The CRM can copy your CRM data into a Microsoft Fabric warehouse on a schedule. This guide takes a CRM administrator through connecting to Fabric, choosing what is copied, and keeping the sign-in healthy. Two ways of signing in are offered: a Dazos-issued token, which needs no secret and never expires, and the older Entra client secret, which Microsoft expires after two years at most.
Contents
1. Before You Start
2. Open the Microsoft Fabric Data Warehouse Page
3. Enter the Connection Details
4. Choose How the CRM Signs In
5. Register the CRM in Azure (Dazos-issued token only)
6. Save and Test
7. Choose What Gets Copied, and When
8. Keeping the Sign-in Healthy: Credential Rotation
9. If Something Stops Working
10. Frequently Asked Questions
1. Before You Start
You will need:
A Microsoft Fabric workspace with a warehouse in it, and its SQL connection string (in Fabric: Workspace settings → SQL connection string).
An app registration in Microsoft Entra ID (the Azure portal), and someone who can edit it. Note its Directory (tenant) ID and Application (client) ID.
The app registration given access to the Fabric workspace.
A CRM administrator login.
Access requirements: the page is visible to CRM administrators only, and only on instances where Microsoft Fabric is switched on. If you do not see Microsoft Fabric Data Warehouse under Settings → Configuration, contact Dazos support to enable it.
Important: the Dazos-issued token method depends on a database driver on the CRM server. The page clearly states, in a red notice at the top of the connection form, whether the server lacks it. When that notice appears, you can set up and register the token method in Azure, but you can't connect yet; use the Entra client secret to connect in the meantime, and ask Dazos support about the driver.
2. Open the Microsoft Fabric Data Warehouse Page
From the CRM, open Settings → Configuration → Microsoft Fabric Data Warehouse, or type "Fabric" into the settings search box.
The page has these cards, top to bottom:
Card | What it is for |
Connection Setup (Azure AD) | Where Fabric is, which app the CRM signs in as, and how. |
Credential Rotation | How often the credential should be replaced, reminders, and the buttons to replace the signing key now. |
Data Selection - Modules | Which CRM modules, fields, and related tables are copied. |
Sync Schedule & Status and Sync History | How often the copy runs, and what happened on each run. |
3. Enter the Connection Details
In Connection Setup, fill in:
Field | Description | Example |
Directory (tenant) ID | Your Entra tenant, from the app registration's overview page. | 11111111-2222-3333-4444-555555555555 |
Application (client) ID | The app registration the CRM signs in as. | 66666666-7777-8888-9999-000000000000 |
Workspace ID | The Fabric workspace that holds the warehouse. | aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee |
Warehouse SQL Endpoint URL | The SQL connection string from the workspace settings, without a port. | <id>.datawarehouse.fabric.microsoft.com |
Warehouse Name | The warehouse database name inside the workspace. | MyWarehouse |
Authentication Method | See the next section. |
|
4. Choose How the CRM Signs In
Method | What it is | When to use it |
Dazos-issued token (recommended, no secret to renew) | The CRM signs a short-lived token with its own private key. You register the CRM once in Azure as a trusted issuer. Nothing expires, nothing is stored in two places, and rotating the key happens entirely inside the CRM. | Any new setup, once the server has the driver (see Before You Start). |
Entra client secret (legacy) | A secret created on the app registration in Azure and pasted into the CRM. Entra expires it after at most two years, often sooner; when it expires, the copy stops until you create a new one in Azure and paste it here. | Setups connected before this version, or while the server lacks the driver. |
If you choose the client secret: paste it into Client Secret. After saving, the field shows only asterisks; typing a new value replaces the old one.
5. Register the CRM in Azure (Dazos-issued token only)
1. With the token method selected, click Generate signing key. The page confirms a key is in place and shows its fingerprint.
2. The box Register this in Azure now shows three values: Issuer, Subject identifier, and Audience. Entra matches them character for character, including upper and lower case, so copy them rather than retyping.
3. In the Azure portal, open the app registration → Certificates & secrets → Federated credentials → Add credential. Choose the scenario Other issuer and paste the three values. Give the credential any name.
4. Alternatively, click Copy the command and run it with the Azure command line while signed in with rights over the app registration; it creates the same credential.
