ariste.info

Has AI taken away the joy of writing?

Tue, 03 Nov 2026 07:00:00 GMT

Today we have a different type of post. Rather than something technical, I’m venting, or ranting, a bit. Maybe I’ve already become the Simpsons “Old man yells at cloud” meme.

Me, probably

The joy of writing

I haven’t been writing a lot for the past year. Not because there aren’t new topics, or because I’ve stopped finding interesting problems to write about. Oh, I have plenty of these 😁

The problem for me, and I’m sure that it’s the same for other people, is that once I start drafting something I end up thinking: is any of this worth doing anymore?

Why spend time writing anything when everybody can go and ask one of the AI chatbots we all know, and get exactly the answer they need?

I’ve always enjoyed writing. I started my blog as a way to help myself in the future, self-documentation. And it ended up helping many other people.

I also enjoy the process that leads to the article itself. Investigating and learning about a new feature, debugging an issue or building something is the fun part for me. It’s like a game.

Don’t get me wrong, I obviously also use AI. All day, every day. I used it to move this blog from WordPress to Astro. I will use it to spellcheck this!

It’s the most useful tool I’ve ever had. But it’s so inhumanly efficient that it’s taking the fun away from some things.

What’s the point in writing anything now?

This is what goes through my mind when I finish that first draft.

What’s the point if people can ask an LLM a specific question, and get the exact answer without having to go through a wall of text?

And as much as I enjoy writing, it also requires time and effort. And this time is usually my free time, something I started prioritizing and protecting A LOT some years ago.

For me this has sucked away the energy I need to put in the work to write something.

Yes, I get the irony. I’m using plenty of tools that were trained the exact way I’m criticising.

Believe me when I say I’ve spent hours, days, weeks, and probably months, writing all the posts and guides of this site.

What’s the point if I can take all of this content, feed it to Claude/ChatGPT/Copilot, so it learns my voice and tone and can produce something 95% me, just by telling it what to write about?

Likewise, what’s the point of reading long articles if I can just copy-paste them and ask for a TL;DR?

The creative dichotomy

I’ve always considered the work developers do is from a creative nature. Yes, it’s definitely not the same as artistic creation, but it’s a different kind of creativity.

As a developer I find it very natural to use AI tools to help me at work. We’ve been copying and pasting from the internet for years, and nobody cared about that.

But I loathe other kinds of creativity where most of the work is done by an AI, because there the person behind that work is the point!

What I won’t do is just go and tell Claude “hey look at the roadmap and write something”. When I wrote my book, I consciously avoided using ChatGPT because I’m VERY lazy and would’ve ended up letting it do all the work.

Everything looks the same!!!

Another awful consequence is the growing trend of everything looking the same.

And I’m not even talking about shitposts on LinkedIn.

AI-generated images, posters, flyers. All have the same style, same fonts, same look. All look equally ugly, dull and lifeless.

Worst of all? People have embraced it and settled for this!

And again, I’m guilty here too. I’ve had plenty of slides created using Cowork. And my slides and everybody else’s slides looked the same, of course!

Please, create things

I beg you, please, keep writing, keep drawing, keep painting, keep composing and playing music. Please.

I don’t want to read a book from Haruki MurAIkami, or BrAIndon Sanderson. I still need them to write books and put a piece of their soul there. Damn, I’d even be at peace if Patrick Rothfuss never published the third book of The Kingkiller Chronicle if it means nobody hands the draft to an AI to finish it.

I don’t want to listen to AI-generated music, or watch movies or shows packed with AI-generated content.

I can be working all day with AI tools, but at the end of the day I still need to get my dose of humanity.

So here’s the thing. I’ll try to keep writing, even if nobody reads it. It makes me happy, it gives me peace. When everything has to be short, have an immediate impact, and be able to be done while doing 27 other things, writing is one of the things I can actually keep my focus on while doing it. The other one would be playing World of Warcraft.

Time to work on those drafts…

Troubleshoot Copilot Studio errors with Postman

Tue, 09 Sep 2025 13:59:00 GMT

Lately I’ve been testing some of the X++ features we can use to extend the Finance and Operations agent in Copilot Studio.

We’re going to troubleshoot Copilot Studio errors!

One of these features is the X++ AI tools (formerly called AI plugins), which allow us to create Copilot Studio tools that call X++ business logic.

Today’s post is a product of my lack of focus and my superpower of ignoring yellow notifications on PPAC. Also, thanks to Jared Hall for the hint about using Postman to troubleshoot Copilot Studio errors.

If you missed any of the first three posts in the series, you can read them now:

Part 1: Copilot Studio 101: Extend Dynamics 365 F&O Copilots.
Part 2: Build an X++ AI Tool for Copilot Studio in Dynamics 365 F&O.
Part 3: Create X++ Client Plugins for Copilot Studio in Dynamics 365 F&O.

Context and scenario

First, let me give a bit of context and clarify a bit how all of this works at a high level, and also which was my scenario.

I’m preparing a session about extending the F&O Copilot with X++ and Copilot Studio. For my demo, I created an X++ AI tool that runs some business logic in X++. Something simple to show how it’s done.

Once we have the X++ AI tool, we deploy it to the environment, which creates a Dataverse custom API/Action (I’ll never stop being amazed at how much Microsoft loves name changes). This is the action that Copilot Studio uses to call the X++ logic.

I wasn’t able to troubleshoot the issue, neither debugging X++ nor debugging Copilot Studio (with messages), because that’s not an option if you don’t have the generative AI orchestration enabled.

How to troubleshoot Copilot Studio errors

When I tested it with my SysAdmin user, everything was OK. But I also wanted to test it with a user whose role only provided access to the X++ AI tool’s data.

And when I tested it, I got this error:

Sorry, the bot can't talk for a while. It's something the bot's owner needs to address. Error code: AIPluginRequestFailure.

It’s not very descriptive, right? I tested with F&O and Dataverse permissions, and I found that if I gave the user the System Administrator role in Dataverse, the agent worked. It had to be a Dataverse thing!

After much investigating and asking, Jared suggested calling the action via the Dataverse API to troubleshoot Copilot Studio, using Insomnia to see if I got any details. I used Postman because I’m more familiar with it, and I got this:

The environment was in Admin mode 🥴

I had put the environment in Admin mode from PPAC to enable a configuration key in F&O and forgot to disable it.

Thanks to the better details I got from the API call, I could troubleshoot the Copilot Studio error! Let’s learn how to do this.

Calling X++ AI Tools in the Dataverse Web API with Postman

Calling the Dataverse Web API is similar to calling OData endpoints in F&O. First, you authenticate and get a token, and with that token you can call the endpoints.

I’ll show this in Postman, but you can use any tool of your choice.

Create an environment

This step is optional; you can create a request to get the token using an AppId and secret, but I’ll show something interesting that I’ve learned from the Web API docs that show how to do this with Insomnia.

Go to the Environments tab and create a new entry for your Dataverse environment. Add these variables:

Variable name	Value
url	`https://YOUR_ENV.crmX.dynamics.com/`
clientId	`51f81489-12ee-4a9e-aaae-a2591f45987d`
version	`9.2`
webapiurl	`{{url}}/api/data/v{{version}}/`
callback	`https://localhost`
authurl	`https://login.microsoftonline.com/common/oauth2/authorize?resource={{url}}`

Notice that the clientId is fixed? Am I just publishing one of my Entra ID App registrations here? Nope! This clientId is Microsoft’s and is used for OAuth authentication.

Once you have these variables configured, set the environment as active by clicking the checkbox on the right:

Set environment as active in Postman

Calling the Dataverse API in Postman

Now, create a new request and go to the Authorization tab. In Auth Type, select OAuth 2.0 and give your token a name.

Scroll down until you see the Configure New Token section. In Callback URL, enter the {{callback}} variable from your environment. In Auth URL, enter {{authurl}}. And in Client ID {{clientId}}.

It should look like this:

Configure New Token in Postman

Then scroll to the bottom until you see the Get New Access Token button and click it. A Microsoft sign-in window will open. Log in with your user:

A new dialog with your token will appear; click the Use Token button:

Use Token

Now we’re ready to finalize the request!

Note

If the token expires while making requests, you just need to click the Get New Access Token button again.

Your X++ AI tool endpoint

So now we need to know what the endpoint name of your X++ AI tool is. That’s easy!

It’s your AI tool’s X++ class name preceded by mserp_! For example, if your class is called AASFabulousCopilotToolCustomAPI, your endpoint will be mserp_AASFabulousCopilotToolCustomAPI.

So in the URL you will be {{webapiurl}}/mserp_AASFabulousCopilotToolCustomAPI and the request must be a POST action.

Now, your X++ AI tool probably has some input parameters, which are data members in the class. For example, my fabulous tool has two: companyId and custAccount. You have to pass these as a JSON. What are the expected names?

Again, it’s easy; just add mserp_AASFabulousCopilotToolCustomAPI_ in front of the member names! So for companyId, it’ll be mserp_AASFabulousCopilotToolCustomAPI_companyId, and for custAccount, mserp_AASFabulousCopilotToolCustomAPI_custAccount.

You should have something like this:

Postman call to the Dataverse Web API action

Click the Send button, and your API will be called, and you should see the output.

And done! Now you can also launch the debugger and test your code, making the requests from Postman.

Conclusion

And that’s it! With these simple steps, you can troubleshoot Copilot Studio errors and test your X++ changes for Copilot Studio using Postman or any other API client of your choice!

Remember, when finding vague errors in the Copilot sidecar chat, the Dataverse Web API may provide better details and help you solve the exact issue quickly. Like finding out your environment was accidentally left in Admin mode! 🥴

So next time your bot decides to be mysteriously cryptic, don’t panic; open Postman, troubleshoot Copilot Studio errors, and relax!

Happy troubleshooting, and keep ignoring those yellow notifications at your own risk!

Create X++ Client Plugins for Copilot Studio in Dynamics 365 F&O

Tue, 02 Sep 2025 13:59:00 GMT

It’s the third part of the Copilot Studio and F&O Extensibility Series, and we’re going to learn about client plugins!

Remember that to follow along with the steps of this post, there are some prerequisites that you can check here: What do you need?

Client Plugins: don’t mess with them!

If you missed any of the first two posts of the series, you can read them now:

Part 1: Copilot Studio 101: Extend Dynamics 365 F&O Copilots.
Part 2: Build an X++ AI Tool for Copilot Studio in Dynamics 365 F&O.
Part 4: Troubleshoot Copilot Studio errors with Postman.

What’s a client plugin?

With client plugins, you can take action in a specific form. This form will be the context in which the action is available, and then you can call functionality, operations, or the business logic in there.

But hey, wait! Isn’t that EXACTLY THE SAME as the AI tools we learned about last week? That’s what I said too when AI tools were released: “Heh, then I can just use AI tools for everything”.

Note

In next week’s post, we’ll learn in detail the differences between using client plugins and AI tools.

Client plugins extend the SysCopilotChatAction class using a data contract for the input and response parameters, similar to AI tools.

Action types

For client plugins, we can define three types of actions depending on the scope.

Global actions

These are client plugins that have no specific context and can run on any form in the application.

To define a class as a global action, you must decorate it with the SysCopilotChatGlobalAction attribute.

Form actions

Only applicable on the specified form (or forms). Copilot Studio will only run your client plugin of this type if you’re on one of the forms that your class specifies.

To define the forms, you must decorate the class with the Export and ExportMetadata attributes.

Warning

To use the Export and ExportMetadata attributes you need to add a using System.ComponentModel.Composition; to your class.

For example:

[ExportMetadata(formStr(BatchGroup), identifierStr(FormName))]
[ExportMetadata(formStr(Batch), identifierStr(FormName))]
[Export(identifierStr(Microsoft.Dynamics.AX.Application.SysCopilotChatAction))]

Runtime actions

Available only where YOU define! That’s real power! I’m joking. 😛

To enable this kind of action, you must use SysCopilotChatAction::addToCopilotRuntimeActions with the following parameters:

runTimeAction: the class name that contains your code.
removeOnFormChange: a boolean indicating whether the action is still registered when you go to another form.
context: an object containing the context to pass to the action.

To disable the action, just call the SysCopilotChatAction::removeFromCopilotRuntimeActions with the runtimeAction parameter.

Input and output parameters

For input parameters, we must decorate the parm method with the DataMember and SysCopilotChatActionInputParameter attributes.

The SysCopilotChatActionInputParameter one takes two parameters, like in AI tools:

description: a description of the parameter.
isRequired: a boolean indicating whether the parameter is mandatory.

For output parameters, decorate the parm method with the DataMember and SysCopilotChatActionOutputParameter attributes.

The SysCopilotChatActionOutputParameter only takes one parameter:

description: a description of the parameter.

Note

You can have as many input and output parameters as you need, not just one.

Implement the executeAction method

And finally, to implement the X++ logic, we need to do it in the void executeAction(SysCopilotChatActionDefinitionAttribute _actionDefinition, Object _context) method.

Here you can use the input parameters that you need in your logic and the output ones to return the values, which can be used later in Copilot Studio.

Creating a client plugin

Now let’s get to work and code a bit. I’m sure you’re wondering which incredible use case I’ve come up with.

Yes, sarcasm.

This time we will be using the Copilot sidecar chat to confirm a purchase order without clicking the form button, and that only works in the PurchTable form.

Create the class

As I said earlier, we need to create a class that extends the SysCopilotChatAction class. I’ll start by showing the top of the class:

using System.ComponentModel.Composition;

[DataContract]
[ExportMetadata(formStr(PurchTable), identifierStr(FormName))]
[Export(identifierStr(Microsoft.Dynamics.AX.Application.SysCopilotChatAction))]
[
    SysCopilotChatActionDefinition(identifierStr(MS.PA.AAS.AP.AASPurchTableConfirm),
        'Confirm a purchase order',
        'Confirms an open purchase order',
        menuItemActionStr(AASPurchTableConfirmAction), MenuItemType::Action)
]

public class AASPurchTableConfirmAction extends SysCopilotChatAction

We decorate the class with the DataContract and note the using on top; otherwise, the Export and ExportMetadata attributes won’t be available.

In the ExportMetadata attribute, we pass two parameters:

The name of the form.
And the FormName identifier.

If you want this plugin to be called from more forms, you can add as many ExportMetadata lines here.

Then we add the Export attribute with the identifierStr(Microsoft.Dynamics.AX.Application.SysCopilotChatAction) parameter.

And for the last attribute, we add SysCopilotChatActionDefinition with the following parameters:

The identifier of your plugin. It must start with MS.PA. and after that you can name it however you want.
The name of your plugin.
A description for the action it does.
An action menu item that calls this class.

Next, we have the class members:

private PurchId purchId;
private boolean hasError;
private str errorMessage;

[   
    DataMember('purchaseOrderNumber'),
    SysCopilotChatActionInputParameter('The purchase order number of the PO you want to confirm.', true)
]
public PurchId parmPurchId(PurchId _purchId = purchId)
{
    purchId = _purchId;
    return purchId;
}

[   
    DataMember('hasError'),
    SysCopilotChatActionOutputParameter('Indicates whether there was an error during the confirmation process.')
]
public boolean parmHasError(boolean _hasError = hasError)
{
    hasError = _hasError;
    return hasError;
}

[   
    DataMember('errorMessage'),
    SysCopilotChatActionOutputParameter('The error message if there was an error during the confirmation process.')
]
public str parmErrorMessage(str _errorMessage = errorMessage)
{
    errorMessage = _errorMessage;
    return errorMessage;
}

As I said, you can have as many input and output parameters. Just make sure you decorate them with the correct attributes.

Finally, here are the executeAction method and a helper method:

public void executeAction(SysCopilotChatActionDefinitionAttribute _actionDefinition, Object _context)
{
    super(_actionDefinition, _context);

    try
    {
        PurchTable purchTable = PurchTable::find(this.parmPurchId());

        if (purchTable.DocumentState != VersioningDocumentState::Approved)
        {   
            throw error(strFmt("Purchase order %1 is not in an approved state and cannot be confirmed.", this.parmPurchId()));
        }

        PurchFormLetter purchFormLetter = PurchFormLetter::construct(DocumentStatus::PurchaseOrder);

        PurchaseOrderId purchOrderDocNum = strFmt('%1-%2', this.parmPurchId(), VendPurchOrderJour::numberOfPurchaseOrderVersions(purchTable) + 1);

        purchFormLetter.update(purchTable, purchOrderDocNum);

        FormRun formRun = _context as FormRun;

        if (formRun)
        {
            formRun.dataSource(formDataSourceStr(PurchTable, PurchTable)).research(true);
        }
    }
    catch (Exception::Error)
    {
        this.parmHasError(true);
        this.parmErrorMessage(AASPurchTableConfirmAction::getInfolog());
    }
}

private static str getInfolog()
{
    SysInfologEnumerator enumerator;
    SysInfologMessageStruct msgStruct;
    Exception exception;
    str error;

    enumerator = SysInfologEnumerator::newData(infolog.copy(1, infolog.num()));

    while(enumerator.moveNext())
    {
        msgStruct = new SysInfologMessageStruct(enumerator.currentMessage());
        exception = enumerator.currentException();
        error = strFmt("%1 %2", error, msgStruct.message());
    }

    return error;
}

This checks that the order is in the Approved status, posts the PO confirmation journal, and refreshes the form.

As a last step, create an action menu item for this class, and we’re done on the X++ side.

