Tenant administration for Dynamics 365

A Dynamics 365 tenant is administered across several overlapping admin consoles. Knowing which one does what — and what tenant-level governance settings live where — is essential to running the platform without surprises.

The four main admin consoles.

1. Microsoft 365 admin centre (admin.microsoft.com) — the master console for tenant-level identity, users, licences, domains, and Microsoft 365 services. The starting point for everything else; Entra ID is here, licence assignment is here, baseline tenant configuration is here.

2. Power Platform admin centre (admin.powerplatform.microsoft.com) — environments, Dataverse capacity, DLP policies, custom connectors, AI Builder credits. Where most Dynamics 365 CRM-side and Power Platform admin happens.

3. Business Central admin centre (businesscentral.dynamics.com/...) — BC-specific: environments (production and sandbox), notifications, update windows, application insights configuration, telemetry, support tickets.

4. Lifecycle Services (LCS) (lcs.dynamics.com) — Finance and SCM specific: environments, code deployments, platform updates, support tickets, asset library, BPM, telemetry. Microsoft is gradually migrating LCS functions to the Power Platform admin centre.

Entra ID and identity. All Dynamics 365 sign-in flows through Microsoft Entra ID (formerly Azure AD). Tenant-level identity policies — MFA, conditional access, named locations, app consent policies — are configured at the Entra layer and apply to Dynamics 365 automatically. Custom policies are typically in scope for:

• MFA enforcement for all Dynamics 365 access.
• Conditional access blocking risky sign-ins.
• App consent restrictions preventing user-driven third-party app integrations.

Roles for admins. Microsoft Entra has tenant-scoped roles:

• Global Administrator — full tenant control. Use sparingly; protect with extra MFA and review.
• Power Platform Administrator — full Power Platform admin centre access.
• Dynamics 365 Administrator — broader rights across Dynamics 365 admin functions, including F&O.
• License Administrator — assign/remove licences.
• User Administrator — manage users.

Within Dynamics 365 apps themselves, separate app-level roles (e.g. Customer Service Manager, Sales Administrator in Dataverse; System Administrator in F&O) govern in-app rights.

Tenant-wide DLP. Data Loss Prevention policies in the Power Platform admin centre classify connectors as Business / Non-Business / Blocked, and prevent flows or apps from mixing classes. Set a tenant baseline and refine per environment.

Licence management. Microsoft 365 admin centre assigns Dynamics 365 licences to users. Power Platform admin centre shows capacity (Dataverse storage, API call usage, AI Builder credits) consumed. Both are checked monthly for the health of the tenant.

Environment topology. A healthy Dynamics 365 tenant has at minimum: production environment, UAT/Test sandbox, Dev sandbox. Larger orgs have per-team dev environments, per-product UATs, per-region production environments. Document the topology and review quarterly.

Backup and restore. Production Dataverse environments have 28 days of point-in-time backup; BC and F&O similar. Test the restore process before you need it.

Auditing. Tenant-wide audit events stream to Microsoft Purview for compliance retention. Per-app audit configures per table; verify both layers.

Alerting. Tenant-level health (sign-in failures, service disruptions, capacity warnings) routes through Azure Monitor and the Microsoft 365 admin centre's service health page. Configure email or Teams notifications to a real distribution list, not an individual.

Governance documentation. Maintain a single-page tenant governance document: environments, admin roles, DLP policies, licence holders, capacity thresholds, alert escalations. Living document, reviewed quarterly.