Tip: The issuer is fixed the first time you save with the token method and does not change afterward, so the credential you register in Azure stays valid even if your CRM's web address changes later.
6. Save and Test
1. Click Save Credentials.
2. Click Test Connection. Give Entra a minute or two after adding the federated credential before the first test.
Every failure now says what happened and what to do next in the message next to the button. If Entra refuses the sign-in, the message includes Entra's own explanation and tells you which three values to check in Azure.
7. Choose What Gets Copied, and When
Nothing leaves the CRM until you choose it:
1. In Data Selection - Modules, tick the modules to copy and click Save Module Selection. Use Fields to leave individual fields out (Save Field Configuration) and Related to include related tables (Save Related Tables).
2. In Sync Schedule & Status, pick a frequency (every 1, 4, 8, 12 or 24 hours), click Save Frequency, then Sync All Now for the first full copy.
3. Watch Sync History. When a run fails, the warehouse's own message is shown in full.
8. Keeping the Sign-in Healthy: Credential Rotation
The Credential Rotation card works for both sign-in methods, but it means something different for each.
Set a schedule (both methods)
1. Choose Rotate every (30, 60, 90, or 180 days, or Manual only) and Remind me (3, 7, or 14 days before).
2. Click Save Schedule. The next rotation date appears on the right.
Administrators receive one e-mail before the date and a weekly reminder while it is overdue. Nothing pauses the copy.
Under the Dazo-issued token, the reminder prompts you to complete the two-step rotation below.
Under the Entra client secret, nothing in the CRM can rotate the secret for you: the reminder is your warning to create a new secret in Azure and paste it into the Client Secret field before the current one expires and the copy stops. Set the schedule to a date before the secret's expiry in Azure.
Rotate the signing key (Dazos-issued token only)
1. Click Generate next key. The next key is published immediately so Entra can read it, but it isn't used yet.
2. Wait a few minutes.
3. Click Rotate now. The new key is tested against Fabric first; only if that works does it take over. If Entra has not read it yet, the switch is refused and the current key stays active. Try again after a few minutes.
The previous key keeps working for a grace period, then removes automatically. A running copy is never interrupted.
9. If Something Stops Working
What you see | What it usually means | What to do |
Red notice: this server does not have the sqlsrv extension | The CRM server is missing the driver the token method needs. | Use the Entra client secret meanwhile; ask Dazos support about the driver. |
"Microsoft Entra refused the sign-in (HTTP 401) ..." | The credential in Azure does not carry exactly the issuer, subject, and audience on the page, or (client secret) the secret has expired. | Re-check the three values in Azure, or create a new secret and paste it. |
"Microsoft Entra accepted the sign-in but returned no access token" | The app registration has no permission on the Fabric workspace. | Give the app access to the workspace in Fabric. |
"Could not reach Microsoft Entra ..." | This is a network issue between the CRM server and Microsoft, not a credential issue. | Try again later; if it persists, contact Dazos support. |
"Could not reach Microsoft Fabric with either SQL Server ODBC driver ..." | The endpoint URL or warehouse name is wrong, or the server cannot reach Fabric. | Check both values against the workspace settings. |
Saving fails with a message about an encryption key | The server is missing a setting it needs to store credentials safely. | Contact Dazos support; nothing on the page can fix it. |
10. Frequently Asked Questions
Q: Do I have to switch to the Dazos-issued token?
No. The client secret keeps working. The token method removes the two-year expiry and the need to copy a secret between Azure and the CRM, so it is worth switching when the server supports it.
Q: Is any secret stored in the CRM with the token method?
Only the CRM's own private key, encrypted at rest. Nothing from Azure is stored, and nothing needs renewing in Azure.
Q: What exactly does Fabric receive?
Only the modules, fields and related tables you ticked in Data Selection. Nothing else.
Q: Will a rotation interrupt a copy that is running?
No. A running copy keeps the credentials it started with; the new one takes effect on the next run.
Q: How do I stop copying data?
Untick every module in Data Selection and save. To remove the connection entirely, contact Dazos support.
Need Help?
If you run into issues:
1. Check Sync History: the newest row shows the warehouse's own message for a failed run.
2. Click Test Connection and read the message; it names the thing to fix.
3. Contact Dazos support with that message and reference CRM-3840.