Create Copilot Studio topics

We now need to create two topics in Copilot Studio. If you don’t know what topics are, I recommend reading the first article in the series: Copilot Studio 101.

Trigger action topic

The first topic will be used to trigger your action. Go to the Topics tab and click the Add a topic button, selecting From blank:

Create new topic

Give it a short but descriptive name. I’m following kind of a naming pattern for topics, where I have an AAS prefix, a dot, and a short name. I’ve named this one AAS.ConfirmPO.

In the trigger, add some phrases you’d like to use. Like confirm the order:

Copilot Studio trigger

Then add an event activity type action from the Advanced menu:

Add event activity

Set the Name field to the same value as the first parameter of the SysCopilotChatActionDefinition attribute in the class. Mine was MS.PA.AAS.AP.AASPurchTableConfirm.

In the Value field, add this expression:

Concatenate("{""purchaseOrderNumber"": """,Global.PA_Copilot_ServerForm_PageContext.titleField1Value, """}")

Here we’re creating a JSON variable with our purchaseOrderNumber input parameter, and as its value, I’m using the first title field of the PurchTable table with the variable Global.PA_Copilot_ServerForm_PageContext.titleField1Value.

Note

If the table doesn’t have a title field, you can use the Global.PA_Copilot_ServerForm_PageContext.rootTableRecId variable and replace the input parameter for a RecId referencing the PurchTable record.

Finally, add an End current topic action from the Topic management menu:

End current topic

Save it, and our trigger topic is ready.

Response topic

Now we need a topic to process the response. I’ve named this one AAS.ConfirmPOResponse.

Change the trigger to the type A custom client event occurs. Set its Event name property to MS.PA.AAS.AP.AASPurchTableConfirm.

Now we need to add a Parse value action from the Variable management menu:

Parse action

Here we will parse the response from our class. Set the Parse value field to the System.Activity.Text variable (in the System tab):

Activity.Text variable

Then in the Data type field, select From sample data and click the Get schema from sample JSON button. Paste this sample:

{
    "isResponse": true,
    "purchaseOrderNumber": "PO-00001",
    "hasError": true,
    "errorMessage": "Oh, no! An error"
}

This is similar to parsing JSON on Power Automate. You’ll now have these four JSON fields available individually.

Now add an Add a condition control. We’ll show the user a different message depending on the outcome of the confirm operation.

On the left condition, we’ll manage errors. Select the ConfirmResponse.hasError variable and check if it’s true:

Error condition

Then add a Send a message action, with the following:

Text: “The purchase order “
Variable: ConfirmResponse.purchaseOrderNumber
Text: ” couldn’t be confirmed, an error occurred. “
Variable: ConfirmResponse.errorMessage

So it becomes human-readable when it’s displayed.

In the other branch and add a Send a message action with the following:

Text: “Purchase order “
Variable: ConfirmResponse.purchaseOrderNumber
Text: ” confirmed!”

Save your topic, and now click the Publish button so it’s available on F&O’s sidecar chat.

Hey! What about the DataAreaId!?

Before testing the plugin, let me answer this question.

If you remember from the previous post about the AI tools, we had to explicitly specify the company in which the code was running; otherwise, it would take the default company.

With client plugins, the company that the code will run in is the active one. That’s also another benefit of the context!

Test it!

Now go to the purchase order form and select one that’s not confirmed. Open the sidecar chat and tell Copilot, “Confirm the order”. The process will run and…

Order confirmed!

We have confirmed the order! Well, not we, but Copilot Studio.

Now let’s try to run the other conditional branch, the one where we get an error. Just try confirming an order that is already confirmed.

That works too! We get the error message in the sidecar chat!

The error appears

As expected, we get the message from our throw error in the function.

Conclusions

Client plugins give Copilot superpowers inside the form you’re on—perfect when you need context or guardrails.

We’ve learned the essentials:

Define the scope (Global, Form, Runtime).
Decorate the class (DataContract, Export/ExportMetadata, SysCopilotChatActionDefinition).
Create inputs and outputs.
Implement executeAction().
Create the trigger and response topics.

Reach for client plugins when the action must respect the current form/session and feel like a menu action; keep AI tools in mind for broader, cross-form logic.

In the next post, we’ll put them head-to-head so you know exactly when to use each.

See you in part 4!

Build an X++ AI Tool for Copilot Studio in Dynamics 365 F&O

Tue, 26 Aug 2025 13:59:00 GMT

Welcome to article 2 in the Copilot Studio series! Want Copilot Studio to run real F&O business logic? Build a simple X++ AI tool and wire it in.

If you missed other articles in the series, read:

Part 1: Copilot Studio 101: Extend Dynamics 365 F&O Copilots.
Part 3: Create X++ Client Plugins for Copilot Studio in Dynamics 365 F&O.
Part 4: Troubleshoot Copilot Studio errors with Postman.

Here’s the idea: Copilot Studio gets truly useful when it can run your real F&O business logic on demand. The fastest way to do that today is with an X++ AI tool: a small data contract class exposed as a custom API in Dataverse that can be called from Copilot Studio.

An AI tool, part of the F&O Swiss Army knife gadgets for your AI endeavors!

In this walkthrough, we’ll build a minimal example (look up a customer’s name by account number) to show the pattern end-to-end. You’ll see how to create the class and attributes, set up the right security (menu item, privilege, role), deploy to Dataverse, and configure the tool in Copilot Studio.

What’s an X++ AI tool?

X++ AI tools are used to extend the capabilities of agents in Copilot Studio.

Note

These AI tools are quite useful… if you have a good use case 😉. Right now this is the hardest part for me. I understand and see their value, but finding a good use case is not easy.

In X++, an AI tool is simply a data contract class! Alright, let’s learn how to create one.

Prerequisites

To follow the steps described in this article, I suggest using a UDE (Unified Developer Experience) environment. You won’t be able to test this on a local VHD-based VM.

Your Dataverse environment needs the following solutions:

Finance and Operations Virtual Entity
Copilot for finance and operations apps
Copilot in Microsoft Dynamics 365 Finance or Copilot in Microsoft Dynamics 365 Supply Chain Management

In your Dynamics 365 F&O environment, you must enable the Custom API Generation feature if it’s not enabled by default.

Caution

As of August 2025, the documentation on Microsoft Learn is outdated, and you don’t need to take any manual steps after creating the AI tool. You can ignore everything in the section Create the Dataverse custom API.

Create the AI tool

For this example, I’ll be creating a class that runs a stupid functionality: return the customer’s name based on their customer account number. I know it’s not the craziest example of using cutting-edge AI technology.

I just want to show you the basics of creating an AI tool in X++, and then you can use it with your scenario!

Create a class

So first create a class. I’ll name mine AASCustomerNameCustomAPI. This class needs to implement the ICustomAPI interface.

We also must decorate it with these attributes:

CustomAPI: this sets the name and description shown in Copilot Studio. Mine is [CustomAPI('Get the customer name', 'Returns the name of the customer based on their customer account number')].
AIPluginOperation: nothing special, just use [AIPluginOperation].
DataContract: and also nothing special, use [DataContract].

Next: input and output parameters. When we ask Copilot for something, it usually needs input data. In our case it’s the customer account number. So I’ll create a custAccount variable:

private CustAccount custAccount;

And then we expect a response from the bot. That’s our output parameter, and because for this example it’s the name, I’ll create a custName variable:

private Name custName;

Great! We need one more thing: a CompanyId variable! Why? As in many Dataverse/Power Platform integrations, the default company from your user info is used. Fortunately, we can get the current company where the request is being done from Copilot Studio, but we need a variable to then change the company if it’s not the same as the default one you have.

That’s why I also create a companyId member:

private CompanyId companyId;

As you may already be thinking, if the class is a data contract, these are our data members. And what do data members need? Their parm methods!

And because they’re AI tool data members, we need to decorate them with the CustomAPIRequestParameter for the request and CustomAPIResponseProperty for the response. They’ll look like this:

[
    CustomAPIRequestParameter('The company of the customer', true),
    DataMember("companyId")
]
public CompanyId parmCompanyId(CompanyId _companyId = companyId)
{
    companyId = _companyId;
    return companyId;
}    

[
    CustomAPIRequestParameter('The customer account number', false),
    DataMember("custAccount")
]
public CustAccount parmCustAccount(CustAccount _custAccount = custAccount)
{
    custAccount = _custAccount;
    return custAccount;
}

[
    CustomAPIResponseProperty('The customer name'),
    DataMember("custName")
]
public Name parmCustName(Name _custName = custName)
{
    custName = _custName;
    return custName;
}

The CustomAPIRequestParameter attribute expects two parameters: the description of the field and a boolean indicating if the field is optional. You can see I’ve set the one for the companyId as true, meaning optional.

If we don’t provide a companyId value, the process will fail, but we’ll make sure that doesn’t happen when using the tool in Copilot Studio.

The CustomAPIResponseProperty attribute only expects one parameter: a description.

Now override the run() method that comes from the interface. This method contains the business logic that’s being triggered. Getting a customer name, that’s easy, right?

[Hookable(false)]
public void run(Args _args)
{
    changecompany(this.parmCompanyId())
    {
        CustTable custTable = CustTable::find(this.parmCustAccount());

        if (custTable)
        {
            this.parmCustName(custTable.name());
        }
    }
}

Build the class, and it’s ready. But there’s more to do!

Create the security objects

For X++ AI tools to work properly, we also need:

An action menu item
A security privilege
A role for the privilege (and a duty if you prefer to use that). We must assign this role to the user chatting to the agent; otherwise, they won’t be able to access it.

Create the action menu item, set its Object Type property to Class, and the Object property to the name of the class we created before.

Create a new security privilege; I’ve called mine AASCustomerNameAPIAccess. Add the action menu item to the Entry Points node, and set its Access Level property to Create.

Finally, I’m creating a new role, also named AASCustomerNameAPIAccess, that has the AASCustomerNameAPIAccess security privilege in the Privileges node.

Your VS project should look like this:

Project objects

Deploy the model to Dataverse

And because I’m in a UDE environment, I’m going to deploy the code to Dataverse.

Once the deployment completes, you can go to F&O, System administration > Setup > Synchronize Dataverse Custom APIs, and look for your API:

Custom API created

If it’s there, you’re all set. If it isn’t, please verify that you’ve created and configured the menu item, privilege, and role or duty correctly. Also check that you haven’t missed adding any attribute in the data contract class or members!

Create the Dataverse API

Once we have deployed the code, we must create a Custom API and parameters in Dataverse.

Note

This step wasn’t needed until recent updates of 10.0.44 and 10.0.45. It’s been enforced to have better ALM when moving these between environments.

Go to the Power Apps maker portal, and create a new solution.

First, click New > More > Other > Custom API:

Dataverse Custom APIs

In the new window, enter the following parameters:

Unique Name: aas_AASCustomerNameCustomAPI (that’s your prefix + class name).
Name: Customer name agent.
Display Name: Customer name agent.
Description: Returns the customer name based on their customer account number.
Binding Type: Global.
Plugin Type: Microsoft.Dynamics.Fno.Copilot.Plugins.InvokeFnoCustomAPI.

Click Save & Close.

Then we must create a Custom API Request Parameter for the parm methods decorated with the CustomAPIRequestParameter attribute.

You must do this for each input parameter you have! I’ll show this for the companyId parameter.

Click New > More > Other > Custom API Request Parameter and set these values:

Custom API: Customer name agent (this is the name you gave the Custom API in the previous step).
Unique Name: aas_AASCustomerNameCustomAPI_companyId (this is your publisher prefix + class name + parameter name).
Name: companyId.
Display Name: companyId.
Description: the company in which to find the customer’s name.
Type: String.
IsOptional: No.

Click Save & Close.

Do the same for the custAccount member of the class.

And finally, create the parameter for the parm methods decorated with the CustomAPIResponseProperty attribute.

Click New > More > Other > Custom API Response Parameter and set these values:

Custom API: Customer name agent (this is the name you gave the Custom API in the previous step).
Unique Name: aas_AASCustomerNameCustomAPI_custName (this is your publisher prefix + class name + parameter name).
Name: custName.
Display Name: custName.
Description: the name of the customer.
Type: String.

Click Save & Close.

Using the AI tool in Copilot Studio

Once the tool is ready, go to Copilot Studio to add it to our Copilot for finance and operations apps agent.

Make sure you select the correct environment, open the agent, and go to the Tools tab:

Tools tab in Copilot for finance and operations agent

Click the Add a tool button, then select Microsoft Dataverse:

Add your AI tool in Copilot Studio

In the next screen, select Perform an unbound action in selected environment:

Perform an unbound action in selected environment

Create a connection, either using Oauth with your account or a Service Principal with an Entra ID App registration, up to you which one to use.

Click the Add and configure button.

Change the Name and Description fields. I’ve used “AAS.Get the customer name” as the Name and “Returns the name of the customer based on the customer account and legal entity” as Description.

Configure inputs

In the Inputs section change the Environment input to “Custom value”, and as the value select “(Current)”.

Then for the Action Name input, change it to custom too, and in the value enter the name of the Custom API we’ve created. It should be in the lookup.

Next, click the Add input button:

Add inputs

Select both parameters, one at a time.

By default, inputs are set to Dynamically fill with AI, which means that the agent will decide which values go there. We can also select Custom value:

Input values

Let’s do this for the companyId field. Remember I said that it takes the default company on user info? We’re going to change this and select the company in which the user was talking to the bot.

Click the three dots in the value field, and look for dataAreaId in the Custom tab. You should find only one result: PA_Copilot_ServerForm_UserContext.dataAreaId.

This variable contains the company in which the user was when they asked the agent.

Note

If you would like to learn more about how this is populated, open the SysCopilotChatUserContext class in Visual Studio.

Leave the custAccount parameter to Dynamically fill with AI.

Don’t forget to click the Save button before leaving this page!

Create a topic

Now the action is there, and we need the agent to be able to know when to use it. That’s what topics are used for.

Caution

Copilot Studio includes a Generative AI Orchestration option.

Gen AI orchestration in Copilot Studio

If this is enabled and supported for your F&O agent, the agent can decide when to invoke the tool automatically, and you don’t need to create a manual topic trigger.

As of September 2025, this orchestration isn’t supported for the F&O built-in Copilot agent, so create a topic manually.

Add a new topic

Go to the Topics tab and click the Add a topic button, selecting the From blank option. Give the new topic a name.

You can see the topic designer looks a bit like the Power Automate one, and it also starts with a trigger:

Topic trigger

Here we need to introduce the phrases that will start our AI tool action. For example, “What’s the name of the customer”, and plenty of variations.

How can you get most of them? With AI! What I do is just ask ChatGPT for variations of one or two examples and use those, and then ask it to put the variations in a file with no quotes. Then I paste it all in Copilot Studio.

Then click the + button below the trigger, go to Add a tool, select the Tool tab and choose yours:

AI action in Copilot Studio

Done! Don’t forget to click Save.

Publish the agent

Even if we clicked Save a thousand times in Copilot Studio, if we go to the F&O sidecar chat and try to run our tool, it will run nothing.

To apply the changes, we need to click the Publish button in the top right area, near the Test one:

Publish on Copilot Studio

Testing the agent

Everything is ready! Now click the Test button in the top right corner. A new pane will open. Here we’ll test the bot, asking, “What’s the name of customer US-001?” and we’ll get it!

Sure? Well, no. Remember we set that the company field would come from the user context in F&O? This is what happens:

Copilot Studio error

It gets an empty companyId, and when it calls the X++ code, the changecompany method is called with an empty value, and it fails. Also because I added no try-catch block, but that’s a different story.

Note

Copilot Studio’s test panel doesn’t include F&O user context. Test context-dependent tools in the F&O side panel or temporarily use custom values while testing in Studio.

Go to F&O, and ask the same question in the sidecar chat:

Copilot in F&O knows!

But wait, every time I want to test something that uses the context, I have to publish the agent and go to F&O? Well, what you can do is set all the inputs in the tool to use a dynamically filled value while testing it inside Copilot Studio and change it before publishing.

Conclusion

And we’re done! We’ve seen how to create and deploy an X++ AI tool from scratch, configure its inputs, set up security, and integrate it into Copilot Studio.

My example was intentionally simple, but I wanted to show all the fundamental steps needed to build more advanced AI integrations.

Finding the perfect use case will be the trickiest part of the process, but now you’ve got the basics down, and I’m sure you’ll discover many valuable scenarios to use this.

You can read part 3 now: Create X++ Client Plugins for Copilot Studio in Dynamics 365 F&O.

Copilot Studio 101: Extend Dynamics 365 F&O Copilots

Tue, 19 Aug 2025 13:59:00 GMT

With this post I’m starting a series of articles about extending the Dynamics 365 Finance and Operations agent in Copilot Studio. Yes… I’ve also finally fallen into the AI whirlwind 😅.

This introductory post covers the basics of Copilot Studio and its extensibility options. After this, we’ll see:

Part 2: Create AI tools (plugins) in X++.
Part 3: Create client plugins in X++.
Part 4: Troubleshooting Copilot Studio agents using Postman.
When to use a client plugin vs. AI tools.

Driving with Copilot Studio

The list will grow as Microsoft ships new features. For example, once the Dynamics 365 ERP MCP server becomes extensible, I’ll add an article for that as well.

What is Copilot Studio?

If you’ve been working with F&O or the Power Platform for some time you might remember Power Virtual Agents (PVA).

