrawn by an administrator, the grant expiring, or a password change on the connected account can all invalidate it. Once that happens no refresh can recover the connection, and reconnecting is the only option.

To reconnect, go to Settings > Connected Apps > Microsoft Dynamics and choose Reconnect. That opens a Microsoft authorization window. Whether Microsoft asks the user to sign in again or completes silently against an existing session is Microsoft’s decision, but the window has to open and finish either way, so allow pop-ups for ScopeStack before you start. While the connection is in Connection Error, Reconnect is the only action available to you; Enable and Disable apply to other states.

Finding the actual error

The connection tile does not show it. The “Additional Information” column on the Connected Apps page reports sync counts, not failures. Open the connection and use the Integration Activity tab, or the (View Activity) link shown next to a Connection Error status.

What you will see there is Microsoft’s own message passed through, prefixed by ScopeStack. A revoked grant typically reads invalid_grant: AADSTS50173, with Microsoft’s description noting the grant was revoked and that the user might have changed or reset their password.

Note that invalid_grant also appears in a completely unrelated context: it is one of the ScopeStack API authentication errors. An AADSTS code means the message came from Microsoft and concerns this Dynamics connection.