CRM 2013 Exchange Synchronization

Untill version 2013 of Dynamics CRM we had two ways to processing incoming and outgoing email on CRM:

• CRM Email Router
• CRM Outlook Client

With Dynamics CRM 2013 the Asynchronous service now provides server-side Exchange Synchronization so there is no need for the old component, even due they are still exists. The Exchange Synchronization allowing users to:

• Process outgoing emails
• Process incoming emails
• Synchronize contacts, tasks and appointments
• Automatically tracking emails based on Correlation rules (smart matching or/and tracking token)

On this post I will walk-through how to set up Exchange synchronization with Dynamics CRM 2013, here is an overview of the steps:

1. Set up an IIS self-signed certificate (it requires SSL)
2. Configure Exchange Impersonation
3. Create and configure a CRM 2013 Exchange profile
4. Configure User Mailboxes
5. Configure CRM global Email Settings
6. Test synchronization
7. Design Overview
8. known issues
9. Summary and References

Before we start configuring CRM 2013 with exchange we need to have in-place HTTPS. We just need a self-signed certificate generated by IIS to get us going.

Step 1 :
  Self-signed Certificate To generate the certificate open IIS and highlight the server name and double click Certificates

• On the right-hand side click on Self-signed certificate
• Give it a Name (I call it MyCertificate) leave Personal and click OK
• You should see the certificate listed on the list:
• 

• Next step is to bind the Dynamics CRM website to HTTPS (443) Highlight the Dynamics CRM web site under sites and on the right-hand side chose Bindings. The below window opens and on the type field you choose HTTPS  this will enable the SSL certificate field to choose a certificate and we choose the MyCertificate, click OK
• 

Step 2: Exchange Account Impersonation
Before we start Configuring profiles in CRM we want to make sure CRM service account has impersonation rights on the Exchange side to do this we run the following PowerShell command: Exchange 2010 New-ManagementRoleAssignment -Name “” -Role:ApplicationImpersonation -User “<service_account>” For example: New-ManagementRoleAssignment -Name “CRM ExServiceAcc” -Role:ApplicationImpersonation -User crm13.service Exchange 2007 Get-MailboxServer “<mailbox_server_name>” | Add-AdPermission -User “<service_account>” -AccessRights ExtendedRight -ExtendedRights ms-Exch-EPI-May-Impersonate, ms-Exch-EPI-Impersonation The second PowerShell command requires the Distinguished Name (DN) of the Microsoft Client Access Server (CAS).   To enable impersonation rights on a single Microsoft CAS server use the following command:   Get-ClientAccessServer -Identity “<cas_server_name>” | Add-AdPermission -User “<service_account>” -ExtendedRights ms-Exch-EPI-Impersonation
Step 3 :
Configuring CRM Exchange Profile With the https binding in-place navigate to CRM using https://server/organization and settings > Email Configuration Click on Email Server Profiles and then New Exchange Profile:

• 

• 

Fill in the details as per the below screenshot, you could use auto-discovery if it’s working okay for you, I have tested in my environment and worked perfectly. The service account we specified has been given server-wide impersonation. I’ve named the profile UK Mailboxes if you have users across different countries and exchange servers located on these sites you should create multiple profiles with the corresponding Exchange servers.

• 

Leave the Advanced settings as they are:   Navigate to Mailboxes and on the Ribbon choose Add Existing Mailbox, by default every user created or imported during an organization import it’s automatically generated a mailbox in the system, so when you click add existing mailbox the system will list all available user accounts.

•  
•  

 Step 4 :
Configuring Mailboxes At this stage we have created an Email Server Profile and added 2 mailboxes, lets double click on one of the mailboxes: Change the: Server Profile: UK Mailboxes (the profile we just created) Incoming Email: Server-Side Synchronization or Email Router Outgoing Email: Server-Side Synchronization or Email Router Note: on the configuration test results you should see Not Run instead of Success the screenshot was taken after the configuration was completed

•  

Approve the Email and then click on Test & Enable Mailbox: You then get the following alert message on the mailbox profile:

• 

Click on Alerts and in a few seconds you will see the following messages coming up:

