{
    "name": "Dynamics365Finance",
    "apiVersion": "2022-09-01-preview",
    "type": "Microsoft.SecurityInsights/dataConnectorDefinitions",
    "location": "{{location}}",
    "kind": "Customizable",
    "properties": {
        "connectorUiConfig": {
            "id": "Dynamics365Finance",
            "title": "Dynamics 365 Finance and Operations",
            "publisher": "Microsoft",
            "logo": "Dynamics365.svg",
            "descriptionMarkdown": "Dynamics 365 for Finance and Operations is a comprehensive Enterprise Resource Planning (ERP) solution that combines financial and operational capabilities to help businesses manage their day-to-day operations. It offers a range of features that enable businesses to streamline workflows, automate tasks, and gain insights into operational performance.\n\nThe Dynamics 365 Finance and Operations data connector ingests Dynamics 365 Finance and Operations admin activities and audit logs as well as user business process and application activities logs into Microsoft Sentinel.",
            "graphQueriesTableName": "FinanceOperationsActivity_CL",
            "graphQueries": [
                {
                    "metricName": "Total data received",
                    "legend": "{{graphQueriesTableName}}",
                    "baseQuery": "{{graphQueriesTableName}}"
                }
            ],
            "sampleQueries": [
                {
                    "description": "Finance and Operations Audited Tables",
                    "query": "{{graphQueriesTableName}}\n            | summarize by TableName"
                }
            ],
            "dataTypes": [
                {
                    "name": "{{graphQueriesTableName}}",
                    "lastDataReceivedQuery": "{{graphQueriesTableName}}\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
                }
            ],
            "connectivityCriteria": [
                {
                    "type": "HasDataConnectors"
                }
            ],
            "availability": {
                "isPreview": false
            },
            "permissions": {
                "resourceProvider": [
                    {
                        "provider": "Microsoft.OperationalInsights/workspaces",
                        "permissionsDisplayText": "Read and Write permissions are required.",
                        "providerDisplayName": "Workspace",
                        "scope": "Workspace",
                        "requiredPermissions": {
                            "write": true,
                            "read": true,
                            "delete": true
                        }
                    },
                    {
                        "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys",
                        "permissionsDisplayText": "Read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key)",
                        "providerDisplayName": "Keys",
                        "scope": "Workspace",
                        "requiredPermissions": {
                            "action": true
                        }
                    }
                ],
                "customs": [
                    {
                        "name": "Microsoft Entra app registration",
                        "description": "Application client ID and secret used to access Dynamics 365 Finance and Operations."
                    }
                ]
            },
            "instructionSteps": [
                {
                    "description": ">Connectivity to Finance and Operations requires a Microsoft Entra app registration (client ID and secret). You'll also need the Microsoft Entra tenant ID and the Finance Operations Organization URL."
                },
                {
                    "description": "To enable data collection, create a role in Dynamics 365 Finance and Operations with permissions to view the Database Log entity. Assign this role to a dedicated Finance and Operations user, mapped to the client ID of a Microsoft Entra app registration. Follow these steps to complete the process:"
                },
                {
                    "title": "Step 1 - Microsoft Entra app registration",
                    "description": "1. Navigate to the [Microsoft Entra portal](https://entra.microsoft.com). \n2. Under Applications, click on **App Registrations** and create a new app registration (leave all defaults).\n3. Open the new app registration and create a new secret.\n4. Retain the **Tenant ID**, **Application (client) ID**, and **Client secret** for later use."
                },
                {
                    "title": "Step 2 - Create a role for data collection in Finance and Operations",
                    "description": "1. In the Finance and Operations portal, navigate to **Workspaces > System administration** and click **Security Configuration**\n2. Under **Roles** click **Create new** and give the new role a name e.g. Database Log Viewer.\n3. Select the new role in the list of roles and click **Privileges** and than **Add references**.\n4. Select **Database log Entity View** from the list of privileges.\n5. Click on **Unpublished objects** and then **Publish all** to publish the role."
                },
                {
                    "title": "Step 3 - Create a user for data collection in Finance and Operations",
                    "description": "1. In the Finance and Operations portal, navigate to **Modules > System administration** and click **Users**\n2. Create a new user and assign the role created in the previous step to the user."
                },
                {
                    "title": "Step 4 - Register the Microsoft Entra app in Finance and Operations",
                    "description": "1. In the F&O portal, navigate to **System administration > Setup > Microsoft Entra applications** (Azure Active Directory applications)\n2. Create a new entry in the table. In the **Client Id** field, enter the application ID of the app registered in Step 1.\n3. In the **Name** field, enter a name for the application.\n4. In the **User ID** field, select the user ID created in the previous step."
                },
                {
                    "description": "Connect using client credentials",
                    "title": "Connect events from Dyanmics 365 Finance and Operations to Microsoft Sentinel",
                    "instructions": [
                        {
                            "type": "ContextPane",
                            "parameters": {
                                "contextPaneType": "DataConnectorsContextPane",
                                "label": "Add environment",
                                "isPrimary": true,
                                "title": "Dynamics 365 Finance and Operations connection",
                                "instructionSteps": [
                                    {
                                        "title": "Environment details",
                                        "instructions": [
                                            {
                                                "type": "Textbox",
                                                "parameters": {
                                                    "label": "Microsoft Entra tenant ID.",
                                                    "placeholder": "Tenant ID (GUID)",
                                                    "type": "text",
                                                    "name": "tenantId"
                                                }
                                            },
                                            {
                                                "type": "Textbox",
                                                "parameters": {
                                                    "label": "App registration client ID",
                                                    "placeholder": "Finance and Operations client ID",
                                                    "type": "text",
                                                    "name": "clientId"
                                                }
                                            },
                                            {
                                                "type": "Textbox",
                                                "parameters": {
                                                    "label": "App registration client secret",
                                                    "placeholder": "Finance and Operations client secret",
                                                    "type": "password",
                                                    "name": "clientSecret"
                                                }
                                            },
                                            {
                                                "type": "Textbox",
                                                "parameters": {
                                                    "label": "Finance and Operations organization URL",
                                                    "placeholder": "https://dynamics-dev.axcloud.dynamics.com",
                                                    "type": "text",
                                                    "name": "auditHost"
                                                }
                                            }
                                        ]
                                    }
                                ]
                            }
                        }
                    ]
                },
                {
                    "title": "Organizations",
                    "description": "Each row represents an Finance and Operations connection",
                    "instructions": [
                        {
                            "type": "DataConnectorsGrid",
                            "parameters": {
                                "mapping": [
                                    {
                                        "columnName": "Environment URL",
                                        "columnValue": "properties.request.apiEndpoint"
                                    }
                                ],
                                "menuItems": [
                                    "DeleteConnector"
                                ]
                            }
                        }
                    ]
                }
            ]
        }
    }
}