Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
In response to the unique and evolving requirements of the United States public sector, Microsoft created Microsoft Dynamics 365 US Government. It's available to a qualified government entity in the United States. On October 11, 2016, Microsoft announced the next generation of intelligent business applications in the cloud under the brand Microsoft Dynamics 365. To this end, Microsoft Dynamics 365 US Government continues the protected environment originally branded as Microsoft CRM Online Government. The following Dynamics 365 products and services are available in the government cloud:
- Customer Service
- Customer Voice
- Field Service
- Finance
- Guides
- Omnichannel Engagement Hub
- Project Service Automation
- Remote Assist on HoloLens or HoloLens 2
- Sales
- Supply Chain Management
Dynamics 365 US Government feature limitations
Microsoft strives to maintain functional parity between commercially available services and those enabled through the U.S. Government clouds, specifically:
- US Government Community Cloud (GCC)
- US GCC High
- US Department of Defense (US DoD)
Some features aren't available in all U.S. Government clouds. For more information, see Product and Feature Availability. Use this information to plan your business application deployment. Microsoft continues to evaluate these services and capabilities for inclusion and updates in future releases. Check back monthly for important updates. To check the availability of Dynamics 365 apps and offers by region, including approximate availability timelines, see Global Geographic Availability.
About Dynamics 365 US Government environments and products
Select Dynamics 365 US Government products are generally available to customers through deployment into the Government Community Cloud (GCC). Among other compliance commitments and reviews as documented in the Microsoft Trust Center, the service has received several agency Authority to Operate (ATOs) since it was originally launched in January 2015. Microsoft is the first Cloud Solution Provider (CSP) to achieve a FedRAMP Joint Application Board Provisional Authority to Operate (JAB P-ATO) through the JAB Accelerated Process. In March 2018, the service impact level was granted a FedRAMP JAB High P-ATO.
As of April 2019, eligible customers can choose to deploy select Dynamics 365 US Government products in the GCC High environment, which enables single sign-on and seamless integration with Microsoft 365 GCC High deployments. Microsoft designed the platform and operational procedures to meet requirements aligning with the DISA SRG IL4 compliance framework. We anticipate our US Department of Defense contractor customer base and other federal agencies currently using Microsoft 365 GCC High to use the Dynamics 365 US Government GCC High deployment option, which enables and requires the customer to use Microsoft Entra Government for customer identities, in contrast to GCC which uses Public Microsoft Entra ID. For our US Department of Defense contractor customer base, Microsoft operates the service in a manner that enables these customers to meet ITAR commitment and DFARS acquisition regulations, as documented and required by their contracts with the US Department of Defense.
Beginning April 2021, eligible customers can choose to deploy select Dynamics 365 US Government products in the DoD environment, which enables single sign-on and seamless integration with Microsoft 365 DoD deployments. Microsoft designed the platform and operational procedures to meet requirements aligning with the DISA SRG IL5 compliance framework. We anticipate our US Department of Defense customer base and other federal agencies currently using Microsoft 365 DoD to use the Dynamics 365 US Government DoD deployment option, which enables and requires the customer to use Microsoft Entra Government for customer identities. Microsoft operates the service in a manner that enables these customers to meet ITAR commitment and DFARS acquisition regulations, as documented and required by their contracts with the US Department of Defense.
Select Dynamics 365 US Government products are available to qualified government and private entities, limited to:
- United States (US) federal, state, local, tribal, and territorial government entities.
- Private entities using Dynamics 365 US Government to provide solutions to a government entity or a qualified member of the cloud community.
- Private entities with customer data subject to government regulations for which the use of Dynamics 365 US Government is the appropriate service to meet the regulatory requirements.