•  

This means all checks completed successfully and you ready to test it in Outlook. If you look back at the Mailbox General tab you should now see the Configuration test results as Success. During this test a test email is sent to your Inbox: This is a test message to check the outgoing email configuration for [User].
Step 5 :
CRM Global Email settings Before we start the Outlook test, lets first look at the CRM Global Email settings navigate to: Settings > Administration > System Settings Go to the Email Tab, on this section there are a number of important settings that you should think from a design phase rather than implementation. Configure email processing: here you define which default method you want to process users email as it says if you choose Server-Side it will block Email Router. As we want to test server-side synchronization choose server-side instead of Email router. Configure default synchronization method: This will define users profile preferences and this is very important from a design perspective because will avoid duplicating work. If all your users are in UK you can default a server profile to UK Mailboxes, if you have users across different countries you could still define a default Email Server Profile using auto-discovery and then workout manually any specific users that require a manual Server Profile. On the incoming, outgoing email and appointments, contacts and tasks default this to Server-Side synchronization or Email Router this will make sure it can use both.

•  

Below you define if you should only process emails for approved users, this means if email processing is not a sensible subject in your implementation then I would recommend you untick this boxes because it removes an extra click on the configuration steps as we have seen above.

•  

Step 6 : Test Synchronization
You ready to test the exchange synchronization create one appointment in CRM and include as required yourself and another CRM user fill in the other details and SAVE in a few minutes if all works well a meeting request is received in Outlook by all users.

• 
• 

To test sending emails confirm that on the Configure Email processing in the Global email settings is set to server-side synch, send an email to someone from CRM and ask that person to reply back, you should see the email tracked automatically in CRM.

CRM 2011 IFD Multi-Tenency Migration Tips

Following on from that we tested the migration from CRM 4.0 hosted CRM instillations to the newly configured test environment for CRM 2011.
We ran into a few problems (and a few things we did not know) and thought others may benefit from this.

CRM Migration

The process was reasonably simple for us and for that reason we will just list the steps.

1. Backup the CRM 4.0 database to file.
2. On the new CRM 2011 SQL server, perform a normal SQL database restore from the backup file.
3. Use the CRM 2011 deployment tool to “Import and Organisation”. Specifying the obvious settings for the database selection and user mapping. (In our case, we were on the same domain, so user mapping was easy).

All this worked well, but there were a few problems when we went to browse the new Org from outside the server. In other words, using the IFD to access the org.
Internally the org was accessible with https://internalcrm.domain.com/orgname  but external access: https://orgname.domain.com:xxx  failed.

The Problems

First one

Was simple but only because we have seen it before. Originally we had accessed the org from our IE 9 browser with https://org.domain.com and accessed the CRM 4.0 IFD. Actually we used it for over a year.
Now we wanted to use the new IFD on CRM 2011, but on the same browser. We found when going to: https://org.domain.com:444 that the browser was not even rendering the request for user name and pass that we expected:

The IE failure gave no message or indication of why. Basically a 404 failure to hit anything useful.
Yet in another “real browser” (not IE) we could at least get prompted for user and pass info.

The Cause

IE really sucks with clearing old data. The delete all / clear cache / remove cookies appears on the outset to dump everything, but it does not. In our case, it cached something from the previous connection to CRM 4.0 that was killing our access. We then also deleted data in “C:\Windows\Temp”  Can’t explain what the cause is… I would just rather put it down to the fact that IE 9 “blow chunks” (big ones).
The solution is to manually navigate to the Temporary Internet Files directory under Windows, and manually delete everything you find in there. That fixes the page rendering issue.
More information here: http://www.interactivewebs.com/blog/index.php/crm/crm-2011-server-error-404-file-or-directory-not-found/
The Second One
Second, we entered a user name and pass, and received a message:

There was a problem accessing the site. Try to browse to the site again. If the problem persists, contact the administrator of this site and provide the reference number to identify the problem. Reference number: numbers

There was a matching set of AD FS 2.0 Event Logs that looked like this:

A token request was received for a relying party identified by the key ‘https://org.domain.com:444/default.aspx’, but the request could not be fulfilled because the key does not identify any known relying party trust.
Key: https://org.domain.com:444/default.aspx
This request failed.
User Action
If this key represents a URI for which a token should be issued, verify that its prefix matches the relying party trust that is configured in the AD FS configuration database.