PVA was Microsoft’s low-code platform for building chatbots. They were part of the Power Platform and allowed you to create, test, and publish bots through a visual, no-code interface, connect to data and services via Power Automate, and deploy them to Microsoft Teams, websites, etc.

In 2023 Microsoft announced the release of Copilot Studio, and that PVA was becoming part of it. Yes, new features were added, but the foundation of Copilot Studio was Power Virtual Agents.

With all the AI advancements since then, Copilot Studio has evolved not just into a low‑code chatbot creation tool but into a complete suite that also extends existing copilots that Microsoft has released for their products, like the Copilot for Finance and Operations apps agent.

Before you start

If you want to follow the examples that I will show in the articles, you will need the following:

Unified Developer Experience (UDE) development environment: creating client plugins and AI tools requires a UDE environment. I haven’t tested this on a cloud-hosted environment linked to Dataverse, and the documentation explicitly asks for a UDE environment. You also need to be at least on version 10.0.40.
System administrator on the F&O environment: probably you could do with less, but if the UDE environment is yours, you’re most likely the administrator.
System customizer on Dataverse: this is the least access role you need to be able to install the Copilot solutions on the Dataverse environment.
Dataverse solutions: you need the following solutions in the UDE environment:
- Finance and Operations Virtual Entity: to enable Copilot Studio to talk to F&O.
- Copilot for finance and operations apps: to add the F&O agent to Copilot Studio.
- Copilot in Microsoft Dynamics 365 Finance: to add the finance-related agents.
- Copilot in Microsoft Dynamics 365 Supply Chain Management: to add the SCM-related agents.
Visual Studio: you need Visual Studio to follow the code examples and to apply them to the UDE environment.

Licensing

I’ve left a separate section in the requirements for licenses because… you know, licensing. Copilot Studio has its own licensing guide, yay!

There’s no entitlement for Copilot Studio in the F&O licenses. First, you need to get one of the following:

Set up pay-as-you-go for Copilot Studio.
Copilot Studio credit pack subscription: 25,000 monthly credits. Previously called message pack subscription and messages.
Some Microsoft 365 Copilot plans have limited use rights, but only related to the M365 agent. Not our thing.

And to build and manage the agents, you need the Copilot Studio author role or Copilot Studio user license. Both are free!

Note

A clarification about licenses: users interacting with the agent don’t need a Copilot Studio user license. Only the users customizing the agents in Copilot Studio need them.

Copilot Studio & F&O

Copilot Studio uses F&O Virtual Entities (a Dataverse representation of F&O data) and Dataverse actions to trigger X++ business logic in F&O. In the end, Copilot Studio acts as an orchestration layer:

Start conversation: a user starts a chat with the Copilot sidecar chat in F&O.
Intent resolution: Copilot Studio identifies the topic (or “action”) that meets the intent and selects the right tool to run.
Access data or logic: Copilot Studio will trigger F&O business logic or retrieve data using Dataverse actions or virtual tables, respectively.
Response: Copilot Studio finally mixes the output with AI and responds back to the sidecar chat.

Because the Copilot Studio chatbot is the single entry point, all happens in Power Platform: managed solutions move your tools, topics, and environment variables through dev -> test -> prod. Only the X++ assemblies travel with your F&O deployable package.

Architecture of the F&O Copilot

As I said, the Copilot for F&O is Dataverse-based. In this diagram I stole from Microsoft Learn, you can see all the components involved:

Architecture of Copilot in F&O

As shown in the diagram, the AI logic, data, and connectors are hosted in Dataverse. Copilot Studio orchestrates communication between the two, consuming F&O data via virtual entities and invoking business logic via Dataverse actions, then composing an AI-generated response.

The Finance and Operations Copilots

In Dynamics 365 F&O, we can find three Copilot “flavors”, depending on where the users access them.

Sidecar: the side chat that you can open with the Copilot button on the top menu bar. It provides natural language chatting capabilities, like ChatGPT.
Embedded: displayed on some forms, for example, the summaries on the customer or vendor forms.
Outside: Copilot experiences outside the F&O application, for example, using F&O data within Microsoft 365 Copilot or an agent accessed through Microsoft Teams.

Then we have several copilots that are available out-of-the-box across all the different F&O apps (Platform), and then for every specific F&O app (Finance, SCM, …) there are specific business-related copilots.

Platform

These are available across all the different F&O apps:

Finance

Supply Chain Management

Project Operations

Commerce

Copilot Studio UI

Now let’s learn a bit about the elements of Copilot Studio. When you open Copilot Studio, you will find a somewhat familiar screen because its UI is built like other Power Platform components:

Copilot Studio UI

Here we have:

Environment: the environment in which you’re creating or editing the agent. This should be the same as your UDE environment.
Agents: here we can create, edit, or delete the agents.
Flows: similar to Power Automate flows, but with agents.
Tools: to create tools that extend and improve your agents. These can be reused across different agents.

Next I want to focus on the Agents tab. Here you’ll see all the agents available for your environment:

Agents in Copilot Studio

Here you can create a new one or modify the existing ones. And if you click on the F&O one, you’ll see several tabs and the agent description:

F&O agent in Copilot Studio

What is each tab for?

Overview: a quick view of your agent.
Knowledge: define what our agent knows and where it takes it from.
Tools: actions that your agent can run.
Agents: other Copilot agents that you can connect to yours.
Topics: create conversation flows.
Activity: shows an activity map of the currently running agent. Only works when generative AI orchestration is enabled.
Analytics: shows usage statistics of your agent.
Channels: decide where your agent is available.

Other than this, we have the Publish button that will push the changes to the live bot. And also the Settings button that shows additional setup for the bot.

We will see most of these elements in the future posts.

Extending Copilots in X++

And what about extending the agents using X++ code? That’s possible too, and right now we have two ways of doing this:

Client plugins: Client plugins, or client actions, are Copilot plugins that invoke client code and are available for users in the context of client experiences for F&O apps. Developers can extend the Copilot chat capabilities by defining plugins that convert the functionality, operations, and business logic of the X++ code base into actions that users can invoke through natural language.
AI tools: currently in prerelease and previously called AI plugins, these can be added to the in-app Copilot for F&O apps, other Microsoft copilots or agents, or custom agents and can use the business logic. They don’t require specific context in the F&O client compared to client plugins.

In short, client plugins are for UI-context actions, and AI tools are background operations available globally. We will learn more details about both options in upcoming posts!

MCP server for Dynamics 365 ERP

And we also have the Model Context Protocol (MCP) server, which adds more capabilities to interact with F&O data. Currently it adds 12 tools that you can check in the Microsoft Learn article.

As of August 2025, it’s not extensible, but Microsoft may allow custom MCP tools in the future.

Note

For the MCP server to show up on your agent in Copilot Studio you need the F&O version to be at least 10.0.2263.17. The version of the Copilot in Microsoft Dynamics 365 Finance solution must be at least 1.0.3049.1. And the version of the Copilot in Microsoft Dynamics 365 Supply Chain Management solution must be at least 1.1.03046.2.

Conclusion

Copilot Studio is quickly becoming the centerpiece for bringing generative-AI experiences into Dynamics 365 Finance & Operations. In this first post we’ve:

Seen how PVA turned into Copilot Studio—and where it plugs into the F&O stack.
Learned about prerequisites.
Met the ready-made copilots you already get in Finance, SCM, ProjOps, and Commerce.
Clicked around the Copilot Studio UI: agents, tools, topics, channels, and everything else.
Teased the two ways to add X++ magic in: client plug-ins and AI tools.

In the next article, we’ll roll up our sleeves and build a client plug-in in X++. Until then, make sure your UDE environment is ready, the required Dataverse solutions are installed, and your licenses are in place to follow along line-by-line!

You can read part 2 of the series now: Build an X++ AI Tool for Copilot Studio in Dynamics 365 F&O.

Ready to master ALM? The New Dynamics 365 ALM Guide is Here!

Sun, 29 Dec 2024 12:13:14 GMT

Today I’m announcing the first part of the new Dynamics 365 ALM guide for Finance and Operations (F&O) is now available!

With the new Dynamics 365 ALM Guide you have all the tools!

This guide focuses on the unified development and administration experiences and the significant changes coming in the next few months. I’ve completely rewritten it from scratch, ensuring that all screenshots are up-to-date to make the process easier to follow.

Over time, countless changes have impacted ALM for Dynamics 365. After writing the original ALM posts, I realized it was more efficient to create a new guide rather than amend the old content. Believe me, it’s easier to write from the beginning than reviewing what I already have…

The previous guide covered everything essential for maintaining a healthy Dynamics 365 ALM process for Finance and Operations projects. While much of that information remains relevant, some updates—especially with Azure DevOps—reflect the latest advancements.

One of the biggest shifts is the deprecation of Lifecycle Services (LCS) and the transition to the Power Platform admin center (PPAC). This change introduces new tools and workflows we need to adapt to for effective ALM.

What’s New in the Dynamics 365 ALM Guide?

With the new Unified development and administration experiences, here’s a sneak peek at what’s coming:

PPAC (say goodbye to LCS)
Power Platform tools for DevOps
The new “local” development experience
Use Git in a very straightforward way
Deploy to production from a release pipeline… yes, you read well, “deploy to production”, that’s correct 😁
Automating operations with PAC CLI or PowerShell

The new guide will offer step-by-step instructions for implementing these tools and workflows. Initially, the focus will be on Dynamics 365 Finance and Operations, but my goal is to expand it to cover a fully unified ALM strategy that includes both ERP and Dataverse projects.

I can’t wait to dive into this journey with you. Let’s embrace the new Dynamics 365 ALM era together!

What’s now available?

Currently, the Dynamics 365 ALM guide is a work-in-progress. The first chapters have been written, and I’ve got drafts of the next ones.

Here’s what’s available now:

Welcome to the new ALM guide

An introduction to the new Dynamics 365 ALM guide and the prerequisites needed to follow along.

Create and prepare Azure DevOps organization and project

This chapter explains how to create a DevOps organization and project from scratch. If your company doesn’t have a DevOps organization, you’ll learn how to create one and add a project.

Enable TFVC in a new organization (since Microsoft defaults to Git now).
Configure pipeline agents with an Azure subscription to add more parallel jobs.

Unified development environment

Introducing one of the most exciting features: the unified developer experience (UDE). Learn how to deploy a new development environment in Dataverse using PowerShell or the PPAC UI.

We’ll also discuss the transition to the capacity-based model. 🤐

Using Visual Studio

This chapter covers using Visual Studio 2022 to develop X++ code, pushing changes to Dataverse, and debugging. (Still a work in progress.)

This is the currently available content in the new Dynamics 365 ALM guide, but I’m preparing many more things!

What’s Planned Next?

The missing parts for the Dynamics 365 ALM guide and what I have in my mind are:

Git basics: just some words on Git. Using it in our projects will be much easier with the UDEs, and it’s worth learning how to create branches, change between branches, or other basic operations.
Pipelines: CI and CD pipelines. Including deploying to production using the Power Platform tasks in releases😍 Oh, and forget about the LCS connector with a username and password… say hello to service principals!
Further automation: like in the old guide, I will describe how we can use pipelines to automate certain processes like copying environments.
PPAC-focused topics: with the move to PPAC we must learn plenty of new things. How to check the capacity, manage environments, provide access to users, etc.

This guide has been long in the making, but I hope it will be just as useful as the first one was. Stay tuned for more updates!

ISVLicenseGenerator v0.9: a farewell?

Wed, 18 Sep 2024 04:47:58 GMT

I’ve been working on the ISVLicenseGenerator open source tool for some years now, almost five. It all started when I ordered a code-signing certificate to sign ISV solutions, and I got a USB token instead of a software certificate.

Warning

ISVLicenseGenerator is not needed anymore and won’t be maintained.

As of version 10.0.43, and since 10.0.38, it’s possible to generate a license file using AXUtil using a HSM-backed certificate: https://learn.microsoft.com/en-us/dynamics365/fin-ops-core/dev-itpro/dev-tools/isv-licensing#create-a-package-and-generate-a-customer-specific-license

After many years of Microsoft not offering support for these devices to sign the license files, it looks like with the changes introduced to AXUtil in the version 10.0.37, ISVLicenseGenerator will not be needed anymore…

RIP ISVLicenseGenerator

If you want to learn more about ISVLicenseGenerator you can read:

What’s new in ISVLicenseGenerator v0.9?

In version 10.0.38 a new parameter to the command-line version of AxUtil was added: AllowCrossDomainInstallation. From the docs:

This parameter provides ISVs (Independent Software Vendors) with the ability to generate licenses that can be used across different environments for the same tenant (customer). The default value is set to false, which means the tenant can’t use the same ISV license across different environments or reuse the same ISV license within the same environment when the admin domain name changes. When the value is set to true, the customer can install the same ISV license across different environments associated with the same tenant or when the customer changes the admin domain name of the environment. This parameter is available in Dynamics 365 Finance version 10.0.38 and higher.

This is what I’ve added, here you can see the option in the UI:

AllowCrossDomainInstallation parameter

When this is selected, the string allowcrossdomaininstallation=”true” is added to the text of the license file, and it’s also added to the string that’s used to generate the signature. That’s all.

Then when the license is loaded using a deployable package, the code in the standard checks if that field is set to true and sets it in the environment. You can see this in the SysLicenseCodeReadFile class, method codeStatus.

You can download ISVLicenseGenerator v0.9 from the releases’ page on GitHub: https://github.com/aariste/ISVLicenseGenerator/releases/tag/0.9.

Why this could be the last ISVLicenseGenerator version?

If you’ve taken a look at the Microsoft learn documentation on ISV licensing lately, you maybe have noticed that there are two more optional parameters that can be used on the command line: subjectname and thumbprint.

What are they used for? First, let’s see how we use the command-line tool without them:

C:\AOSService\PackagesLocalDirectory\Bin\axutil genlicense /file:c:\templicense.txt /certificatepath:c:\tempisvcert.pfx /licensecode:ISVLicenseCode /customer:TAEOfficial.ccsctp.net /serialnumber:4dbfcf74-c5a6-4727-b638-d56e51d1f381 /password:yourPassword

Here, we’re using the certificatepath and password parameters to access the PFX file that contains the private key that’s used to generate the license file.

If we want to use the subjectname and thumbprint parameters, we must skip using certificatepath and password. The command would look like this:

C:\AOSService\PackagesLocalDirectory\Bin\axutil genlicense /file:c:\templicense.txt /licensecode:ISVLicenseCode /customer:TAEOfficial.ccsctp.net /serialnumber:4dbfcf74-c5a6-4727-b638-d56e51d1f381 /subjectName:"ISVCert" /thumbprint:certificateThumbprint

We do it like that because AxUtil will use the subjectname and thumbprint parameters to get our certificate from the certificate store in our computer. And as far as I know, because I don’t have a USB cryptographic token anymore, it should also work with it.

When you receive the USB token, you can install the public key certificate in your PC.

Note

It’s not possible to export the private key from a USB token, because their purpose is to protect it.

Once it’s installed, go to “Manage user certificates”, and select the node under Personal, and Certificates:

Windows certificate manager

Then on the right pane look for your certificate and double click it, a dialog will open, go to the details tab and scroll down:

Subject and Thumbprint on certificate details

Those are the values that will be used in the command line, and if your certificate’s in a crypto USB token, the built-in functionality on Windows should open the certificate selector and then your provider software should ask for the password to unlock the private key… I guess 🤣 because I couldn’t try. But that’s how ISVLicenseGenerator works, it lets you select the certificate from the list, then loads it, and the certificate management software from the certificate provider asks you for the password, unlocks the private key, and uses it to generate the license file.

In theory, IN THEORY, theoretically, you can also use the subjectname and thumbprint parameters with an HSM-backed certificate. Using the full address where your certificate is. But I also haven’t tested this 😝

If it’s the end, so be it!

I’m releasing this last version as some kind of farewell to it. I created it out of a mistake, order a USB certificate instead of software. I’ve enjoyed creating and maintaining it, because that’s what I like the most about this job, being able to investigate (decompile 😂) things, and understand how they work. There have been a lot of “aha moments” while I understood the code in the standard AXUtil library and the X++ classes that enable the license files.

And when I got it working the first time, I was really happy (and also relieved) to see I could keep the USB and didn’t have to order another certificate. But then, thanks to Microsoft ignoring their customer’s requests it’s been a useful tool for many other people, and I’m also happy about that.

So if I had to make a toast I’d say: to problems (that can be solved), and its solutions that make me happy!

APIOps: ALM for Azure API Management

Tue, 27 Aug 2024 06:44:09 GMT

In this post, I’m going to talk about APIOps, the DevOps techniques applied to Azure API Management, that allow us to automate the promotion of changes between API Management instances.

It would be possible to attain a certain degree of automation using Bicep, but it wouldn’t apply to many elements of the APIM, and that’s why we need and like APIOps!

APIOps is like riding the master of automation

If you want to learn more about Azure API Management, you can read my previous posts and video:

Why use APIOps?

The biggest benefit from using APIOps is automation. With DevOps we can automate the deployments of updated code to sandbox environments thanks to CD pipelines, and we can have CI pipelines to make sure our code builds correctly.

Note

You can read my complete ALM guide on Microsoft Dynamics 365 for Finance & Operations and Azure DevOps.