The following Dynamics 365 US Government products are available:
| GCC | GCC High | DoD |
|---|---|---|
| Dynamics 365 Customer Service Enterprise and Professional | Dynamics 365 Customer Service Enterprise and Professional | Dynamics 365 Customer Service Enterprise and Professional |
| Dynamics 365 Customer Voice | ||
| Dynamics 365 Field Service | Dynamics 365 Field Service | Dynamics 365 Field Service |
| Dynamics 365 Finance | Dynamics 365 Finance | Dynamics 365 Finance - Pending IL5 Approval |
| Dynamics 365 Guides | ||
| Dynamics 365 Contact Center | ||
| Dynamics 365 Human Resources | ||
| Dynamics 365 Project Service Automation | Dynamics 365 Project Service Automation | Dynamics 365 Project Service Automation |
| Dynamics 365 Project Operations | ||
| Dynamics 365 Remote Assist on HoloLens or HoloLens 2 | Dynamics 365 Remote Assist on HoloLens or HoloLens 2 | |
| Dynamics 365 Sales Enterprise and Professional | Dynamics 365 Sales Enterprise and Professional | Dynamics 365 Sales Enterprise and Professional |
| Dynamics 365 Supply Chain Management | Dynamics 365 Supply Chain Management | Dynamics 365 Supply Chain Management - Pending IL5 Approval |
Subscription availability
Eligible customers can purchase available user subscriptions and add-ons through the following purchasing channels:
- GCC: Volume Licensing (VL) and Cloud Solution Provider (CSP)
- GCC High: Volume Licensing (VL)
- DoD: Volume Licensing (VL)
You can also get products currently included in an Enterprise Agreement (EA) through Reservation either through a qualified reseller or through the Volume Licensing Service Center (VLSC). When a reservation is placed, the requested subscription is added to the established customer tenant that same day. The customer is billed a prorated amount based on the currently established Enterprise Agreement from the first of the month following activation of the reservation as part of the next anniversary or renewal payment cycle.
For more information and guidance, contact your reseller or Microsoft account manager.
Customer data and customer content
This section describes Dynamics 365 Government commitments for customer content and to customer data.
Customer data, as defined in the Online Service Terms, means all data, including all text, sound, video, or image files, and software, that are provided to Microsoft by, or on behalf of, Customer through use of the Online Service. Customer content refers to a specific subset of customer data that users directly create, such as content stored in databases through entries in Dynamics 365 tables (for example, contact information). Content is considered confidential information, and in normal service operation, isn't sent over the Internet without encryption.
For more information on how Dynamics 365 protects and handles customer data, see the Microsoft Online Services Trust Center.
Data segregation for Government Community Cloud
When provisioned as part of Dynamics 365 Government, the Dynamics 365 service is offered in accordance with the National Institute of Standards and Technology (NIST) Special Publication 800-145.
In addition to logical separation of customer content at the application layer, Dynamics 365 Government provides physical segregation by using infrastructure that's separate from the infrastructure used by commercial Dynamics 365 customers. This infrastructure includes Azure services in Azure’s Government Cloud and Azure’s Department of Defense Cloud. To learn more, see Azure Government.
Customer content located within the United States
Microsoft provides Dynamics 365 US Government services from datacenters physically located in the United States. Microsoft Power Platform and Dynamics 365 apps (Dynamics 365 Sales, Dynamics 365 Customer Service, Dynamics 365 Field Service, Dynamics 365 Project Service Automation, Dynamics 365 Finance, and Dynamics 365 Supply Chain Management) store customer content at rest in datacenters physically located only in the US.
Restricted data access by administrators
Only Microsoft administrators who are U.S. citizens can access Dynamics 365 US Government customer content. These administrators undergo background investigations that follow relevant government standards.
Dynamics 365 support and service engineering staff don't have standing access to customer content hosted in Dynamics 365 US Government. Staff who request temporary permission elevation that grants access to customer content must pass the following background checks.