and

Encountered error during federation passive request.
Additional Data
Exception details:
Microsoft.IdentityServer.Web.InvalidScopeException: MSIS7007: The requested relying party trust ‘https://org.domain.com:444/default.aspx’ is unspecified or unsupported. If a relying party trust was specified, it is possible that you do not have permission to access the trust relying party. Contact your administrator for details.
at Microsoft.IdentityServer.Web.FederationPassiveAuthentication.SubmitRequest(MSISRequestSecurityToken request)
at Microsoft.IdentityServer.Web.FederationPassiveAuthentication.RequestBearerToken(MSISSignInRequestMessage signInRequest, SecurityTokenElement onBehalfOf, SecurityToken primaryAuthToken, String desiredTokenType, Uri& replyTo)
at Microsoft.IdentityServer.Web.FederationPassiveAuthentication.RequestBearerToken(MSISSignInRequestMessage signInRequest, SecurityTokenElement onBehalfOf, SecurityToken primaryAuthToken, String desiredTokenType, MSISSession& session)
at Microsoft.IdentityServer.Web.FederationPassiveAuthentication.BuildSignInResponseCoreWithSerializedToken(String signOnToken, WSFederationMessage incomingMessage)
at Microsoft.IdentityServer.Web.FederationPassiveAuthentication.BuildSignInResponseCoreWithSecurityToken(SecurityToken securityToken, WSFederationMessage incomingMessage)
at Microsoft.IdentityServer.Web.FederationPassiveAuthentication.BuildSignInResponseForProtocolRequest(FederationPassiveContext federationPassiveContext, SecurityToken securityToken)
at Microsoft.IdentityServer.Web.FederationPassiveAuthentication.BuildSignInResponse(SecurityToken securityToken)

The solution

An easy one, but something we did not know. With CRM 2011 in IFD. Each time you add an org, you need to update your Relying Party Trusts from Federation Metadata. Big words that mean…

1. Open AD FS Management Tool
2. Expand Trust Relationships
3. Click on Relying Party Trusts
4. Click on you IFD Trust, Right Click and Select Update From Federation Metadata

I have no idea why this is not automatically updated every time the service starts, or even every time the service is called upon….

 

 

CRM 2011 Email Router Setup and Settings

Often with the setup of CRM 2011. Users experience messages about Pending e-mail warning and sometimes email messages are not sending.

This can be especially frustrating as both the CRM email queuing and tracking system and the Email router application are terrible to help you understand exactly what is going on with your CRM e-mail.
We mentioned some of the issues we have experience here:
http://www.interactivewebs.com/blog/index.php/server-tips/crm-2011-email-router-problemsshes-a-fickle-bitch/

Here are some basic setup tips for email in Microsoft CRM 2011

1. Out of the box, CRM does not send email messages. You need to configure an application known as CRM 2011 Email Router to have email messages send.
2. You also need a working SMTP (email server) that is configured to allow the relay of email messages from email accounts at your domain name. This can be achieved with Amazon SES message service or your own servers. We can assist you setup Amazon SES if you need assistance with this.
3. You should install and configure your Email Router. Some notes to help you may include these: http://www.interactivewebs.com/blog//?s=email+router

Recommended email settings in CRM 2011

1. Out of the box. CRM will only be able to send email messages to leads, contacts, and accounts. Until you change this setting found in the Admin / System Settings in CRM.

2. Avoid delayed email messages in CRM by Approve Email Address. In the Administration / Users. Go into each user and approve the configured email address.

There is a view of users who are Pending Email address approval to help identify who is needing approval.

Also uncheck the option for Process emails only for approved users and process email only for approved queues. Administration / System Settings.


3. Configure users email settings to use the email router for outbound email messages. (optionally inbound configuration too).

Our recommendation is to set the outbound processing for the email router. This will allow emails generated by the crm system to be delivered right away via the email router. This also means that you do need to install and configure the email router.
The above settings can be set automatically for all users by the use of a simpler out of the box workflow that runs on create of new users.