Also, automation brings us many other benefits. By applying the principles of Application Lifecycle Management (ALM) to APIs, APIOps makes the entire APIM lifecycle much easier on us. This automation reduces the risk of errors when moving changes between development, UAT or production APIMs. It also accelerates the deployment process thanks to the publishing pipeline that moves the changes between environments/instances.

How does APIOps work?

Later we’ll learn how it works in more detail, but now let’s see a high-level solution of how APIOps works. The current solution, which is provided by Microsoft, is based on two pipelines and some extra tools hosted on their GitHub repo.

There is an extractor pipeline that will “read” your source APIM instance and generate several files used to define the features and characteristics of your APIM instance.

The extractor pipeline creates a Pull Request in your Azure DevOps repo. When we merge this PR into the main branch, the publisher pipeline runs.

The publisher pipeline takes the setup of your source APIM instance from the files created by the extractor pipeline.

First, the publisher pipeline will publish the changes to the same source APIM instance so you can do some testing.

Then the changes are deployed to the UAT pipeline (if you have one), but only after manual approval. And finally, and also after manual approval, they move to the production APIM instance.

Two supported scenarios

APIOps supports two ways of working: users that build their APIs from the Azure portal and users that build their APIs from an IDE (like VS). In this post, I’ll be showing the first way, from the Azure portal.

In the first scenario (from Azure portal), the workflow looks like this:

Make all changes to the APIM in the Azure portal.
Manually run the extractor pipeline, which will automatically create a PR with all the changes.
Approve and merge the PR into the main branch.
The publisher pipeline will be triggered and publish the changes to the current “dev” environment.
Once the changes are reviewed and validated, there are manual approvals to promote the changes to higher environments like UAT or production.

In the second scenario (from an IDE), the workflow is slightly different:

Do the changes in the IDE and commit them to a dev branch.
Manually create a PR to the main branch.
Approve the PR and merge it to the main branch
The publisher pipeline will be triggered and publish the changes to the current “dev” environment.
Once the changes are reviewed and validated, there are manual approvals to promote the changes to higher environments like UAT or production.

You can see the difference between both scenarios is in the first steps, and also that when using an IDE the extractor pipeline isn’t used because we’re doing the changes in code that’s checked-in to the dev branch.

Configuring APIOps

Now that we know how APIOps works, it’s time to configure everything. But first, here are some links that contain all the information and we’ll need:

The scenario I’ll describe only has a development and production APIM instance, but I’ll explain how to also add a UAT instance between dev and prod.

Starting scenario

For this example, we’ll have a “source” APIM instance with a single API called customers that has an update method:

APIM instance with the customer API

The APIM is using a policy to authenticate to Dynamics 365 F&O. We want all of these to move into the production APIM!

Upload base files

The first step will be preparing the Git repo in Azure DevOps, so head to the releases page of APIOps’ GitHub project and look for the latest version. Beware of not using one of the many alpha versions! For this post, I’m using v5.1.4, which is the latest non-alpha version.

Download the Azure_DevOps.zip file from there, unzip it and upload the contents to your Git repo in Azure DevOps. Once uploaded, your repo should look like this:

APIOps pipelines

This ZIP file contains the YAML files for the extractor and publisher pipelines.

Create a service connection

We need to create a service connection in Azure DevOps, pointing to the Azure that contains the APIM resources. Go to your project settings and select “Service connections” in the left menu under pipelines.

Create the service connection

Create a new one, select “Azure Resource Manager”, then “Workload Identity federation (automatic)”, and in the next step you must choose your subscription, resource group where the resources are and give the connection a name. You can use the subscription name plus resource group to identify it easily.

Note

Check the “Grant access permission to all pipelines” checkbox. Otherwise you’ll have to authorize it when running the extractor and publisher pipelines later.

Create variable group

Go to the Pipelines menu, then Library and create a new variable group called apim-automation and the following variables: SERVICE_CONNECTION_NAME, APIM_NAME, RESOURCE_GROUP_NAME, RESOURCE_GROUP_NAME_Prod and apiops_release_version.

Variable group

Now for the values use:

SERVICE_CONNECTION_NAME: the name of the connection you created in the previous step.
APIM_NAME: the name of your dev APIM.
RESOURCE_GROUP_NAME: the azure resource group name where your dev APIM is.
RESOURCE_GROUP_NAME_Prod: the azure resource group name where your production APIM is.
apiops_release_version: the version of the release from the APIOps you’re using. In my case, it is v6.0.1.1. You need to specify it with the points, so it would be “v6.0.1.1”.

Create environment

Now, in the left menu, still in the Pipelines section, go to “Environments”, and create a new one called “Prod”. We will use this in the approval steps of the pipelines. Change to the “Approvals and checks” tab on top, and add a new check of the type “Approvals”:

Environment approval

Add someone as the approver, I’ll add myself for the example.

Create config file

Now go back to your repo and create a new file in the root. Call it configuration.prod.yaml with this contents:

apimServiceName: apim-aristeinfo
namedValues:
loggers:
diagnostics:
backends:
apis: customers

In the apimServiceName element add your production’s APIM name. And to the apis element your API name.

The config file is used to replace the values of the dev APIM for the ones that the prod instance will have. like named values that use Key Vaults, loggers etc. You can learn all about the config file in the APIOps wiki!

Now, also in the root of the repo, create a folder called artifacts. This folder will be used to store the extracted configuration of your dev APIM instance.

Note

If you give this folder a different name other than artifacts, you must update the run-publisher.yaml file, in the parameters section, because it specifically looks for the “artifacts” folder.

Create the extractor pipeline

Now it’s time to create two pipelines from the YAML files we uploaded in the beginning, an extractor and a publisher pipeline. Go to the pipelines menu and create a new one.

We start with the extractor pipeline. Select “Azure Repos Git”:

Azure Repos Git

Then select your repo, and in the next step “Existing Azure Pipelines YAML file”:

Existing YAML pipeline

And select the run-extractor.yml file:

Extractor pipeline

Save it, don’t run it yet, and then go to pipelines, select it and click “Run pipeline”. We will get some fields to fill in:

Extractor pipeline run

We must fill in these fields:

APIM instance name: the name of your dev APIM.
APIM instance resource group name: the resource group name where your dev APIM is.
APIM repository for pull request: the name of your Azure DevOps repo.
Folder where you want to extract the artifacts: the folder we created in the root of our repo, which we named artifacts.

Now just click run… and there’s a chance your pipeline won’t start running! Click the first stage in the API and check whether you’re getting this message: “This pipeline needs permission to access 2 resources before this run can continue to Create artifacts from portal”.

Pipeline needs permission

Click view and “Permit” if you have anything to allow. If you didn’t select the “Grant access permission to all pipelines” checkbox when you created the service connection you will get these two items to permit:

Permit

If you did select the checkbox, you will only get the variable group permit. Now let’s see if the pipeline run works…

Most likely you’ll see a successful (with a warning) first stage, and a failed second stage, the one called “Create artifacts pull request”. This is due to missing permissions. Click the second stage, and go to the step with the error. You will see a line that says: “You need the Git ‘GenericContribute’ permission to perform this action.”, followd bu an identity like Build\3d382728- and more numbers 🙂

You need the Git ‘GenericContribute’ permission to perform this action

Copy that GUID, go to your project settings, then repositories, the security tab on top, and paste it in the search box:

Give permissions to the build service

And set to “Allow” the following permissions: Contribute, Contribute to pull requests, Create branch and Create tag.

Permissions

Now go back to the pipelines, enter the failed run, and rerun the failed job in the second step:

Rerun failed jobs

Now hopefully the pipeline will create a pull request. So go to Repos, Pull Requests, switch to the active tab and yours should be there. But leave it there for now.

Create the publisher pipeline

First, install the “Replace Tokens” extension for Azure DevOps to your organization. It’s required and the publisher pipeline will fail otherwise.

Now we have to create the publisher pipeline. We’ll do the same as with the extractor one, create a new one, from an existing YAML file, but this time select the “/tools/pipelines/run-publisher.yaml” file.

This one is a CI pipeline, that will run after every commit or merge to the main branch.

We’re done here. Yes, that was all. Now back to the Pull Request.

Merge the Pull Request

Open the pull request and go to the “Files” tab. You will see that it has created a structure of folders and files with the definition of your dev APIM.

Also, if you go to the files in your repo, and click the branches, you’ll see that the pull request has been created in a different branch:

New branch

And that’s why we must merge it to main. Go to the PR again and approve it, or just complete it, it’s your choice 🤪

Once the PR is completed, the publisher pipeline will start… to ask for more permissions! Like the extractor one, we have to permit changes to the variable group and service connection:

More permissions needed

Now the first stage will publish the changes to the dev APIM instance. At this point, you can go to your dev APIM to validate and test the changes.

Remember we created an environment with an approval before? It will be used now before publishing the changes to the prod APIM instance:

Approval in the pipeline

Click Review, and approve it, and the publisher pipeline will apply the changes to the production pipeline.

And that’s all, I hope this post has been useful to start “playing” with the APIOps concept and automate you APIs lifecycle even more! This is quite “basic” and I’d like to write some more content about the config file and how to replace some values in policies using named values for example. I’ll leave that for another post!

Error querying Synapse Link

Tue, 19 Mar 2024 09:49:54 GMT

A short one for today! I stumbled upon this while configuring the new Azure Synapse Link for Dataverse feature for an environment.

Most of the time, when I’m configuring resources on Azure, I do it as a subscription or resource group owner. This means I’m working in god-mode all the time, and I won’t be finding out some issues that users with less access rights do.

Fixing Synapse Link

What’s Azure Synapse Link for Dataverse?

If you’re currently using the Export to Data Lake feature using the add-in in LCS, you must know that it’s been deprecated since October 15, 2023, and that after November 1, 2024, it will stop working. Azure Synapse Link for Dataverse is replacing it, and you can learn how to migrate in the Synapse Link transition guide.

The new Synapse Link feature is configured from Power Platform’s maker portal, and it still supports standard and custom data entities and tables. But if you can learn more about it, and how to configure it, you can read:

Aurélien Clere’s blog post One Dynamics One Platform : Analytics – Delta Lake Synapse Link.
Chapter 8 of my book “Extending Dynamics 365 Finance and Operations Apps with Power Platform“.

The issue: blob access rights

When we configure Synapse Link with a Synapse workspace, we have the following resources:

Storage account: here’s where data from the ERP is stored in data/delta lake format, depending on how you configure Synapse Link.
Synapse Analytics workspace: here we can explore data thanks to the built-in serverless SQL instance.
Spark pool: used for data processing and transformation.

One of the requisites to configure all of this is that we need to add the Synapse Analytics workspace as a “Storage Blob Data Contributor” on the storage account so it’s able to read data.

When you do all of this and access the serverless SQL pool in the Synapse Analytics workspace, you can query data without issues. And the same if you try accessing it from SQL Server Management Studio (SSMS) with your user that’s an owner on Azure.

But what if you create a Microsoft Entra ID app registration that will be used as a service principal to access the serverless SQL instance? We create the app registration, add it as a service principal with the role “Synapse SQL Administrator” inside the workspace, then access the SQL instance with SSMS, try to query the CustTable and…

Content of directory on path 'https://your_storage_account_name.dfs.core.windows.net/dataverse-instance-name/deltalake/custtable_partitioned/_delta_log/*.*' cannot be listed.

Why is that!? Remember you added the Synapse Analytics workspace as a “Storage Blob Data Contributor” to the storage account? Well, we need to do the same with the service principal we’ve created and that will be using to read data.

So go to your storage account, and then add the role assignment:

Add role assignments to storage account

We can use “Storage Blob Data Contributor” or “Storage Blob Data Reader” which has less access rights but will be enough to query data.

Now just wait for a few minutes and try running the query again. And problem solved!

Azure Key Vault support in ISVLicenseGenerator v0.7

Thu, 22 Feb 2024 15:49:09 GMT

I’m once again back with a new version of the ISVLicenseGenerator tool, the piece of software I created with a modified version of the standard AXUtil.dll library that lets us sign license files using a cryptographic USB token.

Warning

ISVLicenseGenerator is not needed anymore and won’t be maintained.

In the new version (v0.7) I’ve added the possibility of signing the license file using a certificate stored on an Azure Key Vault.

And this time I come with a request from anyone reading this post. If you have an HSM-protected key for your code-signing certificate, and are storing it in a Key Vault, I’d love you to try this new version out!

Why am I asking this? Well, I swear there are no hidden intentions here! The main reason is that I don’t have access to HSM keys, and I can’t test the new functionality with one of those. So if your certificate provider has a cloud HSM, and provides some sort of Azure Key Vault integration to store the keys in it, and you want to try it… I’ll be very happy to try to fix things if they don’t work!

What’s going on with ISV licensing?

In February 2024 AXUtil will stop allowing to use SHA1 as the signing algorithm. Something I did on ISVLicenseGenerator v0.6.

There’s something that, as far as I know, Microsoft still hasn’t solved, which is offering a solution for certificates that are delivered in a cryptographic USB token. Yes, my tool covers that, but I’d totally understand if some companies wouldn’t trust a community-made tool instead of an official Microsoft tool 🤷‍♂️

What’s new in version 0.7?

If you open the tool and see the UI, you’ll see it keeps the beautiful appearance, but with a few new fields on top:

ISVLicenseGenerator v0.7

Now you can select between signing the license file using the USB token or local certificate (that’s the existing functionality), or use a certificate stored on Azure Key Vault!

If you choose it as the certificate location, you’ll have to provide details in five more fields:

Azure Key Vault certificate additional fields

Key Vault DNS: this can be found in the overview tab of your Key Vault instance.
Key name: is the name of the certificate in Azure Key Vault where you’ve stored the code-signing certificate.
Entra ID Tenant Id: can be found on the main page of Entra ID in the Azure portal.
AppId: we’ll need an app registration to access the Key Vault from the application as a service principal.
Secret: the secret in the app registration.

Configuring Azure Key Vault

Let’s quickly see how to configure the Key Vault, store the certificate and add the app registration as a service principal.

First deploy an Azure Key Vault, it can be from the standard tier.

Azure Key Vault

In the key vault you’ll see the DNS, which is the Vault URI field (and which I’ll have deleted once I’m done writing this post), and you also have the tenant Id in the Directory ID field below the DNS.

Now upload the certificate under the “Certificates” menu on the sidebar:

Import private key

Remember here you need to upload your private key! The public key is used as a resource in Visual Studio when you create the configuration key used to lock your ISV.

The next step will be creating an App registration on Entra ID:

App registration

Here you will get the App Id in the Application (client) ID, and can get the tenant ID again.

Create a secret in the app registration and keep it somewhere safe.

Now we need to give this app registration rights on the Key Vault to access the certificate we’ll upload, and to sign the license. Go to the Key Vault and under Access management (IAM) on the sidebar we’ll add two roles.

Why two? We could accomplish this with a single role, but I want to reduce the amount of access rights for this app registration! First click the Add button on top and select “Add role assignment”. The first role we’ll add is the “Key Vault Certificate User” role:

Key Vault Certificate User

Click the next button, and click the “+ Select members” link, and look for the name of your app registration:

Add app registration

Click, select, then “Review + assign” twice.

Now repeat the steps for the “Key Vault Crypto User” role:

Key Vault Crypto User

Once done we can go to ISVLicenseGenerator, fill in all the fields and click generate:

ISVLicenseGenerator v0.7

If all the information is correct you’ll get this nice success screen:

Success

And you’ll have a working license to unlock your ISV!

What happens with the HSM-protected keys?

Well, that’s the question I’d also like to know the answer to! Unfortunately, I don’t have access to any certificate provider, and can’t check their HSM capabilities or if they have an integration for code-signing certificates to be stored in Azure Key Vault.

If this were possible, we could use the HSM capabilities of the Premium tier of Azure Key Vault, where we can create a Key Encryption Key (KEK) that’s later used to request a certificate from a certificate provider:

KEK generation

If you want to give it a try you can fork the repo on GitHub, and if you need any assistance from me, feel free to contact me. I’d love to add this feature to the tool.

I wrote a book! Extending Dynamics 365 Finance and Operations Apps with Power Platform

Mon, 15 Jan 2024 08:29:07 GMT

I guess that most of my readers will already be aware of this, as I’ve been spamming LinkedIn with the news: I wrote a book!

The book is called like this post’s title: “Extending Dynamics 365 Finance and Operations Apps with Power Platform”. It covers some practical scenarios where I show how to use Power Apps, Power Automate or AI Builder with F&O data.

It also offers an introduction and overview into the Power Platform integration and F&O: linked environments, Dual-write, Virtual tables, Dataverse, PPAC, etc.

Cover of the book

Who is the book’s target?

Well I’m a technical person, so if you expect is a purely technical book you’re ri… WRONG!

Of course, I will always have a bias when doing things, because, as I just said, I’m a technical person and I LOVE solving technical issues. That’s what drives me, to be honest.

But the book is targeted at all profiles, technical and functional consultants, architects, that maybe haven’t had enough exposure to Dataverse or the Power Platform. The first chapters will show you the basic concepts and I think that’ll be very helpful.

And I think that also people from the F&O or the Dataverse sides will learn something from their respective “other side” 😝

What’s in the book?