State-adjudicated review of federal and state criminal history by state CSA appointed authority within each state that has signed up for the Microsoft CJIS IA program| Restricted Data Access | |
|---|---|
| Microsoft personnel screening and background checks | Description |
| U.S. Citizenship | Verification of U.S. citizenship |
| Employment History Check | Verification of seven (7) year employment history |
| Education Verification | Verification of highest degree attained |
| Social Security Number (SSN) Search | Verification that the provided SSN is valid |
| Criminal History Check | A seven (7) year criminal record check for felony and misdemeanor offenses at the state, county, and local level and at the federal level |
| Office of Foreign Assets Control List (OFAC) | Validation against the Department of Treasury list of groups with whom U.S. persons aren't allowed to engage in trade or financial transactions |
| Bureau of Industry and Security List (BIS) | Validation against the Department of Commerce list of individuals and tables barred from engaging in export activities |
| Office of Defense Trade Controls Debarred Persons List (DDTC) | Validation against the Department of State list of individuals and tables barred from engaging in export activities related to the defense industry |
| Fingerprinting Check | Fingerprint background check against FBI databases |
| CJIS Background Screening | State-adjudicated review of federal and state criminal history by state CSA appointed authority within each state that has signed up for the Microsoft CJIS IA program |
| Department of Defense IT-2 | Staff requesting elevated permissions to customer data or privileged administrative access must pass Department of Defense IT-2 adjudication based on a successful OPM Tier 3 investigation |
Certifications and accreditations
Dynamics 365 US Government is designed to support the Federal Risk and Authorization Management Program (FedRAMP) accreditation at a High Impact level. FedRAMP artifacts are available for review by federal customers who are required to comply with FedRAMP. Federal agencies can review these artifacts when evaluating whether to grant an Authority to Operate (ATO).
Dynamics 365 is authorized as a service within the Azure Government FedRAMP ATO. For more information and access to FedRAMP documents, see the FedRAMP Marketplace.
Dynamics 365 US Government has features designed to support customer requirements under the CJIS Policy for law enforcement agencies. For more information about certifications and accreditations, see the Trust Center for more detailed information related to certifications and accreditations.
Dynamics 365 US Government and other Microsoft services
Dynamics 365 US Government includes several features that allow users to address customer calls through Skype for Business, email editing for sales materials and integration with other Microsoft enterprise service offerings such as Microsoft 365 for Government. Dynamics 365 US Government is deployed within Microsoft datacenters in a manner consistent with a multi-tenant, public cloud deployment model. However, client applications including but not limited to the web-user client, Dynamics 365 for tablets, Dynamics 365 for phones, Dynamics 365 for Outlook, Unified Service Desk for Dynamics 365 and any third-party client application that connects to Dynamics 365 US Government aren't part of Dynamics 365 US Government's accreditation boundary and government customers are responsible for managing them.
Dynamics 365 US Government uses the Microsoft 365 customer administrator UI for customer administration and billing. Dynamics 365 US Government maintains the actual resources, information flow, and data management, while relying on Microsoft 365 to provide the visual styles that are presented to the customer administrator through their management console. For purposes of FedRAMP ATO inheritance, Dynamics 365 US Government uses Azure (including Azure Government) ATOs for infrastructure and platform services, respectively.
Dynamics 365 US Government and third-party services
Power Platform and Dynamics 365 apps can integrate third-party applications into the service. These third-party applications and services might involve storing, transmitting, and processing your organization’s customer data on third-party systems that are outside of the Power Platform and Dynamics 365 apps Engagement infrastructure and therefore aren't covered by the Power Platform and Dynamics 365 apps compliance and data protection commitments. We recommend that you review the privacy and compliance statements provided by the third parties when assessing the appropriate use of these services for your organization.
Dynamics 365 US Government and Azure services
Microsoft Entra and Microsoft Entra Government aren't part of the Dynamics 365 US Government accreditation boundary. Government customers are responsible for using ADFS to uniquely identify and authenticate their organizational users. It is important to note that Microsoft Entra and Microsoft Entra Government provide critical functionality to both Dynamics 365 US Government and ADFS, whose dependencies are described in detail in the Dynamics 365 US Government SSP (Service Security Plan).