4. The next setting is recommended. Knowing that email can be tracked in CRM with the outlook client:

Email messages can automatically be tracked too.

5. The all powerful features of creating contacts in CRM when and email address is not known.

This is a great way to automatically get more leads or contacts (depending on your business) in crm. And depending on your business can also be a great way to pollute your crm full of contacts or leads that you don’t want.

Troubleshooting Tips

To troubleshoot an E-mail Router outgoing profile configuration, follow these steps:

1. Make sure that you follow the incoming profile configuration procedures in the E-mail Router Configuration Manager Help.
2. For more information about how to configure an incoming profile, see the E-mail Router configuration information in the latest version of the Installing Guide that is included in the Microsoft Dynamics CRM 4.0 Implementation Guide.
3. Refer to the following sections for information about how to resolve commonly encountered outgoing profile issues.

Test Access error
If there is a problem with your outgoing e-mail configuration, you may receive the following error message when you click Test Access on the E-mail Router Configuration Manager:
“Outgoing status: Failure – An error occurred while checking the connection to e-mail server EXSERVERNAME. The requested address is not valid in its context”
If you receive this message, follow these steps to troubleshoot the problem:

1. Run a telnet command to verify that connectivity is functioning between the computer that is running CRM Router and the Exchange Server. For example, start the TELNET utility and enter the following command:TELNET EXSERVERNAME PORT
2. Make sure that you have no antivirus services running on the Exchange Server computer that prevent connection by using port 25.
3. For information about how to configure the SMTP server to allow relay messages from Microsoft Dynamics CRM, see KB article 915827.

E-mail error when message sent from the Web application
Symptom: When a user sends an e-mail message by using the Web application, the user might receive one of the following messages:
This message has not yet been submitted for delivery. 1 attempts have been made so far.
The message delivery failed. It must be resubmitted for any further processing.
Resolution: For information about how to resolve this issue, see KB article 915827.
Load Data error
When you click Load Data in the E-mail Router Configuration Manager, you receive the following error:
The E-mail Router Configuration Manager was unable to retrieve user and queue information from the Microsoft Dynamics CRM server. This may indicate that the Microsoft Dynamics CRM server is busy. Verify that URL ‘http://OrganizationName‘ is correct. Additionally, this problem can occur if the specified access credentials are insufficient. To try again, click Load Data. (The request failed with HTTP status 404: Not Found.)
To resolve this problem, follow these steps:

1. Make sure that the user account that is running the E-mail Router Configuration Manager service is a member of the Active Directory PrivUserGroup security group.
2. The account that is specified in the Access Credentials field on the General tab of the E-mail Router Configuration Manager must be a Microsoft Dynamics CRM administrative user. If the access credentials are set to Local System Account, the computer account must be a member of the Active Directory PrivUserGroup security group.
3. Make sure that the URL is spelled correctly. The organization name in the URL field is case-sensitive and must be spelled exactly as it appears in the Microsoft Dynamics CRM server. To view the organization name as it appears in the Microsoft Dynamics CRM server, start the Web application. The organization name appears in the upper-right corner of the application window.
4. The DeploymentProperties table may have incorrect values if you have modified the port or hostheaders on your Web site. To update the DeploymentProperties table see, KB article 950248.

Pending Email warning

On the Email Router, configure:
1. Check event view for Email Router related errros
2. Change the send email
3. Restart CRM email Router service
4. Reduce the pooling time and conneciton timeout

Automatically Resending Failed Email Messages

The Advanced find can be used to find email messages that have not sent. A workflow can also be created to resend messages automatically. However constant failures is going to indicate a problem some other place. So the use of this automatic workflow should not be introduced in place of fixing your sending issues.
Steps to create the workflow to re-send failed e-mails:
1. Create a new Workflow in CRM | Processes on the E-mail entity

2. Set the workflow to be Available to Run “As an on-demand process”, Change the scope to Organization and uncheck “Record is created”.  This will make the workflow available to run On-Demand, function for all e-mails in the organization and also not run when every time a new e-mail is created as we just want to use this when needed on specific e-mails.

