CRM 2016 available, but not ready for your Production Server just yet!


Over the last few weeks my colleagues and fellow MVP’s have been working on a few CRM 2016 systems. Our general thought is that a lot of this code is from the CRM Online 2015 code base, and should really be production ready. However, the Microsoft CRM team has been hard at work delivering new features, so looks like we introduced a few bugs.

I’m going to recommend that you wait for update rollup 1 before deploying to your production system. There’s still plenty of time to test and install in your dev and test systems as you wait for these fixes. Here’s the main areas:

  1. Overall Outlook 2016 Client Configuration and Usage Issues – Support Recommended to stay with 2015 client
  2. New Form Rending Engine slowing overall form performance – fix in the works for update roll up 1
  3. Tweaks to the 2016 Solution Engine, breaking some backwards capability while importing solutions – fix in the works for update roll up 1
  4. Mobile Client performance issues

So we will re-test about the update roll-up 1 and provide future recommendations when we feel this is ready for production. Remember that there are some best practices and one is two wait until the first update roll-up is available. Stay tuned.


Understanding the ADFS Token Signing and Decrypting Certificates Rollover Process


Active Directory Federation Services (ADFS) creates and manages the two certificates used for the tokens issued. These are the Token-signing and Token-decrypting certificates. By default, these certificates are valid for one year from their creation and around the one-year mark, they will renew themselves automatically via the Auto Certificate Rollover feature in ADFS. Once this happens, CRM can no longer properly authenticate users as it still holds the old certificates’ metadata in the database. This is easily resolved by rerunning the “Configure Claims Based Authentication” and “Configure Internet Facing Deployment” wizards from the CRM Deployment Manager and then issuing an IISRESET on the CRM server(s).

More details and resolution can be found in this KB: http://support.microsoft.com/kb/2686840

While most CRM administrators understand that aspect, there are a number of settings and configurations that lead up to this issue that are less well-known to most. One of the biggest complexities is understanding EXACTLY when CRM will be going down because of the Auto Certificate Rollover and how to avoid it. We will be going through that today.

We will start with the process that ADFS goes through for certificate renewal:

  1. ADFS determines that its certificates will be expiring soon.
  2. ADFS creates new certificates and sets them as secondary certificates.
  3. ADFS updates the new certificates to primary certificates.

There are a number of settings for ADFS only accessible via PowerShell that control the Auto Certificate Rollover options and properties for the process above. To access these, open an administrative PowerShell prompt and execute the following (Note that if you are using ADFS 2.0, you will need to add the ADFS PowerShell Snap-In first by executing Add-PSSnapin Microsoft.ADFS.PowerShell):

adfs1

 

This will display a listing of the deployment properties for ADFS, including the properties around the certificates and rollover. For our purposes, we will keep our focus on just a handful of these properties:

  • AutoCertificateRolloveradfs2
  • CertificateDuration
  • CertificateGenerationThreshold
  • CertificatePromotionThreshold
  • CertificateRolloverInterval

adfsgrid

 

So what do all of these values mean? Below are the same steps provided earlier but now account for the values in the table above.

  1. ADFS determines that its certificates will be expiring within 20 days.
  2. ADFS creates new certificates valid for 365 days and sets them as secondary certificates.
  3. After 5 days’ time the Certificate Management Cycle kicks off and ADFS updates the new certificates to primary certificates.

As you can see, knowing these values can greatly help in planning for certificate rollover. Here is an example:

In the screenshot below, we can see our primary certificates expire on 2/12/2015 and ADFS has already created new certificates to rollover. The new (secondary) certificates were created 20 days prior to the expiration of the primary certificates (1/23/2015). On 1/28/2015, 5 days after the creation of the new certificates, ADFS will change them to primaries.

adfscert

 

In the above example, you know your deadline is 1/28/2015. Rather than sitting back and waiting until CRM goes down, plan a short outage afterhours and roll the certificates over manually! You can force ADFS to generate new certificates and promote them to primaries immediately using the following command in PowerShell:

adfs3

 

Once the new certificates are in place in ADFS, re-run the Claims and IFD Wizards in the CRM Deployment Manager to update the metadata and issue an IISReset on the CRM server(s). Voila! Happy CRM users!

Of course, given the properties we have at our disposal to modify there is much more you can do to create a better life for yourself. For example, set the CertificateDuration to 1095 days (three years) rather than just 365 (one year) so this is not as frequent of an issue. Another idea would be to set the CertificateGenerationThreshold lower so the actual rollover date is closer to the true expiration of the certificate. Or just turn off AutoCertificateRollover altogether, set a reminder, and take care of it all manually before expiration!

