CRM must be accessible from the internet in order for ClickDimensions to work, and your CRM system must be able to access ClickDimensions. If you use CRM on-premise, we recommend Microsoft's prescribed method of Internet-Facing Deployment (IFD) for CRM. An alternate method is discussed below.
Configuring access to CRM
If CRM is deployed on-premise it must be accessible from the internet. CRM Online deployments are already configured for external internet access, so this article does not apply to CRM Online customers.
How does ClickDimensions connect to my CRM?
ClickDimensions’ cloud service communicates with your CRM via web services using connection methods described in Microsoft's Software Development Kit (SDK). This requires your CRM to be accessible from the web.
Why does ClickDimensions need to connect to my CRM?
Installing ClickDimensions in your CRM sets up a two-way integration where users can design email templates, forms, landing pages, etc., right within CRM and submit email jobs to the ClickDimensions cloud service. ClickDimensions queries CRM for recipients and synchronizes data such as opens, clicks, completed web forms, etc., back to your CRM.
How do I make my CRM accessible from the web?
There are two ways you can accomplish this. You may require the assistance of your CRM partner to implement either of these methods.
- Recommended: Configure CRM for Internet-Facing Deployment (IFD). This is Microsoft’s recommended method for configuring secure external access to CRM. In addition to making your CRM accessible to ClickDimensions, an IFD configuration enables your users to access CRM from mobile devices or the CRM Outlook client without being on your network. (Note: CRM 4.0 uses an IFD tool to assist in configuring forms-based authentication. CRM 2011, 2013, 2015 and 2016 require ADFS – Active Directory Federation Services, a claims-based authentication service. ADFS 2.0 is a free download from Microsoft and is installed on a separate web server from CRM. With CRM 2011/2013/2015/2016, IFD is configured in the CRM Deployment Manager.) See the links at the bottom of this article for Microsoft's documentation on IFD.
NOTE: Although ADFS is necessary to configure IFD for your CRM in order to utilize ClickDimensions, since ADFS is a separate service through Microsoft and is not part of the ClickDimensions solution, ClickDimensions Support cannot troubleshoot its setup or implementation. We also cannot troubleshoot authentication issues when using a third-party authentication mechanism such as a Single Sign-On (SSO) solution.
- Expose the CRM website to the internet through standard web publishing techniques (open the firewall to a public IP for the CRM server and permit direct Windows auth). This approach can be less complex to configure than IFD. This method will allow the ClickDimensions cloud service to connect to your CRM, but will not enable the CRM Outlook client to access CRM while outside of your network. In this scenario, users and our service would be able to access CRM externally through standard Windows authentication.
If you provide us with just a public IP address for your CRM server, it will not be possible to use SSL, since the CRM address would need to match the SSL certificate. For example, the CRM address would need to be https://crm.mycompany.com so that you could apply a commercial SSL certificate that matches the address 'crm.mycompany.com'. Alternately, if you wish to just use an IP address and wish to further secure the connection, you can configure your firewall to restrict access to only our IP addresses for better security, but traffic will not be encrypted if you do not use SSL. Also, please note that we cannot advise on firewall configuration (TMG, F5, ISA, etc.) for this setup as it is not a setup that Microsoft documents for external CRM access.
In CRM 2011, 2013, 2015, and 2016 the address of the Organization Service web service must be updated in the Deployment Manager's web address properties so that it uses an address that is reachable from the internet - not an internal server name.
Both methods described above may require DNS and firewall changes on your network and with your domain host in order to allow your CRM server’s address to be resolved and accessed from an external URL.
Caution: When configuring external access to your CRM, evaluate the security ramifications of any approach carefully. Always use SSL encryption and refer to Microsoft documentation for best practices. We do not support self-signed certificates. Tip: Many organizations find it cost-effective to implement IFD for a production environment while using method 2 above for test and development environments.
Are there alternatives?
No. ClickDimensions requires a connection to CRM to work. There is no application that can be installed on your server to replace our cloud-based functionality.
Do you support VPNs? What about Azure Connect?
We do not support VPNs or Azure Connect.
What if my company policy does not permit connections to applications inside our firewall?
Some customers have deployed an additional CRM web front end server in their DMZ in order to provide external access to their CRM system's web services. This is an option you can explore with your CRM partner and network administrator.
Is the connection secure?
Yes. When you register your CRM with ClickDimensions, connection details are securely encrypted. If you set up Microsoft's recommended IFD method for external access or set up your CRM to use an SSL certificate, the communication between ClickDimensions and your CRM will be encrypted. You can also restrict access via your firewall to just our IP addresses.
Accessing the ClickDimensions Service from Your CRM
Just as important as reaching your CRM deployment from the cloud, it is also necessary that the cloud-based ClickDimensions service be accessible from your CRM server. Many corporate networks block outbound connections from application servers by restricting certain IP ranges, domain names or ports. This can sometimes prevent access to ClickDimensions. To ensure connectivity from your CRM server to the ClickDimensions system, it may be necessary to add an exception rule to allow inbound and outbound requests from the ClickDimensions IP addresses on the secure port 443.
(For a complete list of IP addresses for the ClickDimensions API, see the article “What firewall changes are needed to allow ClickDimensions proper access to your CRM deployment?”)
This exception will need to be created for any firewalls through which traffic from your CRM server may traverse. Proxies that require inbound authentication must be configured to permit the ClickDimensions IP addresses to bypass the proxy by adding them to the Proxy Bypass List.
To test connectivity to the ClickDimensions API from the browser, open Internet Explorer on the CRM server and browse to the following address:
https://app.clickdimensions.com/service.svc/help
Note: If there are any errors when attempting to connect to the above address, review your firewall and IE settings.
For further reading:
IFD for Dynamics 365
- Download: Microsoft Dynamics 365 Implementation Guide (Microsoft)
IFD for CRM 2015
- Download: Microsoft Dynamics CRM 2015 Implementation Guide (Microsoft)
IFD for CRM 2013
- Download: Microsoft Dynamics CRM 2013 Implementation Guide (Microsoft)
IFD for CRM 2011
- Download: Microsoft Dynamics CRM 2011 Implementation Guide (Microsoft)
- Blog: Configuring IFD with Microsoft Dynamics CRM 2011 (Microsoft)
- Video: Introducing Microsoft Dynamics CRM 2011 Claims-based Authentication (YouTube)
- MSDN Article: Configure the Microsoft Dynamics CRM Server 2011 for IFD (Microsoft)
Related Articles
- Article: What firewall changes are needed to allow ClickDimensions proper access to your CRM deployment? (ClickDimensions)
- TechNet Article: Network ports for Microsoft Dynamics CRM (Microsoft) - NOTE: This is for reference only. ClickDimensions only needs to communicate on standard web ports (such as 80 or 443, or a custom port if you specify one for your CRM website).