3. Click “Add Step” and choose “Change Status”

4. Set the E-mail to a status of “Pending Send”

5. Click Save and then Activate in the toolbar.  Click ”OK” to the message to confirm you want to Activate the workflow and then click “Close” on the workflow.

Advanced Find to see how many e-mails are in a failed status:
1. Open Advanced Find by clicking the “Advanced Find” button in the CRM ribbon

2. Select “E-mail Messages” in the Look For option set and then select “Status Reason” and set it equal to “Failed”. Then click the Results button in the Advanced Find ribbon.

3. You can refine the results using the filter criteria from here as well in case you do not want to re-send all of the e-mails. Once you are done, multi-select the e-mails you want to re-send and then click the “Run Workflow” button in the CRM ribbon.
4. Select the e-mail workflow that you created using the steps above and click OK.
The workflow will then run and change the status of all the e-mails you had selected back to “Pending Send”.  This is an asynchronous process, so it may take a few minutes depending on your current asynchronous workload in CRM.  Then the CRM e-mail router will process them again and send them out through SMTP as expected.

 

Microsoft CRM IFD SSL Certificate Renewal

The time will come around where you need to renew the SSL certificate for your CRM IFD configuration.
This will include the renewal of the SSL certificate as used by IIS and and ADFS. Couple of steps we followed based exactly on the configuration outlined in our above linked blog post.

Generate a new SSL Request.

1. Open IIS Manager and click on server certificates.

2. Create certificate request

3. Fill in the data:
Next
4. Change to 2048 Bit

5. Give it a name:

Finish and you are done.
Now Open the certificate text file and copy the text to your clip board, or use this with your certificate authority to issue you a new Wild Card Certificate. *.interactivewebs.com is what we use.
To get the certificate we use a service called “startssl.com” who allow you to issue certificates like this for 2 years for free once you are validated as a user.

Complete the Certificate Request

Once the new certificate has been issued to you you need to complete the request on IIS.
1. In IIS Manager click on Complete Certificate Request

2. Browse to the certificate from your issuer provider and give it a friendly name. We like to use a year in the name to help distinguish from the old one.

Finish the import.

Change the certificate used by IIS

1. Expand the two sites on the CRM server and click on Default Website first then Bindings / https

Then EDIT
2. Select the new certificate that you just imported and click on OK

3. Repeat this process fro the Microsoft Dynamics CRM website

selecting the new certificate here and OK.
4. Restart IIS

Set Permissions on SSL Certificate

1.  Click Start, and then click Run.
2.  Type MMC.
3.  On the File menu, click  Add/Remove Snap-in.
4.  In the Available snap-ins list, select Certificates, and then click Add. The Certificates Snap-in Wizard starts.
5.  Select Computer account, and then click Next.
6.  Select Local computer: (the computer this console is running on), and then click Finish.
7.  Click OK.
8.  Expand Console Root\Certificates (Local Computer)\Personal\Certificates.
9.  Right-click Certificates, click All Tasks, and then click Import.

Step 2: Add to the ADFS service account the permissions to access the private key of the new certificate. To do this, follow these steps:

1.  With the local computer certificate store still open, select the certificate that was just imported.
2.  Right-click the certificate, click All Tasks, and then  click Manage Private Keys.
3.  Add the account that is running the ADFS Service, and then give the account at least read permissions. (for us this is the Network Service)

Run the Deployment Manager with new Certificate

1. Run the CRM deployment manager:

2. Run the Configure Claims-based Authentication

Select the default settings.


Which should be the default from your IFD setup
But when you get to the Certificate, you need to select the new certificate.


Which should be visible from the list after importing it in the steps above.
3. Run the Configure Internet Facing Deployment action and just step though it with the default settings.

4. Restart the AD FS 2.0 Windows Service

Configure AD

Set the Service Communication Certificate

1. Start AD FS 2.0 Management

2. Expand certificates and select Set Service Communications Certificate

3. Select the new certificate that will be listed here.

Update Relying Party Trusts
1. From the AD FS 2.0 Management, Select your replying party trusts and update from the federation metadata one by one.

Update both listed. They will likely have a red cross before you do this.
Restart Services
Restart AD FS Service:

and restart IIS the usual way.
And you should be done. Login to your CRM IFD again and enjoy.