This is the table of contents and a brief description of the content:

Dynamics 365 F&O and Low-Code Development, discusses how development has been done traditionally in F&O and how low-code tools like those in Power Platform can help us speed it up. An overview of Power Platform and Dataverse is also provided.
Dual-Write and Virtual Tables, shows how we can integrate the data from F&O into Dataverse and the benefits and issues that come with both methods.
Power Automate Flows in Dynamics 365, provides an overview of Power Automate, its connectors, and the triggers and actions we can have inside a flow. We also compare and learn about the differences between using the Dynamics 365 F&O connector and the Dataverse one with virtual tables in flows.
Replacing F&O Processes with Power Automate, discusses how we can extend the workflow functionality in F&O using Power Automate and have users approve or reject flows from Teams or emails.
Building Automations and Integrations, shows how we can use a Power Automate flow instead of X++ to connect to a FTP/SFTP server to retrieve a file and update data inside F&O.
Power Apps: What’s in It for Finance and Operations Consultants, serves as an introduction to Power Apps and how we can embed them in existing F&O forms.
Extend F&O Apps with Power Apps, shows an example of building a canvas Power App in which we display F&O data, create filters, and update the data back in F&O from the canvas app.
Power BI reporting for Dynamics 365 F&O Apps, shows how we can export data from F&O into Azure Data Lake Storage thanks to the Synapse Link functionality and virtual tables.
Integrating AI Builder, introduces us to AI Builder and its custom and pre-trained models, and shows examples of using those models inside a Power App and from Power Automate.
Environment Management, serves as an introduction to the Power Platform admin center and Dataverse environments.
Solution Management, serves as an introduction to the Application Lifecycle Management (ALM) concept and shows the differences between managed and unmanaged solutions, along with examining how we can move the components we create between environments.

Where can you get the book?

Depending on where you live, you can buy the book from:

Packt’s site
Amazon.com (US)
Amazon.co.uk (UK)
Amazon.es (Spain)
Amazon.it (Italy)
Amazon.de (Germany)
Amazon.fr (France)
Amazon.co.jp (Japan)
Amazon.in (India)
Amazon.br (Brazil)
Amazon.ca (Canada)
Amazon.com.mx (Mexico)
Amazon.com.au (Australia)
Barnes& Noble (US)
Kriso (Estonia and Lithuania)

Drop me an email at adria(at)ariste(dot)info if you’re having trouble finding it.

Microsoft Dev Box and Dynamics 365 F&O local development

Thu, 14 Dec 2023 07:15:19 GMT

After a long, long, long, long, long time waiting for it, the Dynamics 365 F&O local development feature is finally here… in public preview. It’s a bit different since the first time we heard about this at the MBAS in 2019… but it opens up a new scenario for developers.

I won’t go into much detail about the new unified developer experience, which is its name now, but if you want to know what you need to use it and how to configure it, you can read this blog post from Aurélien Clere: Dynamics 365 FinOps Unified developer experience.

Today I’ll explain what Microsoft Dev Box is and how we can use it with the Dynamics 365 F&O local development tools. We will also learn about the cost, and in which scenarios we could benefit from Microsoft Dev Box as our development environment. You know, the best of both worlds, or the worst… 🤣

Mixing the cloud and local tools…

But first…

What is Microsoft Dev Box?

Microsoft Dev Box is an Azure service that we can use to deploy ready to use virtual machines for development. For X++ development? No, it’s targeted to… well to anything that Visual Studio has out-of-the-box like .NET, Azure development, Python, etc. But that doesn’t mean we can’t use it for X++ development! We’ll see that later.

What can we do with Microsoft Dev Box?

Seamless Setup and Configuration: Microsoft Dev Box allows teams to quickly set up development environments that are pre-configured with the necessary tools, libraries, and settings. This reduces the time spent on environment setup and troubleshooting, allowing developers to focus more on coding.
Collaboration and Consistency: Since Microsoft Dev Boxes are cloud-based, teams across different locations can work on a consistent environment. This ensures that everyone is working with the same set of tools and configurations, reducing the “it works on my machine” problem.
Powerful and Scalable Resources: Microsoft Dev Box provides access to scalable cloud resources, which means developers can leverage high-performance computing power as needed. This is particularly useful for resource-intensive tasks like compiling large codebases, running tests, or using machine learning algorithms.
Enhanced Security: Being a cloud-based solution, Dev Box benefits from Microsoft’s robust security protocols. This means your code and development environment are protected with industry-leading security measures.
Integration with Existing Tools: Dev Box integrates seamlessly with other Microsoft services and many third-party tools, offering a comprehensive development experience. Whether you’re using GitHub, Azure, or other CI/CD tools, Dev Box fits into your existing workflow.
Flexibility and Customization: Teams can customize their Dev Boxes to match their specific project needs. Whether you’re developing a mobile app, a web service, or a machine learning model, you can tailor your environment accordingly.
Efficient Resource Management: With Dev Box, organizations can manage resources more efficiently. Development environments can be spun up or down as needed, ensuring that you only pay for what you use.

And speaking of costs… how much does Microsoft Dev Box cost? As everything in Azure it depends on the SKU of the resources used. We can choose between three CPU and RAM setups:

8 vCPU and 32 GB RAM
16 vCPU and 64 GB RAM
32 vCPU and 128 GB RAM

And we can deploy each of these sizes with 256, 512, 1024 or 2048 GB of storage.

So, for example, a 8 vCPU with 32 GB of RAM and 256 GB of SSD storage costs, deployed in West Europe:

Storage: 18.69€/20.52$ per month
Compute: 1.47€/1.61$ per hour
Maximum monthly price: 135.93€/149.26$ per month

Source: Microsoft Dev Box pricing.

It’s not that expensive, if we use a dev VM for 8 hours each day, and 20 days per month that’s 20*8*1.47 + 18.69, which is 253.89€ per month. Is it? No it isn’t! You can see we have a maximum monthly price, and when the usage of an instance goes over that maximum price, that’s all you will pay that month! The compute cost is capped at 80 hours.

Licenses everywhere

Before continuing, let me tell you something about licenses. Because it’s always licensing! And let me quote Microsoft on this:

To use Microsoft Dev Box, each user must be licensed for Windows 11 Enterprise or Windows 10 Enterprise, Microsoft Endpoint Manager, and Azure Active Directory P1.
In addition to being available independently, these licenses are included in Microsoft 365 F3, Microsoft 365 E3, Microsoft 365 E5, Microsoft 365 A3, Microsoft 365 A5, Microsoft 365 Business Premium, and Microsoft 365 Education Student Use Benefit subscriptions.

https://azure.microsoft.com/en-us/pricing/details/dev-box/

It’s not that bad, right? Most of us working at partners, or customers implementing Dynamics 365, have a Microsoft E3 or E5 license assigned, which would fulfill the base requirements. Just keep that in mind.

Enough licensing, now let’s get back to dev boxes and pricing!

Having a maximum monthly price means that if you use a Microsoft Dev Box just for some hours a month, you will pay its hourly price, but if you use it a lot, when you go over the max price it will switch to the max monthly price automatically!

That’s regarding compute, which only counts while the dev box is running (not shut down or hibernated). But what about storage? Well, as like many other Azure services, you pay for storage as long as the storage resource exists, so if you kept a Microsoft Dev Box turned off for a whole month you’d only pay its storage costs.

This looks cheaper than a Cloud-hosted environment VM to me… of course we can’t compare both because if we need to enable the Power Platform integration and have a Dataverse environment linked to your F&O dev instance we have to deploy it as a CHE. Do we?

Well, here’s where the new unified development experience takes the spotlight!

One Dynamics One Platform

As you may know, we’re on a trip to have a unified admin and developer experience for Dynamics 365 F&O and Dataverse.

The new developer experience starts when we deploy a sandbox environment in Power Platform admin center instead of LCS. And this means that we no longer have to manually configure the Power Platform integration, it will be on by default.

So we don’t really need a CHE if we want to build things that use both F&O and Dataverse. Let me show you something, this is how a unified development environment looks like on PPAC.

Unified development environment in PPAC

Do you notice something different? It has a Dataverse environment URL and… a Finance and Operations URL too! This is not something new and exclusive about the unified development experience, we’ve actually had it for some time, but it was a bit different. Let me explain.

When we configured the Power Platform integration from LCS, a Dataverse environment was deployed and showed the F&O URL too. But in this case we’re deploying a Dataverse environment from PPAC with F&O installed as a Dynamics 365 app!

If this sounds a bit confusing, I’d recommend you to get familiar with PPAC and the new unified admin experience in PPAC.

And this is why I think that in some scenarios we can replace our CHE for a Microsoft Dev Box with the local dev tools.

Unified developer experience and Microsoft Dev Box

Let me make something clear first: this is not a blueprint, a one-size-fits-all solution. Depending on your team, your processes, your customer’s requirements and other factors, you may still benefit from using cloud hosted environments. It’s up to you to find that out!

You might be thinking, “but weren’t the local dev tools meant to be used locally?”. Yes, you can install them on your local laptop and start working!

But what if your current laptop doesn’t meet the requirements? What if because of company policies, you can’t install all the required components? What if you just don’t want to install anything on your laptop? What if, what if…?

So whatever is your reason, I will show you an alternative to use the local dev tools!

Deploying a dev center

The first thing we need to do is create a Dev center in our Azure subscription:

Create a dev center on Azure

Select the region which is the nearest to you or your development team, in my case I go with West Europe. If you have a distributed team of developers, you can create several dev centers for the different regions your team is.

Next we need to create a project inside the dev center:

Create a project in dev center

We just need to select the dev center and give the project a name:

New project in dev center

Now we will go back to the dev center and will create a dev box definition:

Create a dev box definition

Complete the required fields with your selected VM and storage sizes:

Dev box definition

I recommend giving it a meaningful name, which hints at the both the size of the VM, storage and Visual Studio and Windows versions.

Now go inside the project we created earlier, and create a new dev box pool:

New dev box pool

And now we will complete all the fields:

Dev box pool details

I’d also use the same name as in the definition, just out of convenience. Complete all other fields as per your requirements and select the licensing checkbox.

Finally, in the project, we need to assign the role DevCenter Dev Box User to the users that will create and use the dev boxes. You have to do this even if you’re the owner of the Azure resources!

We’re done with the dev center, now it’s time to access the dev boxes…

Accessing the Microsoft dev box

In order to create and access these dev boxes, we need to go to Microsoft developer portal at https://devportal.microsoft.com/.

If you get this screen:

Dev portal is not ready!

This means that either the Azure resources are not deployed yet or that you’re missing the DevCenter Dev Box User role! Once that is fixed you should see this:

Dev portal is ready!

So just click the “New dev box” button:

New dev box creation

In case you had several dev box pools, for example for different Visual Studio versions, you would get a dropdown in the “Dev box pool” field, and you’d be able to select in which pool you’re deploying the dev box.

Finally, click the create button and wait around 25 minutes.

Dev box being created!

Configuring the dev box for F&O

Once the Microsoft dev box is ready you will receive an email and be able to connect to it using the RDP client or your browser like Bastion does.

Microsoft dev box is ready

Choose your preferred method and log into the dev box using your Azure ADMicrosoft Entra ID credentials!

The VM has everything needed to work with the F&O local dev tools, including LocalDB.

Once you’ve logged in you basically have to follow Aurelién’s post linked at the beginning of the post. I’ll configure everything quickly without going into much detail and I’ll just focus on the issues I’ve found.

The first step is running Visual Studio and logging into your account. Then we will install the Power Platform tools extension.

Power Platform Tools install

Close Visual Studio and the extension will install. Once done open Visual Studio again and connect to your F&O development environment in Dataverse. We do that in the Tools menu:

Connect to Dataverse

Enter your credentials, and select your environment in the list and select the solution. The a dialog will appear asking if we want to download the F&O assets:

F&O assets download

This will download several things to the C:\Users\YOUR_USER_NAME\AppData\Local\Microsoft\Dynamics365\10.0.1627.73 folder:

F&O visual studio extension
Cross-references database BAK
PackagesLocalDirectory ZIP file.

The first thing we will do is unzip the ZIP file. The documentation suggests to use 7-Zip to do that, and I do too because using the Windows extraction tool it took over an hour for me to unzip the file, while when using 7-Zip it took less than 10 minutes. You can uncompress the AOT objects wherever you want. For example, I do it at C:\AOSService\PackagesLocalDirectory because… I’m used to that.

While the ZIP file is uncompressed install the VS extension for F&O. And one thing: don’t move the BAK file from there! When we configure the environment it expects the BAK file to be there, if we delete it, cut it somewhere else or whatever, we won’t be able to configure the local development tools!

When the ZIP file has finished being extracted and the extension is installed we can continue.

Open Visual Studio again, go to Extensions, hover on the Dynamics 365 menu item and… a dialog will appear!

Local XPP configuration

We need to complete all the fields. Give it a name and description as you like, as the xRef database server use (localdb)\., and a name for the xRef DB that will be restored using the BAK file.

IMPORTANT: click on the version number. I went nuts until I noticed you had to actually click and select it, it’s not automatically selected!

Finally, change the paths to your AOSService folders and click Save. It will fail, because we have to select the configuration as active by enabling the “Current” check next to the configuration name on the list. Now click Save and it will start restoring the xRef DB, you will see a message on the dialog.

If you have a database server error you might have to start the localdb instance. You can do that opening a command prompt and running this command:

sqllocaldb start mssqllocaldb

Now create a runnable class with a hello world, deploy the model to the environment, run it and…

Runnable class in the cloud!

It works!

Once you’re done for the day, you can head back to the developer portal and choose several options:

Dev center shut down

You can hibernate or shut down the box, which will stop the computing costs (but not the storage ones). We can also restart it, or delay the scheduled shutdown if it’s configured. And of course, we can also delete it.

What about performance?

Probably performance is one of the things we all thought about when the local developer experience was released.

And how is performance of the local tools on a cloud box? Well, it’s the same as in my laptop. I think the bottleneck for performance here are the actual F&O development tools and not hardware, local or in the cloud.

You still get some VS freezes and the warnings of the extension, but it’s definitely not worse than working on your own PC.

What about Visual Studio 2022?

If you want to use a Microsoft dev box with Visual Studio 2022 or Windows 11, go ahead! Since version 10.0.36 the Visual Studio extension for the F&O tools are included in the deployable packages used for the version upgrades!

Final thoughts

This is a small proof of concept, and while I think most people will use the local development tools on their local PC, there’s some cases where we could benefit from Microsoft Dev Box.

From a cost perspective we see that Microsoft Dev Box can cost much less than a classic LCS-deployed virtual machine.

I wouldn’t use this if I wanted to deploy and delete the dev box daily, because configuring the dev tools every day would be quite a loss of time. However it’s possible to use custom images to create dev boxes. Something I haven’t tried but maybe could be explored to have an image pre-configured.

Finally, this is something that may work for me, but not for others, and as always we need to evaluate what’s the best solution for us: the local VHD, cloud-hosted environments or local development.

But hey, I enjoyed trying this!

Microsoft Sentinel for Dynamics 365 F&O

Wed, 19 Jul 2023 05:51:04 GMT

Today I’m bringing you a post that’s all about Dynamics 365 F&O, but the main focus is on security, specifically Microsoft Sentinel. Some days ago it was announced a Microsoft Sentinel Solution for F&O had been published and is currently in preview. Let’s learn a bit about it!

That’s how Microsoft Sentinel really works

Sometimes we overlook the security aspects of the things that are not directly related to F&O, specially regarding resources like networking, storage accounts, dev VMs, Microsoft Entra ID (this is Azure AD’s new name!) or using Bastion.

And we don’t do that because we just don’t care about security, but because we’re Dynamics 365 people, and sometimes we might lack the knowledge in other things. If you’re lucky, you’ll have an in-house security team that’ll take care of that, otherwise we need to train ourselves a bit.

This is the first time I’ve used Microsoft Sentinel, and I’m for sure missing on a lot of things and features. Time to learn!

What is Microsoft Sentinel?

Let me repeat: this feature is in preview as of July 2023.

Microsoft Learn defines Sentinel as:

Microsoft Sentinel is a scalable, cloud-native solution that provides:

Security information and event management (SIEM)

Security orchestration, automation, and response (SOAR)

Microsoft Sentinel delivers intelligent security analytics and threat intelligence across the enterprise. With Microsoft Sentinel, you get a single solution for attack detection, threat visibility, proactive hunting, and threat response.

https://learn.microsoft.com/en-us/azure/sentinel/overview

Microsoft Sentinel makes it easy to collect security data across your organization, not only Dynamics 365 F&O! From devices, to users, to apps, to servers on any cloud. It uses the power of artificial intelligence to ensure you are identifying real threats quickly.

Microsoft Sentinel provides several capabilities, including but not limited to:

Collect data at cloud scale across all users, devices, applications, and infrastructure, both on-premises and in multiple clouds.
Detect previously undetected threats, and minimize false positives using Microsoft’s analytics and unparalleled threat intelligence.
Investigate threats with artificial intelligence, and hunt for suspicious activities at scale, tapping into years of cybersecurity work at Microsoft.
Respond to incidents rapidly with built-in orchestration and automation of common tasks.

Configuring Microsoft Sentinel for F&O

The process to configure Microsoft Sentinel for F&O is pretty straightforward and if you follow the official Microsoft Learn tutorial to deploy Microsoft Sentinel solution for Dynamics 365 Finance and Operations, you should have no issues, but I’ll follow the same steps.

