Problem
With the deprecation of Azure Access Control Service (ACS), you should modify the SDK authentication code by removing all references to ACS. Effective from Microsoft Dynamics CRM Online 2016 Update 1 (v8.1.1) and Microsoft Dynamics 365 (v8.2), we removed Live ID support and ACS dependencies on the server-side. It is required to update the references in all client side components by updating the SDK.
Impacted Versions
A client side component is either installed on your server or one of the machine that interacts with Dynamics CRM using Microsoft.Xrm.SDK.DLL. E.g. Email Router, Dynamics Connector, Unified Service Desk etc. For all client components list please refer the “Update the Client Component” section
Any client side component SDK (Microsft.Xrm.SDK.DLL) version 8.0 or lower should be updated to the latest version.
Update the Client Component
The following are the possible client side components that might use ACS
- Custom Application(s) – If you have developed a Web/Windows/Console application that is interacting with Dynamics CRM
- Scan the folders on your server where the solution is running and look for: Microsoft.XRM.SDK.dll. If found, use the table given in the Team Blog site to determine which version of the SDK you need to download.
- Using the table, determine which version of .NET that you have deployed against, and confirm the version of Dynamics 365 CRM service you are using. If you are uncertain which .NET version your solution is using, contact your development or engineering teams.
- Once you have determined the correct SDK version to use simply replace the Microsoft.XRM.SDK.dll found in /bin folder with the latest version of the SDK dll.
![Replace Microsoft.XRM.SDK.dll with latest version of SDK dll]()
- Third-party product(s) – If you are using a 3rd party products developed by a partner or ISV that interacts with Dynamics CRM, please follow the steps below:
- Scan the folders on your server or machine where the solution is running and look for: Microsoft.XRM.SDK.dll. If found, and if the version is older than 8.1.x, contact your ISV or third party product owner as soon as possible for guidance
- ADX Studio v7.* – If you are using ADX Studio V7.* for Portal development, the Adoxio team has provided the guidance for the fixes for ADX Studio and Dynamics 365 Compatibility. Please follow the instructions to update your
- Unified Service Desk (USD) – If you are using USD client that is less than the latest version of USD 2.2 or USD 2.1, please upgrade to USD 2.2 or higher.
- Email Router – If you are currently using Email Router that is less than the latest version of Email Router 8.2 or Email Router 8.1, please upgrade to the latest version by downloading and installing the update located here
- Dynamics Connector – If you are currently using Dynamics Connector solution to connect to an ERP system (GP/AX/NAV/SL), please use the step-by-step guide to update your version
- Report Authoring Extension – If you are developing custom fetch-based reports and use Report Authoring Extension of version 8.0 or below, please apply CRM2016-Srs-KB3154952-LangID-amd64.exe from December 2016 update for Dynamics 365 to update to version 8.2
- Developer Toolkit – If you are currently using Developer Toolkit to develop custom code that is using older Microsoft.Xrm.SDK.DLL (v8.0 or older), please update to the latest version of developer toolkit
The following table list down the action to be taken for each client component for the corresponding Dynamics CRM version
| Area |
Action to be taken by Customers on Dynamics CRM Ver 8.0 & Below |
Action to be taken by Customers on Dynamics CRM/Dynamics 365 Version 8.1 or 8.2 |
| Custom .Net application that is using older Microsoft.XRM.SDK.DLL – | If Microsoft.Xrm.SDK.DLL is 8.0 or older, use the SDK Client as suggested in the Team Blog | If Microsoft.Xrm.SDK.DLL is 8.0 or older, use the SDK Client as suggested in the Team Blog |
| 3rd Party Product that is interacting with Dynamics CRM | If Microsoft.Xrm.SDK.DLL is 8.0 or older, teach out to 3rd Party Product Support | If Microsoft.Xrm.SDK.DLL is 8.0 or older, teach out to 3rd Party Product Support |
| ADX V7.X | Use the SDK Client as suggested in the Team Blog | Use the SDK Client as suggested in the Team Blog |
| Customers on older version of USD (< 2.1) |
Use Latest USD 2.2 or Use the SDK Client as suggested in the Team Blog |
Use Latest USD 2.2 |
| Dynamics Connector (v8.0 or older) | Use the SDK Client as suggested in the Team Blog | Use Latest SDK and apply the fix using the Team Blog |
| Email Router (V8.0 or older) | Use the SDK Client as suggested in the Team Blog | Update to latest Email Router (on SDK 8.2) |
| Report Authoring Extension (v8.0 or older) | Use the SDK Client as suggested in the Team Blog | Update to the latest Report Authoring Extension |
| Developer Toolkit (v8.0 or older) | Use the SDK Client as suggested in the Team Blog | Update to the latest developer toolkit |
How to troubleshoot
One way to diagnose if your client component is still using ACS authentication is to use an HTTP Proxy or router logs looking for access to a specific URL. One such example is the use of Fiddler. In a fiddler trace, you would see a request to the following service
Services to look for:
| Your Org Region | Service |
| APAC | dynamicscrmapac.accesscontrol.windows.net |
| EMEA | dynamicscrmemea.accesscontrol.windows.net |
| NA | dynamicscrmna.accesscontrol.windows.net |
| OCE | dynamicscrmoce.accesscontrol.windows.net |
| JPN | dynamicscrmjpn.accesscontrol.windows.net |
| SAM | dynamicscrmsam.accesscontrol.windows.net |
– Ramana Sridhar Vaidyanathan (RAM)