The Delegated Administrator in CRM

The Delegated Administrator allows us, as a Dynamics CRM Partner, to gain access to a Dynamics CRM organization or O365 Portal without the requirement of a license whatsoever. Previously the delegated admin could only do administrative tasks, but now he can also do customizations in the Dynamics CRM organization.

Admins for CRM Online can use their Office 365 global administrator role to create and edit users, reset user passwords, manage user licenses, manage domains, and assign admin permissions to other users in their organization, among other things.

However, if admins want someone else to do these administrative tasks, then they can delegate this role to an authorized CRM partner.

When admins authorize a partner to take on this role, the partner is referred to as a delegated admin. A delegated admin can perform routine tasks such as adding users and resetting passwords, or more complex tasks such as adding a domain. A delegated admin can have access to multiple tenants, which can simplify and consolidate tenant management.

You can see the new Delegated Admin user in Microsoft Dynamics CRM Online revisions 2040 or greater or in Microsoft Dynamics CRM Online 2015 Update 0.2. This user won’t appear in standard provided views. You must create a custom view to see it.

To create a simple custom view to see the delegated admin user:

1. Go to Settings > Security > Users.
2. Choose Select a view () and then choose Create Personal View.
3. Verify Users is selected in Look for.
4. Choose User > Contains Data, and then choose Results.

How to get authorized as a delegated admin

CRM partners can be authorized to be delegated admins for a company in several ways:

1. A partner can offer the customer to become a delegated admin for their account by sending a link to the delegated admin offer. The customer will need to accept and sign in with their Office 365/Microsoft Dynamics CRM Online credentials.
2. A partner can send the customer a purchase offer link with delegated admin selected as part of the offer. The customer will need to sign up for the offer and accept the delegated admin offer.
3. A partner can create a trial invitation link to Microsoft Dynamics CRM Online and invite the customer to the trial via a link in email or a link on the partner’s website. The trial invitation can include delegated admin if the prospect chooses to accept.

Some of the restrictions of the delegated admin

The delegated admin has as default the system administrator role in the Dynamics CRM organization. This allows him to own records, do customizations etc. Nonetheless, I have discovered some restrictions inside the system for this user, feel free to share yours in the comments:

• The delegated admin cannot be linked to your Outlook client
• The delegated admin cannot have an image in the CRM system
• The delegated admin has the access mode of “delegated admin”. This kind of access mode isn’t even mentioned in the technical documentation. This restricts him to change the access mode of other users, e.g. he cannot set a CRM user to non-interactive access mode. So if you’re setting up a CRM user to be used as a connector user, you’ll still need the help of the organization’s system admin.
• The delegated admin cannot perform CRUD operations through the web service endpoint. (UPDATED on 21/11/2016, based on comment of Winston)

In case you forgot about Access modes…

Access modes specifies the type of access that this user has to Microsoft Dynamics CRM. This is sometimes referred to as the type of user.

• Administrative – The user has access to the Settings area but does not have access to the Sales, Marketing, and Service areas.
• Non-Interactive – The user can access the system but only through the Web service.
• Read – The user has read-only access.
• Read-Write – The user has both read and write access.
• Support User – The user was created by the Microsoft Dynamics support team.

Source: For partners: the Delegated Administrator and User and team entities