Create a new Log Analytics Workspace

Go to the Azure portal and look for Microsoft Sentinel, click the “Create Microsoft Sentinel” button:

Microsoft Sentinel workspaces in your Azure subscription

Microsoft Sentinel sort-of runs on top of a Log Analytics workspace. We use the Log Analytics workspace to ingest the data from our resources, then Microsoft Sentinel analyses that data. The create button will show the Log Analytics workspaces, if you have any:

Log Analytics workspaces

If you don’t have any, or want to create a new one, you must create a new one:

Create Log Analytics workspace

Give it a meaningful name, you can see in the image I’m calling it onefin-sentinel, but a better name would be onefin-sentinel-loganalytics.

Add Microsoft Sentinel to the workspace

Once it’s created you will see it in the previous screen, if you don’t see it click the refresh button. Finally, select it and click the “Add” button in the bottom left corner.

Add Microsoft Sentinel to a Log Analytics workspace

Install the F&O solution

When this is done, it will take you to the Microsoft Sentinel main screen. Now we need to install the F&O solution. In the left sidebar, look for “Content hub”, and then in the search bar look for Dynamics 365, you should see the one we want as “Dynamics 365 Finance and Operations”. Click the “Install” button in the lower right corner:

Install the Dynamics 365 Finance and Operations solution in Microsoft Sentinel

Install the F&O data connector

When the solution has finished installing, we need to add the data connector to F&O. In the left menu, go to the “Data connectors” section. You should already see the “Dynamics 365 F&O (using Azure Functions)” connector there. If it’s not there, use the search bar or try cleaning the filters:

Microsoft Sentinel data connector for Dynamics 365 F&O

Click the “Open connector page” button in the lower right corner. You will see this:

Data connector for F&O

The data collection is done using an Azure Function. Don’t worry, it will be deployed using an ARM template. We just need to click the blue “Deploy to Azure” button, a new tab will open:

Azure Function deployment using ARM template

We need to complete the information in the template fields:

Function App Name: the name of the Azure Function app, remember that it should be meaningful and describe what it is. Like d365fo-sentinel-app.
Workspace Name: the Log Analytics workspace name we created in the first steps.
Finance Operations Api Host: the URL of your Dynamics 365 F&O instance.

Click the “Review + create” button, and once everything has been validated, the “Create” button.

This will take a bit longer than the previous steps, but not much, I’d say less than 5 minutes.

Get the function Managed Identity

Head to the Azure AD section in the Azure portal. Yes, the name has changed, but not all the branding is ready yet. Navigate to the “Enterprise Applications” section. We have to remove the filter on the image below:

Remove the Enterprise Applications filter

And then add a new filter to display only the managed identities apps:

Filter on managed identities

In the search bar look for your Azure Function app name:

Azure Function in AD

And finally, copy its Application ID. Now we’re headed to the F&O interface.

Create a new security role

Go to System administration -> Security -> Security configuration, and create a new role.

New role

Now click on Privileges under the references grid, and click the “Add references” button:

Add privilege to role

In the list, filter on the name and look for “Database log”. Add the “Database log Entity View” privilege.

Finally, publish the security objects. Go to the “Unpublished objects” tab, select the new role we just created, and click the “Publish selection” button. You can use the “Publish all” option if you wish and have no other pending changes:

Publish objects

Note: if you’re not doing this for the production environment, it’s better to create the role and add the privilege in Visual Studio. If a DB refresh is done to the environment you’re using, the role created from the Dynamics 365 F&O UI will be gone.

Create a new user

Or use an existing one if you want. This user will be assigned the role we’ve created and used in the Azure Active Directory applications form.

If you use an existing user, make sure it’s not a superuser or system administrator.

Add a new Azure AD application

Now, using the Application ID we copied before from the Azure Function managed identity, create a new record in the Azure Active Directory applications form, and use the new user we’ve just created as the User ID.

New Azure AD App

We’ve configured everything. Microsoft Sentinel is ready to ingest and analyze data from our Dynamics 365 F&O instance. But which data is monitored? Now, this is going to be interesting…

Now, the part that I don’t like…

You might’ve already noticed and already know where I’m going. When we created the new role, we added the privilege to read the database log entity, remember?

It’s not a surprise, the monitoring in Microsoft Sentinel for F&O is using the database log!! And what is wrong with the database log? Possible performance issues!!

So, in my opinion, this restricts a bit what we can do with Microsoft Sentinel to:

Parameter tables
Master data tables
Other tables during a short period of time

And of course, we can forget about transaction tables. At least, it’s not possible to add new tables to the database log until you configure the cleanup log batch job.

Add whichever table you want to monitor. I’ve chosen the Bank Accounts as in the Learn tutorial. When the Azure Function app triggers, which does every 10 minutes, we will see the changes in the Logs section:

F&O Logs

And in the query editor we look for the FinanceOperationsActivity_CL logs as in the image above, we will see the records for the changes done. And inside the “FormattedData” node we can see all the fields of the table that we’re logging, with their old and new value:

Changes in the Bank Accounts

What does Microsoft Sentinel offers out-of-the-box for F&O?

The solution we installed in the first steps includes a small set of rule templates that can be enabled and used with no other setup needed:

Rule name	Description
F&O – Non-interactive account mapped to self or sensitive privileged user	Identifies changes to Azure AD Client Apps registered for Finance & Operations, specifically when a new client is mapped to a predefined list of sensitive privileged user accounts, or when a user associates a client app with their own account. To modify the list of sensitive privileged accounts, change the “priviliged_user_accounts” variable in the rule query.
(Refer to the example in the rule query)
---	---
F&O – Mass update or deletion of user account records	Identifies large delete or update operations on Finance and Operations user records based on predefined thresholds. Default update threshold: 50
Default delete threshold: 10
---	---
F&O – Bank account change following network alias reassignment	Identifies updates to bank account number by a user account which his alias was recently modified to a new value.
---	---
F&O – Reverted bank account number modifications	Identifies changes to bank account numbers in Finance & Operations, whereby a bank account number is modified but then subsequently reverted a short time later.
---	---
F&O – Unusual sign-in activity using single factor authentication	Identifies successful sign-in events to Finance & Operations and Lifecycle Services using single factor/password authentication. Sign-in events from tenants not using MFA, coming from an Azure AD trusted network location, or from geolocations seen previously in the last 14 days are excluded.

This detection uses logs ingested from Azure Active Directory. Therefore, you should enable the Azure Active Directory data connector. | | --- | --- |

These alert templates can be found under the Analytics menu, in the Rule templates tab:

Alert templates

This alerts can create incidents, which for example we can later use in a Logic App (there’s no Microsoft Sentinel connector for Power Automate), or can send notifications from Azure to administrators.

What happens behind the scenes?

I’ll provide a short explanation as a high-level overview of how all the elements we’ve deployed and configured work.

As we’ve seen, all of this depends on the database log functionality in Dynamics 365 Finance and Operations. Then there’s an Azure Function that runs on a schedule and will query the OData endpoint for the database log entity. That’s why we need to configure the managed identity of the Azure Function in the AD applications form.

And it’s the Azure Function the one that’s responsible to send the data to the Log Analytics Workspace, which is later analized by Microsoft Sentinel.

Some final thoughts

I do see the value of Microsoft Sentinel in securing your Azure AD Microsoft Entra ID. For F&O, with the functionality I’ve described here, and what I’ve been able to test… to me, it feels like, in simple scenarios, we’re using a sledgehammer to crack a nut. If you only want to track field changes, you can use the standard alerts’ functionality.

However, for complex scenarios, Microsoft Sentinel offers more advanced rules, like checking for mass updates, or field values being changed after a user has an updated network alias and therefore a different login. This is something that really does add a value to your security strategy.

As I said, this is the first time I’ve used Microsoft Sentinel, so I’m probably missing on something, I promise I’ll keep on investigating.

F&O alert emails in Power Automate

Mon, 10 Jul 2023 06:02:31 GMT

There’s a nice feature in Dynamics 365 F&O that lets us emit notifications when data is changed, created or deleted: the alert framework.

In this post, I will show you how to send the alerts as Business events and send emails notifying the users using a Power Automate flow.

When I was almost done writing this blog post, I found this blog post and video from Scott Gaines where he showed this scenario. Take a look at it for a clearer step-by-step guide: Using Dynamics 365 Finance and Operations Alerts to Trigger Power Automate Flows.

Why? The standard does that!

You’re 100% right. There’s a standard functionality that already does that, you can configure an alert and select a recipient for the email and add a message:

Create an alert dialog in F&O

So why would anyone duplicate that functionality outside of Dynamics 365 F&O? It’s just my opinion, but the email that the standard sends is terribly awful! Look at this:

Standard alert email

Plus, you can’t customize it! Not even brand it with your company logo. Other than adding a fixed message in the Message field when creating the alert, you can’t add template placeholders as we do in the email templates for example.

In the past, I raised a question about this in the Dynamics Insider Program group and was told to create an idea, so I did that, here’s the idea. But after almost 4 years, I’m not very confident this will be implemented, specially seeing we can do it using Power Automate.

Alerts Business events

We have two batches for the alerts:

Change-based alerts: these include create, delete or update events.
Due date alerts: triggered by a date going over a limit.

Both types are also available as Business events under the “Alerts” category. When an alert is triggered, it will emit a Business event of the same type as the alert.

However, in order for this to work, you need to mark the “Send externally” field when configuring the alert.

Alert configured with the send externally field

Before continuing, let’s create an alert on the customer groups form. Select the field “Terms of payment”, the event “has changed”, and in the “Alert me with” tab enable the “Send externally” field. Just like in the image above.

Power automate

Now we’ll configure the flow. Start by creating a new automated cloud flow, and in the dialog that will open, press the skip button.

As a trigger, search for “Fin & Apps” and you should see the “When a Business Event occurs” trigger. Select your instance, Alerts in the category field, When an alert rule is triggered in the business event field, and the company where you configured the alert in the Legal entity field. In my case, that’s Contoso’s USMF.

When a business event occurs

This trigger will return a JSON body, we need to parse it to be able to have all the JSON members as a separate field in the dynamic fields’ dialog in the flow designer.

Add a Parse JSON action, and as the Content field, select the body that’s returning the trigger. Now we must define the schema. The schema is a definition that tells the parse block which fields are expected, and its type. Instead of doing this by hand, we will use the “Generate from sample” button.

Save the flow as it is, and go back to the Business Events workspace. Select the BusinessEventsAlertEvent business event and click the “Download schema” link on the right pane:

Download F&O business event schema

This will download a JSON file with sample data. Open it and copy the content. Then go back to the Power Automate designer, click the “Generate from sample” button and paste the content of the file into the dialog that opens, and finally click the Done button.

This will generate the schema. Now we need to design a nice email, because that was what I didn’t like in the first place, right? And how will we do this? With our old friends adaptive cards!

Go to the adaptive cards designer, select “Outlook Actionable Messages”and design the one that makes you happy.

Outlook email adaptive card

In my case I’ve added a logo in the top left corner, a title in bold large size, a text field and an OpenUrl button.

In the adaptive cards designer, you can copy and paste the JSON structure of the card from the “Card payload editor” on the lower part of the page. We will use that later, but first we will create the text that will be displayed on the card.

Add a new compose block after the Parse JSON action, and write what you want to display in the email. In my case, I’ve done this:

Adaptive card text in a power automate compose block

The TableLabel field (which comes from the Parse JSON action) will display the name of the table. The KeyValue1 and KeyValue2 fields display what we define in the TitleField1 and TitleField2 of the table, in the case of the CustGroup table the CustGroup and Name fields.

Next, add another compose block. Here we will use the JSON content of the adaptive card. But wait a second, we can’t just paste it! In order for the email to display the content correctly, we must wrap the JSON content inside this:

<script type="application/adaptivecard+json">
JSON CONTENT
</script>

Now we should have this in this compose block:

<script type="application/adaptivecard+json">
{
    "type": "AdaptiveCard",
    "$schema": "http://adaptivecards.io/schemas/adaptive-card.json",
    "version": "1.4",
    "body": [
        {
            "type": "ImageSet",
            "images": [
                {
                    "type": "Image",
                    "size": "Small",
                    "url": "URL_OF_LOGO"
                }
            ],
            "imageSize": "Small"
        },
        {
            "type": "Container",
            "items": [
                {
                    "type": "TextBlock",
                    "text": "SUBJECT_FIELD_PARSE_JSON",
                    "wrap": true,
                    "id": "Title",
                    "weight": "Bolder",
                    "size": "Large",
                    "fontType": "Default"
                }
            ]
        },
        {
            "type": "Container",
            "items": [
                {
                    "type": "TextBlock",
                    "text": "OUTPUT_FROM_TEXT",
                    "wrap": true,
                    "id": "Text"
                }
            ]
        },
        {
            "type": "Container",
            "items": [
                {
                    "type": "ActionSet",
                    "actions": [
                        {
                            "type": "Action.OpenUrl",
                            "title": "Go to record",
                            "id": "OpenBtn",
                            "url": "LINK_FIELD_PARSE_JSON"
                        }
                    ],
                    "id": "OpenBtn"
                }
            ]
        }
    ]
}
</script>

There are 4 places where you should change the values:

The URL of your logo:

URL

The Subject field that returns the Parse JSON step:

Mail subject

The output of the compose action where you wrote the body of the email:

Mail body

And finally, the Link field from the Parse JSON step:

Link to record

Finally, add a “Send an email (V2)” action and complete the To field with the people that should receive the email. This value doesn’t come in the JSON output from the Business event, you must add the recipients by hand. This might seem worse than adding the emails in the alert inside F&O, but you can always use distribution lists or email groups instead of adding all the addresses.

Then in the Subject field select the Subject field from the Parse JSON action, and in the Body field add the Outputs of the adaptive card compose action, the last one we did.

Save the flow, go to the customer groups form and change the terms of payment value of any record. The flow will trigger, and you should get an email that looks like this:

Alert email

I know, it’s not much nicer than the standard one, but thanks to adaptive cards we can make it even better. It’s just that I’ve not done it better.

In conclusion, using Power Automate along the alert framework in Dynamics 365 F&O not only enhances the versatility and utility of alerts, but also provides opportunities to create more personalized and visually pleasing notifications.

ISV License Generator v0.6 released

Thu, 16 Mar 2023 09:33:31 GMT

Yesterday I released a new version of ISV License Generator with full support for the SHA-256 hash function after fixing an issue with it.

Warning

ISVLicenseGenerator is not needed anymore and won’t be maintained.

What’s new in ISV License Generator?

In this new version the support to generate Dynamics 365 Finance and Operations licenses using the SHA-1 hash has been removed, and it will use SHA-256 by default as the AXUtil tool does.

ISV License Generator

Remember this is an open-source tool released under the MIT License which uses a custom version of the AXUtil library to be able to use it from a Windows application.

If you want to learn more about this tool, you can read:

Why is this important?

Due to the Ballot CSC-13 of the CA/B Forum, code signing certificates will stop being shipped as software certificates, and all certificates will have to be store in a hardware crypto device which is FIPS compliant.

In the past we could use software certificates and the AXUtil tool to generate licenses, but if we had our code signing certificates in a cryptographic USB, we could not use it. And that’s why I created this tool.

So if you’re currently signing licenses for your ISVs with a software certificate, you can still use the AXUtil tool. But when it expires, and you have to renew it, you’ll get it in a cryptographic hardware device, and then you can use ISV License Generator to create your licenses!!

Thanks to Juan Antonio Tomás for making me notice about this change in signing certificates!

You can download the latest version of ISVLicenseGenerator v0.6 on GitHub.

Create a Dynamics 365 F&O encrypted field

Wed, 08 Mar 2023 12:02:53 GMT

Today we have a quick and easy X++ post where we’ll learn how to create an encrypted field in Dynamics 365 Finance and Operations.

Creating an encrypted field in Dynamics 365 Finance and Operations is a simple process that can help secure sensitive information in your application. By using an encryption key to encrypt the data, it ensures that the data remains safe even if it is accessed by unauthorized users.

By encrypted field I mean what you see, for example, in the Email parameters form for the SMTP password:

Email parameters encrypted field

Encrypted fields

These encrypted fields aren’t stored as plain text in the database, instead they’re encrypted (as its name suggests) using a key and that value is saved.

It’s worth mentioning that each environment has a different encryption key, so when you refresh a sandbox or development environment with data from another environment, the values of encrypted fields are lost because they can’t be unencrypted with a different key.

Creating it

You need a new field in a form, you know that the first step is creating it in a table. For this example, I’ll be adding a field to the CustParameters table and form.

So extend the table in your model and go to the EDTs in the AOT and drag and drop the EncryptedField EDT into the CustParameters table extension. Give it the name you want, I’ll name mine AASEncryptedField, and let’s continue.

Next, you need to create a code extension for the CustParameters table. Because encrypted fields are shown on forms as an edit field, we need a method to encrypt and decrypt the content of the field, and that’s what we’ll do here:

[ExtensionOf(tableStr(CustParameters))]
final class CustParameters_aristeinfo_Extension
{
    public edit Name AASEncryptedNameEdit(boolean _set, Name _value)
    {
        return Global::editEncryptedField(this, _value, fieldNum(CustParameters, AASEncryptedField), _set);
    }
}

This is a regular edit method, but it’s calling Global’s editEncryptedField method and there it’s calling Appl’s class EncryptForPurpose and DecryptForPurpose kernel methods that do the job.

Defining an EDT as the return type in the method will help us display the right label in the form, so create your EDTs or use one that fits your purpose. I’m using the Name one because this is just a demo!