Another great post from my team at www.Tribridge.com

 


CRM 2016: New Form Rending Engine


With the release of CRM 2016 (2015 Update 1 for CRM Online), comes a new form rendering engine (referred to as Turbo Forms in some circles) was built to provide better performance of form loads. The two main changes are focused around loading process of the form and the handling of the cache.

However, while the new rendering engine was built to help with performance you may actually notice the opposite taking place. In heavily customized environment, you might experience long stalls during form loads with messages reading “requesting data from CRM” and/or “loading business logic”.

render1 Render2

 

 

 

 

If you are currently being plagued by these messages, it may be a good idea to turn the new rendering engine off. To do this, simply go to: Administration -> System Setting, scroll all the way down and you will see the “Use legacy form rendering” option. Turning it to “yes” will disable the new engine.

legacy

 

 

While this will help in the short term, it is advised to figure out what on your form is causing conflict with the new engine so that it can be fixed and the new engine can be turned back on for even better performance. Microsoft is also aware of the issue and is looking at it within the Update Roll-up 1 Time frame.


ADFS Logon Page Loop Issue with Dynamics CRM 2015


We recently setup CRM 2015 and ADFS 2.2 (the version that comes on Server 2012 R2, aka ADFS 2.2) on new servers for a customer. Everything configured fine and initial tests proved successful when logging in with the domain admin account used to set everything up. However, we quickly found an issue when other users tried to access CRM via the external URL. At the ADFS login page, a user would enter his or her credentials as usual and try to login but rather than giving a 302 redirect back to CRM for access, it redirected back to the ADFS login page. This presented no errors on screen or in the CRM event viewer – it was as if we never tried logging in. If we purposefully entered invalid credentials, it provided the error regarding incorrect user ID or password so we knew authentication against AD was taking place successfully and that something was wrong with the passing of the token. Also of note was the fact that despite the external URL not working, all users were able to access CRM just fine using the internal (pass-through auth) URL.

login1

 

 

 

 

 

 

 

Nothing appeared in the ADFS Admin event viewer logs but upon closer inspection, the Security log in the event viewer on the ADFS server was loading up with Audit Failure notifications – Event ID 4625. The failure reason indicated “Unknown user name or bad password” for the ADFS service account. As any logical person would assume, we figured the account was locked out, the password expired, or we entered invalid credentials during setup. Unfortunately, upon resetting the password in Active Directory, the audit failures persisted.

property1

 

 

 

 

 

 

 

 

 

 

After some digging around, we uncovered that adding the ADFS service account to the Windows Authorization Access Group in Active Directory was the resolution. The members of this group have access to the computed tokenGroupsGlobalAndUniversal attribute on User objects. We added the account to the group, restarted the ADFS service, and all users were then able to access CRM via the external URL as expected! Another great tip from the CFE team!

property2

 

 


Microsoft announces Azure Express Route for CRM Online. Here’s why its important to you.


Jujhar Singh announced at Convergence EMEA at Azure Express Route is now available for CRM Online. Why is this important to you and your business?

CRM online is public cloud. Azure Express Route will allow dedicated network connections from your MPLS network to CRM Online. This will dramatically help improve not only connectivity to CRM Online, but also the ability to leverage Azure Services for your CRM data. This connectivity is big private cloud advantage that has just been neutralized and another step towards better integration as a hybrid cloud.

expressroute-basic

 

Read about it here:

https://community.dynamics.com/b/msftdynamicsblog/archive/2015/12/01/announcing-support-for-azure-express-route-for-crm-online


CRM, Azure and Me… A new journey has begun.


As I look forward into the future and beyond 2016, I have taken notice of what Microsoft is doing with Azure, and how they are positioning their products CRM, AX and others to leverage Azure services. Many people think Azure is nothing more than a private cloud or Rackspace and Amazon competitor. They couldn’t be more wrong.

A few weeks ago we hosted a AzureCon.com web event at our Tribridge Office’s in Tampa. In little over 1 hour, many people, included myself were blown away. Of course, at first thinking, this is not real, or how can I build a data warehousing infrastructure, setup azure machine language and get English like responses in less than 15 minutes. This had to be vapor ware right? WRONG.

After the video, which can be found here: https://azure.microsoft.com/en-us/azurecon/, I immediately spun up an Azure free trial. https://azure.microsoft.com/en-us/free/ I proceeded to walk thru the steps I had recalled and replayed the video. In approx. 25 minutes I had exactly the same setup configured and running. Amazing.