When a user in an organization that uses ADFS attempts to access Dynamics 365, the user is redirected to a login page hosted on the organization’s ADFS server. The user provides their credentials to their organization's ADFS server, which attempts to authenticate the credentials using the organization’s existing Active Directory infrastructure. If the credentials are authenticated, the organization’s ADFS server issues a SAML (Security Assertion Markup Language) ticket containing information about the user’s identity and group membership. The customer ADFS server signs this ticket by using one half of an asymmetric key pair and sends the ticket to Microsoft Entra via encrypted TLS. Microsoft Entra ID validates the signature by using the other half of the asymmetric key pair and grants access based on the ticket. The user's identity and group membership information remain encrypted in Microsoft Entra ID. In other words, limited user-identifiable information is stored in Microsoft Entra ID. Full details of the Microsoft Entra security architecture and control implementation can be found in the Azure SSP and Azure Government SSP.
Dynamics 365 US Government URLs
Use a different set of URLs to access Dynamics 365 US Government environments, as documented in the following article:
Instances
- GCC: *.crm9.dynamics.com
- GCC High: *.crm.microsoftdynamics.us
- DoD: *.crm.appsplatform.us
Dynamics 365 Customer Voice
Discovery (OData V4) RESTful API
GCC:
- (Deprecated) Discovery URL:
https://disco.crm9.dynamics.com/api/discovery/v9.1/ - Global discovery URL:
https://globaldisco.crm9.dynamics.com/api/discovery/v2.0/
- (Deprecated) Discovery URL:
GCC High:
- (Deprecated) Discovery URL:
https://disco.crm.microsoftdynamics.us/api/discovery/v9.1/ - Global discovery URL: https://globaldisco.crm.microsoftdynamics.us/api/discovery/v2.0/
- (Deprecated) Discovery URL:
DoD:
- Global discovery https://globaldisco.crm.appsplatform.us/api/discovery/v2.0/
Instance Web API
- GCC: https://*.api.crm9.dynamics.com/api/data/v9.1/
- GCC High: https://*.api.crm.microsoftdynamics.us/api/data/v9.1/
- DoD: https://*.api.crm.appsplatform.us/api/data/v9.1/
Organization Service
- GCC: https://*.api.crm9.dynamics.com/XRMServices/2011/Organization.svc
- GCC High: https://*.api.crm.microsoftdynamics.us/XRMServices/2011/Organization.svc
- GCC DoD: https://*.api.crm.appsplatform.us/XRMServices/2011/Organization.svc
Microsoft Dynamics Portals
- GCC: https://*.dynamics365portals.us
- GCC High: https://*.high.dynamics365portals.us
- DoD: https://*.appsplatformportals.us
Dynamics 365 Finance and Supply Chain Management
- GCC: https://*.operations.gov.microsoftdynamics.us
- GCC High: https://*.operations.high.microsoftdynamics.us
- DoD: https://*.operations.dod.microsoftdynamics.us
Dynamics 365 Lifecycle Services (LCS)
- GCC: https://gov.lcs.microsoftdynamics.us
- GCC High: https://high.lcs.microsoftdynamics.us
- DoD: https://dod.lcs.microsoftdynamics.us
Telemetry for Power Apps
Add the following URLs to your allow list to enable Power Apps telemetry through firewalls and other security mechanisms:
- GCC:
https://tb.pipe.aria.microsoft.com/Collector/3.0andhttps://tb.events.data.microsoft.com/OneCollector/1.0/ - GCC High:
https://tb.pipe.aria.microsoft.com/Collector/3.0andhttps://tb.events.data.microsoft.com/OneCollector/1.0/ - DoD:
https://pf.pipe.aria.microsoft.com/Collector/3.0andhttps://pf.events.data.microsoft.com/OneCollector/1.0/
If you are filtering by IP ranges, ensure that you have unblocked the OneDsCollector service tag.
Regional Discovery Service is deprecated
Discovery Service (Deprecated)
- GCC:
https://disco.crm9.dynamics.com/XRMServices/2011/Discovery.svc - GCC High:
https://disco.crm.microsoftdynamics.us/XRMServices/2011/Discovery.svc
Effective March 2, 2020, Microsoft deprecated the regional Discovery Service.