Finally, we’ll add a string field in the form and set the CustParameters table as its Data Source property, and the CustParameters_aristeinfo_Extension.AASEncryptedNameEdit method as its Data Method property. If your field’s base data type is not a string, you need to add the correct type of new field!

Synchronize, compile and let’s take a look at the field in the UI:

That doesn’t look like it’s encrypted…

Ooops, I forgot about something! You need to set the form field’s property Password style to Yes! Otherwise, it’ll only show plain text. Let me change that…

Encrypted field with password style

That’s much more better. You might be wondering… if it was showing plain text before using the password style… was it really encrypted? Yes, it was. If we take a look at the field’s value in SQL Server Management Studio:

Encrypted value in SSMS

That’s the encrypted value stored in SQL Server. It was showing plain text because the editEncryptedField method of the Global class takes care of unencryption. But believe me that in SQL it’s stored as encrypted data! Done!

And just like that, you created a new encrypted field and added a bit more of security to your customizations. This has been quite easy, and as I always say, if you need to do something that the standard application already does, take a look at it because that’ll be the best way of doing it.

Dynamics 365 F&O and firewalls: monitor Azure IP ranges

Thu, 09 Feb 2023 10:52:21 GMT

If you’re integrating Dynamics 365 Finance & Operations with 3rd parties, and your organization or the 3rd party one are using a firewall, you might’ve found yourself in the scenario of being asked “which is the production/sandbox IP address?”.

Well, we don’t know. We know which IP it has now, but we don’t know if it will have the same IP in the future, you will have to monitor this if you plan on opening single IPs. This is something Dag Calafell wrote about on his blog: Static IP not guaranteed for Dynamics 365 for Finance and Operations.

I monitor with my eye

So, what should I do if I have a firewall and need to allow access to/from Dynamics 365 F&O or any other Azure service? The network team usually doesn’t like the answer: if you can’t allow a FQDN, you should open all the address ranges for the datacenter and service you want to access. And that’s a lot of addresses that make the network team sad.

In today’s post, I’ll show you a way to keep an eye on the ranges provided by Microsoft, and hopefully make our life easier.

WARNING: due to this LinkedIn comment, I want to remark that the ranges you can find using this method are for INBOUND communication into Dynamics 365 or whatever service. For outbound communication, check this on Learn: For my Microsoft-managed environments, I have external components that have dependencies on an explicit outbound IP safe list. How can I ensure my service is not impacted after the move to self-service deployment?

Azure IP Ranges: can we monitor them?

Microsoft offers a JSON file you can download with the ranges for all its public cloud datacenters and different services. Yes, a file, not an API.

But wait, don’t complain yet, there IS an API we can use: the Azure REST API. And specifically the Service Tags section under Virtual Networks. The results from calling this API or downloading the file are a bit different, the JSON is structured differently, but both could serve our purpose.

My proposal: an Azure function

We will be querying a REST API, so we could perfectly be using a Power Automate flow to do this. Why am I overdoing things with an Azure function? Because I hate parsing JSON in Power Automate. That’s the main reason, but not the only one. Also because I love Azure functions.

Authentication

To authenticate and be able to access the Azure REST API we need to create an Azure Active Directory app registration, we’ve done this a million times, right? No need to repeat it.

We will need a secret for that app registration too. Keep both. We will create a service principal using it.

Go to your subscription, to the “Access control (IAM)” section and add a new role assignment:

Create a service principal

Select the contributor role and click next:

Contributor role

Click the select members text and look for the name of the app registration you created before:

Add members

Finally, click the “Select” button, and the “Review + assign” one to end. Now we have a service principal with access to a subscription. We will use this to authenticate and access the Azure REST API.

The function

The function will have an HTTP trigger, and will read and write data in an Azure Table. We will do a POST call to the function’s endpoint, and that will trigger the process.

Nice diagram

Then the function will download the JSON content from the Azure REST API, do several things, like looking into the table to see if we stored a previous version of the addresses file, compare both and save the latest version into the table. This is the code of the function:

[FunctionName("CheckRanges")]
        public static async Task<IActionResult> Run(
            [HttpTrigger(AuthorizationLevel.Function, "post", Route = null)] HttpRequest req,
            ILogger log)
        {
            log.LogInformation("C# HTTP trigger function processed a request.");

            string ret = string.Empty;

            try
            {
                string body = String.Empty;

                using (StreamReader streamReader = new StreamReader(req.Body))
                {
                    body = await streamReader.ReadToEndAsync();
                }

                if (string.IsNullOrEmpty(body))
                {
                    throw new Exception("No request body found.");
                }

                dynamic data = JsonConvert.DeserializeObject(body);
                string serviceTagRegion = data.serviceTagRegion;
                string region = data.region;

                if (string.IsNullOrEmpty(serviceTagRegion) || string.IsNullOrEmpty(region))
                {
                    throw new Exception("The values in the cannot be empty.");
                }

                // Get token and call the API
                var token = GetToken().Result;

                var latestServiceTag = GetFile(token, region).Result;

                if (latestServiceTag is null)
                {
                    throw new Exception("No tag file has been downloaded.");
                }

                // Download existing file from the blob, if exists, and compare the root changeNumber                
                var existingServiceTagEntity = await ReadTableAsync();

                // If there's a file in the blob container we retrieve it and compare the changeNumber value. If it's the same there's no changes in the file.
                if (existingServiceTagEntity is not null)
                {
                    if (existingServiceTagEntity.ChangeNumber == latestServiceTag.changeNumber)
                    {
                        // Return empty containers in the JSON file
                        AddressChanges diff = new AddressChanges();

                        diff.addedAddresses = Array.Empty<string>();
                        diff.removedAddresses = Array.Empty<string>(); ;

                        ret = JsonConvert.SerializeObject(diff);

                        log.LogInformation("The downloaded file has the same changenumber as the already existing one. No changes.");

                        // Return empty JSON containers
                        return new OkObjectResult(ret);
                    }
                }

                // Process the new file
                var serviceTagSelected = latestServiceTag.values.FirstOrDefault(st => st.name.ToLower() == serviceTagRegion);

                if (serviceTagSelected is not null)
                {
                    ServiceTagAddresses addresses = new ServiceTagAddresses();

                    addresses.rootchangenumber = latestServiceTag.changeNumber;
                    addresses.nodename = serviceTagSelected.name;
                    addresses.nodechangenumber = serviceTagSelected.properties.changeNumber;
                    addresses.addresses = serviceTagSelected.properties.addressPrefixes;

                    // If a file exists in the table get the differences
                    if (existingServiceTagEntity is not null)
                    {
                        string[] existingAddresses = JsonConvert.DeserializeObject<string[]>(existingServiceTagEntity.Addresses);

                        ret = CompareAddresses(existingAddresses, addresses.addresses);
                    }

                    // Finally upload the file with the new addresses
                    var newAddressJson = JsonConvert.SerializeObject(addresses);

                    //await UploadFileAsync(fileName, newAddressJson);
                    await WriteToTableAsync(addresses);
                }
                else
                {
                    AddressChanges diff = new AddressChanges();

                    diff.addedAddresses = Array.Empty<string>();
                    diff.removedAddresses = Array.Empty<string>();

                    ret = JsonConvert.SerializeObject(diff);

                    // Return empty JSON containers
                    return new OkObjectResult(ret);
                }
            }
            catch (Exception ex)
            {
                return new BadRequestObjectResult(ex.Message);
            }

            return new OkObjectResult(ret);
        }

I’ve added comments to the code to make it clearer, but we’ll go a bit through it. You can find the complete Visual Studio solution in the AzureTagsIPWatcher GitHub repo.

Environment variables

You will find this piece of code several times in the code. This is used to retrieve the environment variables:

Environment.GetEnvironmentVariable("ContainerName")

It means that once you’ve deployed the function, you need to create as many different application settings in the Azure function as different variables you’ll find in the code. The variables are used to save the value of keys, secrets, etc. to create the connections to storage and get the token credentials. These are the ones I have used, and you should complete with your own values:

ContainerConn: the connection string to your Azure storage account.
ContainerName: the name of your storage account.
StorageKey: the key for your storage account.
StorageTable: the name of the table.
appId: your app registration id.
secret: the secret in your app registration.
tokenUrl: this will be the URL used to get the token. You need to change YOUR_TENANT_ID by the id of your tenant: “https://login.microsoftonline.com/YOUR_TENANT_ID/oauth2/token”.
resource: “https://management.azure.com/”, this is the root URL we will authenticate to.
apiUrl: “https://management.azure.com/subscriptions/YOUR_SUBSCRIPTION_ID/providers/Microsoft.Network/locations/{0}/serviceTags?api-version=2022-07-01”, and this is the API endpoint URL. You need to change YOUR_SUBSCRIPTION_ID for the id of the subscription in which you’ve created the service principal.

HTTP call

The function is expecting a POST call with a JSON body in its request, containing the node we want to get the addresses from, and also the region:

{
    "serviceTagRegion": "azurecloud.westeurope",
    "region": "westeurope"
}

Function response

The function will return a JSON file with two containers, one for added addresses if any, and one for removed addresses:

{
    "removedAddresses":[],
    "addedAddresses":[]
}

Using the function

Now we have an Azure function with an HTTP trigger that returns a JSON string with two nodes with the changed addresses, or empty nodes if no changes exist.

How can we trigger this function on a schedule? With Power Automate, of course! We can use a scheduled cloud flow, that runs once a day, or as many times as you want.

Once we have a trigger, we will call the function. I like to create “Compose” blocks where I “initialize” the value of several “variables”. They’re not variables, but you’re getting what I mean, right?

In this first compose block I just add the body of the function:

Function body

Then we add an HTTP action, we set it to the POST method and add the function URL, and in the body the output of the previous compose block:

Calling the Azure function

The next step will be parsing the response of the function. It will always return the containers, filled in or empty, so you can use this as the payload to generate the schema. And finally add the Body output of the function:

Parsing the function output

Then I will create two more “Compose” blocks where I’ll save the output values of parsing the JSON, one for the added addresses and one for the removed ones:

Values from the JSON parsing

And now I add a condition where we’ll check whether there’s anything inside the new or deleted arrays. How can we check this? We will use an expression in the value field to check if the container’s length is 0:

Check if the arrays are empty

And if it’s 0 (“If yes” branch) we’ll do nothing, and if it contains elements (“If no” branch) we’ll send an email:

Outcomes

Let’s test it!

To test it, I’ll go into my Azure Table and edit the latest entry it has, because I’ll run the function locally several times. I’ll change the value of the columns ChangeNumber and Addresses.

Changing values

And now run the flow…

Flow run

We can see the flow has gone through the “If no” branch in the condition, because the arrays contained changes. And I can see those in the email I’ve received:

Email from Flow

And that’s all! As I said at the beginning, this could also be done solely using a Power automate cloud flow, but I preferred using an Azure function to do the dirty job of comparing values.

You can find all the code in the GitHub project AzureTagsIPWatcher.

2023 Release Wave 1 plans: what’s new?

Wed, 25 Jan 2023 16:35:12 GMT

It’s already that time of the year again, the Dynamics 365 and Power Platform 2023 Release Wave 1 plans have just been released!

The 2023 release wave 1 for Microsoft Dynamics 365 Finance and Operations is focused on improving the development, administration, and user experiences by removing barriers, tightening integrations, and enhancing cross-platform capabilities. This release will bring a range of new features and capabilities that will help improve the performance of the platform and enhance the overall experience for developers, administrators, and end-users.

The features described here are planned to be delivered from April to September 2023.

The 2023 release wave 1: I bring fresh features! by Eva

2023 Release wave 1: Cross-Application Features

The features described here will be available for ALL the Dynamics 365 Finance and Operations apps, including Finance, Supply Chain Management, Human Resources,
Commerce, and Project Operations.

Existing features

First, I will start with the list of existing features that will be mandatory or automatically enabled starting on the version 10.0.32.

These features were introduced in the 2022 release wave 1 plan and 2022 release wave 2 plan.

Mandatory features with the 10.0.32 release

Mandatory features will be automatically enabled in all your environments when 10.0.32 arrives.

Enabled-by-default features with the 10.0.32 release

Enabled-by-default features will be automatically enabled on new environments, but not the ones that are already deployed. If you deploy a new environment on the 10.0.32 version they will be enabled, if you update an existing environment to the 10.0.32 version they won’t.

One Dynamics One Platform

One of the main features of this release, and it’s something that is becoming a norm for the F&O release notes, is One Dynamics One Platform, which focuses on the convergence plans of Finance and Operations Apps with Microsoft Power Platform. This will enable customers to take full advantage of Power Platform with each Finance and Operations environment and help improve end-user productivity and enhance the overall user experience.

Let’s see what’s waiting for us in 2023 in the cross apps section.

Improve performance from apps and integrations built on F&O virtual tables

Link to Learn: Improve virtual table perfomance

Public preview: not available

General availability: June 2023

This feature will offer us an improved latency in API responses between Dataverse and the F&O platform. All integrations that use the F&O virtual tables on Dataverse will perform better.

Ensure consistency in service requests between Finance and Operations apps and Microsoft Dataverse

Link to Learn: Ensure consistency in service requests

Public preview: February 2023

General availability: June 2023

If you’re a member of the Dynamics 365 Insider Program, you’ve probably heard about One Transaction.

One Transaction will allow X++ developers to have X++ code and calls to Dataverse inside a single transaction, thanks to the IOrganizationService API. This will enable commits and rollbacks to be consistent between F&O and Dataverse. And this will also work with transactions originating in Dataverse!

Simplify finance and operations apps privileged access to Microsoft Dataverse

Link to Learn: Simplify access to Dataverse by Finance and Operations apps

Public preview: February 2023

General availability: June 2023

More IOrganizationService API. In this case to simplify the process of granting access to the IOrganizationService API for Finance and Operations apps. The administrator of the Dataverse environment will be able to give these apps administrative access to send requests to the API, which is connected to the Dataverse environment via the Microsoft Power Platform integration.

Enable background jobs in Dataverse of One Batch

Link to Learn: Enable background jobs in Dataverse of One Batch

Public preview: June 2023

General availability: July 2023

This will be the phase 2 of the feature (this was phase 1) will prepare the platform for enabling Finance and Operations customers to use the Background job capabilities in Dataverse.

Power automate Flows to execute batch jobs, that’ll be nice to see.

Use IP-based cookie binding in finance and operations apps to block cookie replay attacks

Link to Learn: Block cookie replay attacks with IP-based cookie binding

Public preview: May 2023

General availability: July 2023

This is a security feature, maybe it looks like it has nothing to do with the Uno project or One Dynamics One Platform, but it has. It’s always nice to have better security features for the ERP, in this case to prevent cookie replay attacks, something that’s already available for Dataverse.

A cookie replay attack is done by getting an auhtentication cookie or token that has been issued by a server to your browser. Somebody could use that to impersonate you and gain access to the system.

The feature will help prevent this by offering an option to add the IP address of your computer with that cookie to block the access to F&O apps.

And that’s all regarding the new cross apps features. There’s also many cool other features in the Finance and SCM spaces, like data archival and purging, invoice automation or the tax rate API. If you want to learn more about all of them, you can go to the Learn page of 2023 release wave 1 plan.

Dataverse, dataverse, dataverse, dataverse

(Read it with the same rythm as Developers, developers, developers, developers)

As I said earlier, all the new platform features point to the same direction: Dataverse.

The 2023 release wave 1 plan for Finance and Operations apps includes the One Dynamics One Platform project, which aims to converge the Finance and Operations apps with Microsoft Power Platform and Dataverse.

This will enable customers to take full advantage of Power Platform with each Finance and Operations environment, helping to improve end-user productivity and enhance the overall user and admin experience.

Configure Azure Bastion for Dynamics 365 F&O VMs

Tue, 17 Jan 2023 07:31:33 GMT

We’ve been working with the F&O development VMs for a long time, specially Microsoft partners that need to be able to quickly and easily change between different customer environments, and using the VHD is a bit more complicated in that scenario.

And of course, we use Remote Desktop Protocol to connect to these VMs. RDP is insecure due to its weak encryption, widespread use, and the lack of security features built-in to the protocol. So hackers often target RDP to gain unauthorized access to systems. You can learn more about securing your VMs in Best practices for defending Azure Virtual Machines.

With Bastion you’re as safe as with Gandalf!

Today, we will walk through the steps of configuring Azure Bastion for Dynamics 365 Finance and Operations development VMs.

Azure Bastion

Azure Bastion is a service in Azure that enables you to remotely access your Azure Virtual Machines (VMs) directly from the Azure Portal. This eliminates the need to configure and maintain Remote Desktop (RDP) or Secure Shell (SSH) connections separately.

It is one solution to fix the RDP vulnerabilities, but if you’re using Microsoft Defender for Cloud, you could also use JIT access. As always, deciding between one or another is a matter of your or your customer’s preferences.

If you’re working at a partner, and you need to configure this in one of your customers, you’ll need access to their Azure subscription, and once it’s configured the people that need to access the VMs will need the following roles in Azure:

Reader role on the virtual machine.
Reader role on the NIC with private IP of the virtual machine.
Reader role on the Azure Bastion resource.
Reader role on the virtual network of the target virtual machine, if the Bastion deployment is in a peered virtual network, which we’ll see what it is later.

Let’s configure it

We will create all the resources in the Azure Portal, make sure you can do that before starting.

VMs Virtual networks and peering

This section is long, but it’s also important because it gives a bit of basic details of virtual networks that must be taken into account when configuring Bastion.

