Environment strategy
Dev, test and prod per solution, plus a managed sandbox for makers.
Why. Controlled change and safe experimentation.
Trade-off. More environments to licence and administer.
CRM and business systems · Microsoft
Dynamics 365, Power Platform and Dataverse with Entra ID
A Microsoft-centric business platform: Dynamics 365 apps on Dataverse, Power Apps and Power Automate for tailored processes, governed environments and DLP, integrated with Entra ID, Microsoft 365 and Azure.
A reference architecture from EITSAA, not a named client system. Service limits, prices and product features change, so confirm current details before you commit to a design.
- Australian Privacy Principles
- ACSC Essential Eight
- SA ISMF supplier expectations
- Australian tenant geography
Architecture
- Security and identity
- People and clients
- SaaS and business systems
- Compute and containers
- Databases and data
- Messaging, events and workflow
- Network and edge
- Monitoring, audit and analytics
- Request or data flow
- Asynchronous or optional
- Boundary: region, account, network or trust zone
Request and data flow
Users sign in with Entra ID. Conditional Access applies MFA and device or location conditions, and licences and groups control app access.
They use model-driven apps (Dynamics 365 or custom) or canvas apps in the browser, on mobile or in Teams.
Apps read and write Dataverse. Table, row and column security is enforced by security roles, business units and field security profiles.
Changes trigger Power Automate flows for approvals, notifications and cross-system updates.
Flows use Microsoft Graph connectors for Teams messages, calendar entries and SharePoint documents.
Complex or high-volume integration goes through API Management and Azure Functions or Logic Apps rather than long flow chains.
Components and why they were chosen
| Component | What it does | Why this choice |
|---|---|---|
| Dynamics 365 (Sales, Customer Service, Field Service) | Packaged CRM and service apps on Dataverse. | Faster than building, and extensible on the same data model. |
| Microsoft Dataverse | Relational store with security, auditing and business logic. | One governed data layer for Dynamics and custom apps. |
| Power Apps | Low-code front ends. | Model-driven for data-heavy processes, canvas for task-specific mobile. |
| Power Automate | Cloud flows and desktop flows. | Fast workflow. Use solutions and service principals, not personal connections. |
| Managed Environments and DLP policies | Environment strategy and connector control. | Governance prevents shadow IT sprawl. |
| Azure API Management and Functions | Custom integration and heavy logic. | Throttling, observability and testable code. |
| Microsoft Entra ID | Identity and Conditional Access. | Same identity as the rest of the Microsoft estate. |
| Solutions and pipelines (Power Platform Pipelines or Azure DevOps) | Dev, test and production promotion. | Never build directly in production. |
Design decisions and trade-offs
Where logic lives
Low-code for process and UI, Azure code for integration and heavy logic.
Why. Right tool for each job and easier testing.
Trade-off. Two skill sets.
Data policy
DLP policies separating business and non-business connectors.
Why. Stops data leaking into personal services.
Trade-off. Makers need an exception process.
Flow ownership
Service principal or solution-owned connections.
Why. Flows survive staff leaving.
Trade-off. Licensing and permission design are needed.
Well-architected pillars
Security
Conditional Access, Dataverse security roles, field-level security, DLP and customer-managed keys where required.
Reliability
Platform SLA, environment backups and restore, and scoped error handling in flows.
Performance
Delegation-aware canvas apps, indexed columns and heavy work offloaded to Functions.
Cost optimisation
Per-user licences, Dataverse capacity and flow licensing. Plan capacity early.
Operational excellence
Centre of Excellence monitoring, solution checker in the pipeline and a maker onboarding path.
Sustainability
Archive old Dataverse data and retire unused apps.
Network, identity and data
Networking
Virtual Network support for Power Platform lets plug-ins and connectors reach private Azure resources. Use IP firewall in Power Platform and private endpoints on Azure services where policy requires.
Identity and least privilege
Entra groups drive security roles. Admin roles use PIM. External users use Entra External ID or Power Pages with strict table permissions.
Data and encryption
Classify tables, use column security on sensitive fields and enable auditing. Customer-managed keys are available if policy requires them. Retention rules follow the records policy.
Security and compliance mapping
| Control | How this design addresses it |
|---|---|
| Multi-factor authentication | Conditional Access policy. Essential Eight. |
| Restrict administrative privileges | PIM and tiered admin roles. Essential Eight. |
| Regular backups | Environment backups and tested restore. Essential Eight. |
| Privacy | Auditing, field security and retention support APP 11. |
Mappings show how the design supports each control. They are not certifications, and EITSAA does not claim IRAP assessment or compliance for any reference architecture.
Failure modes, targets and scaling
- Target RTOEnvironment restore in hours
- Target RPOPlatform backups on a rolling schedule. Confirm retention for your plan
- Scaling and limitsService protection limits apply per user and licence. Check current limits.
| Failure mode | Mitigation |
|---|---|
| Flow owner leaves | Solution-owned flows and service principals. |
| Throttling or API limits | Batching, retries with backoff and moving heavy work to Functions. |
| Production hotfix breaks the solution | Pipelines, solution checker and managed solutions in production. |
| Oversharing through maker apps | DLP, managed environments and sharing limits. |
Observability and runbooks
- Power Platform admin analytics and Application Insights for custom code.
- Flow failure alerts and a weekly review of failed runs.
- CoE toolkit inventory of apps, flows and owners.
Cost drivers and levers
Dynamics and Power Apps licences, Dataverse capacity, Power Automate licences and Azure integration.
- Choose per-app or per-user plans by usage.
- Archive old data.
- Consolidate flows.
- Use Azure for high-volume integration.
Implementation and fit
Phased approach
- Define environment and DLP strategy first.
- Configure the packaged Dynamics apps before customising.
- Build custom apps and flows in solutions with pipelines.
- Integrate to Microsoft 365 and line-of-business systems.
Anti-patterns to avoid
- Building in production.
- Personal connections on critical flows.
- One environment for everything.
- Customising Dynamics before using standard features.
When to use it
- Organisations on Microsoft 365 and Entra.
- Process-heavy teams needing quick delivery.
- Customer service and field service on one platform.
When not to
- Very high-volume transactional systems.
- Teams without capacity to govern citizen development.
More in crm and business systems
HubSpot
HubSpot with website forms, marketing automation and data warehouse sync
A lean marketing and sales stack: consent-aware forms and tracking on the site, HubSpot as the system of engagement, and a warehouse for reporting that does not live inside the CRM.
Xero and MYOB
CRM-to-accounting integration with Xero or MYOB
Quote, invoice and payment data moving safely between a CRM and Xero or MYOB: OAuth, idempotent writes, GST-correct line items, reconciliation and clear ownership of every record.
Data platform
Customer 360 platform joining CRM, support, billing and analytics
One governed customer profile built from the systems you already have: identity resolution, consent-aware activation and privacy controls, with a clear line between what is analysed and what is acted on.
Related insights
Discuss this architecture
Tell us your systems, constraints and timeline. We reply within one business day, and the initial conversation is free.