This is truly the next generation of not only cloud, but a complete cloud application development platform, that simply cannot be competed against or ignored. Another example in the video above is Azure Auto scaling capabilities. We have all had that performance challenge at the end of the month processing, needing more bandwidth, or end of the quarter, or even holiday sales event, where the hardware solution purchased couldn’t keep up with the demand.

This is now no longer an issue. With Azure Auto scaling, Azure systems can scale to meet these demands and give you the extra horsepower needed. Pay for only what you need, when you need, not all year long. Truly this is very innovative. We are not talking about adding extra VM’s, web servers etc, this is actually scaling the size of the physical machine, for memory, bus, data, a complete virtual computer. Very neat indeed.

Over the next coming year, I will be working across both CRM and Azure Product Lines, and hope to provide the same level of experience on both platforms with posts that can help everyone. Time to study….

 

 

 


CRM 2016 General Availability Announced at Convergence EMEA!


I’m pleased to announce that Microsoft Dynamics CRM 2016 has been released. Microsoft Dynamics CRM 2016 will be available in the Microsoft download center on December 15, 2016. Thank you to Jujhar and the entire CRM team for putting extra hours to make this release so special.

Don’t forget the What’s New page at: https://www.microsoft.com/en-us/dynamics/crm-customer-center/what-s-new.aspx

As well as the Dynamics CRM Customer Center for all your help and training needs. https://www.microsoft.com/en-us/dynamics/crm-customer-center/default.aspx

 

 

 


Join me at CRMUG Summit in Reno NV October 13-16


Join me at the CRMUG Summit In Reno NV. This is the premier Dynamics CRM Event of the year. Don’t miss out, not too late to register below.

renosummit

 

More details..

http://www.crmugsummit.com/home

Here’s my preliminary schedule. Please refer to the website!

Monday, October 12

8:00pm-10:00pm @ Peppermill – Terrace Lounge Chapter Leader Bash

Tuesday, October 13

2:00pm-4:30pm @ Atlantis: Paradise D & E Volunteer Immersion at CRMUG Summit
5:00pm-8:00pm @ Hall 2 Welcoming Expo Reception

Wednesday, October 14

7:00am-8:00am @ Hall 1 Breakfast – Jump Into a Great Day
9:15am-9:45am @ Ballroom Lobby Networking Break
9:45am-10:45am @ D2 Getting Ready to Pull the CRM Trigger
11:15am-12:25pm @ C4 CRMUG Opening General Session – Microsoft Keynote
1:30pm-2:30pm @ D4 The CRM Superhero’s Tips, Tricks, and Toolbox
1:30pm-2:30pm @ D2 Scouting & Preparing as CRM GameDay Draws Near
2:30pm-3:00pm @ Ballroom Lobby Networking Break
4:00pm-4:30pm @ Ballroom Lobby Networking Break
4:30pm-6:00pm @ D2 ADFS & Upgrading with a Mobile State of Mind
6:00pm-8:00pm @ Hall 2 Expo Reception

Tribridge Customer Party – Invitation Only 7pm on..

Please contact me if your a customer or prospect and did not receive an invitation.

Thursday, October 15

7:00am-8:00am @ Hall 1 Breakfast – Jump Into a Great Day
8:00am-9:00am @ D2 Getting that CRM Upgrade to Purr Like a Kitten
9:00am-9:30am @ Ballroom Lobby Networking Break
10:30am-11:00am @ Ballroom Lobby Networking Break
11:00am-12:00pm @ C4 CRMUG General Community Session
12:00pm-2:00pm @ Halls 1 & 2 Networking Lunch and Expo
2:00pm-3:00pm @ D7 Going OnPremise to CRM Online
2:00pm-3:00pm @ C1 Take It to the Next Level with End User Experience Upgrades in CRM 2015
3:00pm-3:15pm @ Ballroom Lobby Networking Break
3:15pm-4:15pm @ D4 Ask the MVPs: Admin-Foundation Edition
3:15pm-4:15pm @ D7 Ask the Experts – User Adoption Edition: Enterprise CRM Strategies and Pitfalls to Avoid
4:15pm-4:45pm @ Ballroom Lobby Networking Break
4:45pm-5:45pm @ D2 Dissecting Multifaceted CRM Upgrades

Friday, October 16 – CANCLLED

8:00am-9:15am @ D2 Deployment Method of Choice  CANCELLED