Azure Bastion provides access via RDP to virtual machines within a virtual network. Of course, there’s something called virtual network peering in Azure that lets us connect two different virtual networks and share the resources in the networks.

BUT, because there is one big BUT, you can only configure peering between networks with different network addresses. This means that if VNet A has the address space 10.1.0.0/16, and you want to peer it to VNet B, VNet B must have a different address space.

Let me ask Drake to explain it better:

How VNet peering should be

And something else: imagine we have VNet A with the address space 10.1.0.0/16, and VNet B with the addressing 10.3.0.0/16, and we configure peering for both. If we wanted to peer a third VNet C with VNet A, it should have a different address space than VNet A and VNet B.

Or as Drake would say…

VNet peering with several VNets

This may seem obvious, but I want to remark this before starting with Bastion because the defaults of a Dynamics 365 F&O development VM from LCS will always create the VM address space as 10.1.0.0/16.

Fortunately, we can change that in the advanced settings option while deploying a new CHE, and assign the VM VNet to an already existing virtual network.

What would I suggest? I would suggest planning things, if you can. This means creating a virtual network in Azure first, and deploying the VMs that need Bastion inside that VNet. If you do this, you can forget about peering.

If you have your VMs in different virtual networks, there’s a high probability that they have all the same address space. In that case, you can either deploy a bastion for each VM (more expensive) or redeploy the VMs in a single VNet (more time-consuming). It’s up to you.

If the VNets of the virtual machines are different, we’ll see how to set peering up later.

Resources location

Another important thing to remember: your NSG, virtual network and Bastion instance must be in the same region. If you’ll be using different virtual networks for Bastion and your VMs, the Bastion VNet can be in a different region than that of your VMs, but it will be the same as the one of the NSG and Bastion.

Network security group

After this long remark, we can take the first step: create a new Network Security Group (NSG). This NSG will be used in the virtual network of the Bastion we’ll create later.

This step is mandatory and is described in Working with NSG access and Azure Bastion.

You need to create the following security rules in the NSG.

Inbound

Port	Protocol	Source	Destination
443	TCP	Internet	Any
443	TCP	GatewayManager	Any
8080, 5701	Any	VirtualNetwork	VirtualNetwork
443	TCP	AzureLoadBalancer	Any

Outbound

Port	Protocol	Source	Destination
22, 3389	Any	Any	VirtualNetwork
443	TCP	Any	AzureCloud
8080, 5701	Any	VirtualNetwork	VirtualNetwork
80	Any	Any	Internet

To get the VirtualNetwork, AzureCloud, Internet, GatewayManager and AzureLoadBalancer values in the source or destination, you need to select “Service tag” in the Source field when creating a new rule.

Important: even if you’re not using the SSH port (22) you must add it to the outbound rule, otherwise when you apply the NSG to the virtual network you’ll get an error. Believe me, I lost some time until I discovered that…

Optional: Create a virtual network

If you want, you can create a separate virtual network for Bastion. If you choose to do this, remember to create it with a different address space than the existing virtual network where your VMs are.

For example, create a new VNet with the 10.10.0.0/16 address space. And, this is important, you must create a subnet named AzureBastionSubnet and with an address range size of at least 26. The minimum subnet size is 26, but it can be something larger, like 25 or 24.

Virtual network peering

And if you create a different virtual network, for Bastion, we need to create a peering with the one of your VMs. Go to your Bastion VNet, and go to the Peerings section:

Virtual network peerings menu

In the setup screen, name your links and select the target virtual network:

Virtual network peering setup

Deploy Bastion

Now we can deploy the Bastion instance. Firstly, we need to decide with tier we’ll be using. Bastion offers a Basic and a Standard tier, and other than the price they have some differences.

The Basic tier only allows two instances of Bastion, and you can only connect to the Bastion instance through the browser.

The Standard tier lets you decide how many instances it has, plus it also allows you to connect to Bastion using your RDP client in your PC, plus other features.

Depending on how many VMs you need to connect to, and if you want to use your local RDP client you will go with one or another.

Price-wise, it’s a bit cheaper to deploy 1 standard Bastion instance to access more than 2 VMs, than creating multiple Basic Bastion instances. So if you have 8 VMs, you can create 4 Basic instances or 1 Standard instance, and the Standard one will be a bit less expensive than the Basic ones.

So go to the portal and create a new instance of Bastion, remember the /26 subnet thing? If the virtual network you choose doesn’t have it, you will get a warning:

Subnet warning

You can create it clicking on the “Manage subnet configuration” link, add a new Subnet named AzureBastionSubnet, we already talked about this, and select the NSG we created before here:

Go back to the Create a Bastion screen and click on the Review + create button, and Create. It will take like 10 minutes to be ready.

Access the VM

Now in your VM in Azure, go to Bastion under the Operations section and you’ll see this:

Bastion access

Now you just need to enter the RDP credentials you find in LCS, the username without the “builtin\” part, and click Connect.

A new browser tab will open, and you’ll see the desktop of your VM. Done!

Conclusion

In conclusion, Azure Bastion is a powerful service that allows you to access your Azure VMs directly from the Azure Portal. By following the steps outlined in this article, you can configure Azure Bastion for your Dynamics 365 F&O VMs and enjoy the convenience and security of this service.

You will need to give each developer access to the Azure subscription of the dev VMs with the roles we’ve seen before, but it’s a way to avoid using RDP if you have to and secure your workflow.

IaC with Bicep: deploy Azure API Management Architecture

Tue, 13 Sep 2022 06:14:43 GMT

In the previous post, we learned about my proposal of an architecture for Azure API Management for integrations. And I closed the post with a pending thing, which was details on how to deploy and configure all the Azure resources the solution uses.

And in today’s post we’re going to see how all the resources are created, linked together and configured to have a fully working API logging solution, and how we can deploy everything using Bicep.

Do it manually!

Of course! That’s the logic way of doing it! With our keyboards and mouses, clicking buttons and entering names, then looking in Azure for configurations, connection strings, enabling options, etc.

That’s what I did the first time I set this up, I created all the resources from the Azure portal by hand, changing the configuration of the different elements until I had everything working fine.

But then I thought that there should be a way of deploying this automatically and if, for example, I had to deploy this in different customers or projects, could reduce the chance of having errors, or just avoid repeating work that can be automated.

I knew about the ARM templates, and I also knew that I don’t like them a lot. That’s when I remembered I had heard about this new thing…

Use Bicep!

Bicep is a language used to deploy Azure resources that we’ll use to create infrastructure-as-code (IaC) solutions.

One of the benefits of using IaC is that it helps automate resource deployments, and helps us to make sure that we deploy the same resources each time our code is run. The same code will always be deployed as the same infrastructure.

To deploy all the resources, you need an Azure subscription. Remember, you can register and get one free and with $200 of credit for 30 days, and that several services are always free of charge.

Bicep uses declarative syntax, which means that we describe what we want the code to do, and how the code does it is a problem of the compiler. I personally find it much easier to read than the JSON from the ARM templates.

And starting using it is really easy, you just need to install the Bicep tools, which if you’re using Visual Studio Code is as easy as installing an extension.

Then imagine you want to deploy a new storage account to your Azure subscription. We’ll write the following code:

resource aristeinfoStorageAccount 'Microsoft.Storage/storageAccounts@2021-09-01' = {
  name: 'aristeinfostorage'
  location: 'westeurope'
  kind: 'StorageV2'
  sku: {
    name: 'Standard_LRS'
  }
}

If you use the VS Code extension it’s almost as easy as writing .NET code, hitting the tab key 🙊 Joking… let’s take a look at the different parts of the code.

All resources are declared using the resource keyword, then aristeinfoStorageAccount would be like the variable name for that resource, and you can use it later in your code to access its members, just like an object in any OOP language. And what comes next, the ‘Microsoft.Storage/storageAccounts@2021-09-01‘ piece, is the type of resource, which the extension helps us look for it, you don’t need to remember how all resources are named.

Then inside the curly brackets we have:

The name, which will be the name of the resource in Azure.
The location, is the region where the resource is deployed to.
kind, is the version of the storage account.
sku, the tier of the resource.

Of course, different types of resources have different elements in its setup, and different properties.

Before deploying the file, make sure you have installed both the Bicep and Azure Account extensions for VS Code. And first, connect to your subscription by pressing F1 and looking for “Azure: Sign in”.

Now to deploy it, you just need to right-click on the VS Code tab and select the “Deploy Bicep file…” option:

Deploying a Bicep file from VS Code

Thanks to the Bicep extension you will see a dialog to select the subscription, the resource group (or create one) and after that it will also ask to select a parameter file, select None.

You will see a message in the output window, and if you go to the Azure portal (or click the link in the output window), navigate to the resource group you’re deploying this to, and select the Deployments option you will see the deployment:

Bicep deployment in Azure portal

And when it’s finished, you can go to overview and see your resource:

Storage account deployed using Bicep

It’s that easy, and if you want to learn more about Bicep, you can check Microsoft Learn learning paths for Bicep.

Deploying the APIM solution

I wanted it to be easy for everyone to try this, so I prepared everything and if you go check this GitHub project I’ve created, you will find the following things:

The X++ folder that contains a model with a custom web service that will create a calculator API in your F&O environment. There’s both a model folder and an axpp file you can import in Visual Studio.

The AzureFunction folder contains the code to create an Azure Function that will create a calculator API.

And finally, and what interests us the most, the Bicep folder that contains the needed code to create all the Azure resources, so you can test what I explained in my previous post without having to create all the resources manually. And you have two options.

Deploy an Azure Function

If you choose to try the solution using an Azure function, you just need to deploy the mainAzureFunction.bicep file.

You don’t need to create and deploy the Azure Function because the Bicep file will download this ZIP file which is only the Azure Function packaged to make your life easier, and this faster to try. If you prefer to deploy the function for security reasons, you’ll need to update the azureFunction.bicep file inside the modules folder.

If you choose this option, the dialogs will ask you for the following parameters: Subscription, Resource Group, location (which is defaulted to that of the resource group), prefix to be used as the name of the resources and, finally, email and organization to deploy the APIM (just your email and tenant but don’t worry no emails will be sent).

Deploy X++ code

If you choose this option, you have to download the code from the X++ folder and add it to your environment. Once you’ve done that, you can deploy the mainDynamics.bicep file.

If you prefer using an X++ custom web service to try this, you’ll have to provide additional information. In addition to the same parameters as the ones of the Azure Function solution, you’ll need to provide the environment URL (without the final /), the environment URL with the API information (service group and service name, also without the final /), tenant, AAD App Id and secret.

This way of deploying the code will create a policy in your APIM that will handle the token authentication, that’s why it’s asking for the tenant, App Id and secret.

The Bicep files

In the Bicep folder you will find these files:

Bicep folder

The mainAzureFunction.bicep and mainDynamics.bicep files are what needs to be executed/deployed, depending on which way you choose to go.

Let’s take a look at the mainAzureFunction.bicep file:

@description('The location where the resources will be deployed')
param location string = resourceGroup().location
@description('A prefix that will be added to the resources.')
param prefix string
// Analytics
@description('Log Analytics workspace name')
var logAnalyticsWorkspaceName = '${prefix}LogAnalytics'
@description('Name for the App Insights resource')
var appInsightsName = '${prefix}AppInsights'
// Azure Function
@description('The name of the account storage used by the Azure function')
var storageName = toLower('${prefix}Storage')
@description('Azure function name')
var functionName = '${prefix}Function'
@description('App Service plan name')
var appServicePlanName = '${prefix}AppServicePlan'
// APIM
@description('Name of the APIM resource')
var apiManagementInstanceName = '${prefix}apim'
@description('APIM publisher email')
@secure()
param publisherEmail string
@description('APIM publisher name')
param publisherName string
@description('Name of the API that will be created in the APIM')
var apiName = 'calculator'
// Analytics resources
module analytics 'modules/analytics.bicep' = {
  name: logAnalyticsWorkspaceName
  params: {
    appInsightsName: appInsightsName
    location: location
    logAnalyticsWorkspaceName: logAnalyticsWorkspaceName
  }
}
// Azure Function Resources
module azureFunction 'modules/azureFunction.bicep' = {
  name: functionName
  params: {
    appInsightsId: analytics.outputs.appInsightsId
    appServicePlanName: appServicePlanName
    functionName: functionName
    location: location
    storageName: storageName
  }
}
// APIM Resources
module apiManagement 'modules/apiManagement.bicep' = {
  name: apiManagementInstanceName
  params: {
    apiManagementInstanceName: apiManagementInstanceName
    apiName: apiName
    endpointUrl: azureFunction.outputs.azureFunctionUrl
    location: location
    publisherEmail: publisherEmail
    publisherName: publisherName
    apiKey: azureFunction.outputs.azureFunctionApi    
    appInsightsId: analytics.outputs.appInsightsId
    appInsightsKey: analytics.outputs.appInsightsKey    
  }
}

I’ve put the parameters and variables at the beginning of the file and the resources after that.

When you use a parameter, that’s declared using the parm keyword, you need to provide that parameter each time the Bicep file is run.

Variables are declared with the var keyword and… you remember about resources, right? But there are no resources in this file, instead there are…

Modules

In Bicep, modules are files that are deployed from other files. Think of them as other classes which we can use in the main file. It’s something like this.

In modules, you usually group resources that need to be deployed together or that can be reused in other files.

The modules’ folder contains other Bicep files that help deploy all the infrastructure.

For example, let’s take a look at the azureFunction.bicep file:

param functionName string
param appServicePlanName string
param appInsightsId string
param storageName string
param location string
// Storage resources
resource storageAccount 'Microsoft.Storage/storageAccounts@2021-09-01' = {
  name: storageName
  location: location
  kind: 'StorageV2'
  sku: {
    name: 'Standard_LRS'
  }
}
resource appservice_plan 'Microsoft.Web/serverfarms@2022-03-01' = {
  name: appServicePlanName
  location: location
  properties: {}
  sku: {
    name: 'Y1'
    tier: 'Dynamic'
  }
}
resource azureFunction 'Microsoft.Web/sites@2022-03-01' = {
  name: functionName
  location: location
  kind: 'functionapp'  
  properties: {
    serverFarmId: appservice_plan.id
    siteConfig: {
      appSettings: [
        {
          name: 'AzureWebJobsStorage'
          value: 'DefaultEndpointsProtocol=https;AccountName=${storageAccount.name};AccountKey=${listKeys(storageAccount.id, storageAccount.apiVersion).keys[0].value}'
        }
        {
          name: 'APPINSIGHTS_INSTRUMENTATIONKEY'
          value: reference(appInsightsId, '2020-02-02').InstrumentationKey
        }
        {
          name: 'FUNCTIONS_EXTENSION_VERSION'
          value: '~4'
        }
        {
          name: 'FUNCTIONS_WORKER_RUNTIME'
          value: 'dotnet'
        }
        {
          name: 'WEBSITE_RUN_FROM_PACKAGE '          
          value: 'http://ariste.info/wp-content/uploads/2022/08/CalculatorFunction.zip'
        }        
      ]
    }
  }  
}
output azureFunctionId string = azureFunction.id
output azureFunctionApiVersion string = azureFunction.apiVersion
output azureFunctionUrl string = azureFunction.properties.hostNames[0]

First, we see parameters too. These parameters will be required when using the module in another file.

And then we see the resources. You can see I’m deploying a storage account, an app service plan and the function. These go in this module because those are things needed when you deploy a function.

And at the end we see output variables, that can be accessed from the file that uses the module, like a return in a method.

Deploy

I’m going to show this using the Azure function, I open the mainAzureFunction.bicep file and right click in the tab and select “Deploy Bicep file…”:

Deploy Bicep file

You will see a list of the subscription the user you’ve authenticated with has access to:

Azure subscriptions

Then you’ll get asked which resource group you want to deploy it to, or if you want to create a new one:

Create new resource group

I’ll create a new resource group. When you do this, you will get an additional dialog asking in which region you want to create it from a list.

Then you can select a parameter file, but we’re not using it, so select “None“.

And now we have to select the region where the resources are going to be deployed. Because in the code we’re using the resourceGroup().location value, we see this option in the dialog, but we could use a different one.

Resource group selection

Next we enter the prefix, keep in mind it has to be a unique name:

Prefix

And finally enter the email and publisher name, your name or domain.

And, finally, a dialog will ask if we want to create a parameter file, select “No”:

Parameter file from values

After that we’ll see the message in the output window, and if we want to see the operation status we go to the resource group and “Deployments” option:

Deployments in resource group

It will take a few minutes to deploy everything, and when all it’s done we can go to the overview and see all the resources there:

APIM architecture resources

And just like that, everything is ready to try!

One last cool trick

You may already have noticed this while testing the bicep solution, but when you right-click on the VS Code tab for your main Bicep file, you can select any one of these two options:

Bicep Visualizer

The Bicep Visualizer will open a new tab and show a diagram of the resources, with their icons, and arrows pointing to the relationships between resources.

Bicep diagram

Maybe it’s not that important, but I really like it 😛

Let me insist: if you want to learn more about Bicep, go right now to Microsoft Learn learning paths for Bicep, you don’t even need an Azure subscription because the Learn modules deploy a free sandbox account for you to do the exercises.

And that’s all, I hope this helps you a bit as an introduction to Bicep, and also to deploy the APIM architecture I proposed and try it, and see if it can be helpful for your projects.