How to Integrate Lovable with Microsoft Dynamics 365

Dynamics 365 authentication is handled through Azure Active Directory. You must register an application in Azure AD and grant it access to your Dynamics 365 instance. Go to portal.azure.com and sign in with your Azure account. Navigate to Azure Active Directory → App registrations → New registration. Fill in: - Name: 'Lovable Dynamics 365 Integration' - Supported account types: 'Accounts in this organizational directory only' - Redirect URI: leave blank (not needed for client credentials flow) Click Register. On the app overview page, copy the Application (client) ID and Directory (tenant) ID — you need both. Next, create a client secret. Go to Certificates & secrets → Client secrets → New client secret. Set an expiry (24 months recommended) and click Add. Copy the secret Value immediately — it is shown only once. Now configure API permissions. Go to API permissions → Add a permission → APIs my organization uses → search for 'Dynamics CRM'. Select 'Dynamics CRM' and then 'Application permissions'. Add the 'user_impersonation' scope. Click 'Grant admin consent for [your tenant]'. Wait for the green checkmark confirming consent. Critical step that many guides miss: you must also add the application as a user in your Dynamics 365 instance. In Dynamics 365, go to Settings → Security → Users → switch to 'Application Users' view → New Application User. Enter the Application ID from Azure AD, and assign a security role (e.g., 'System Administrator' for full access, or a custom role with minimum required permissions). Without this Dynamics-side step, API calls return 403 even with valid Azure AD tokens.

Add all Azure AD and Dynamics 365 credentials to Lovable's Cloud Secrets panel. In Lovable, click '+' → Cloud panel → Secrets. Add four secrets: - DYNAMICS_CLIENT_ID — the Application (client) ID from Azure AD app registration - DYNAMICS_CLIENT_SECRET — the client secret value you copied - DYNAMICS_TENANT_ID — the Directory (tenant) ID from Azure AD - DYNAMICS_INSTANCE_URL — your Dynamics 365 instance URL (e.g., https://yourorg.crm.dynamics.com) The instance URL format matters: it must be the base URL without any path suffix. For US environments, it typically ends in .crm.dynamics.com. For other regions: .crm4.dynamics.com (EMEA), .crm5.dynamics.com (APAC), .crm3.dynamics.com (Canada). The Azure AD token endpoint uses your tenant ID: https://login.microsoftonline.com/{tenantId}/oauth2/v2.0/token. The scope for Dynamics 365 API access is: https://yourorg.crm.dynamics.com/.default (your instance URL with /.default appended). This scope format tells Azure AD to grant all permissions pre-configured for the Dynamics CRM API. Access tokens from Azure AD expire after one hour (3600 seconds). The Edge Function requests a new token for each request using client credentials flow — since tokens are not stored, there is no refresh token management required. Simply re-request a new token when needed.

Build the Edge Function that acquires Azure AD access tokens and proxies OData requests to the Dynamics 365 Web API. The token acquisition uses the OAuth2 client credentials flow: POST to the Azure AD token endpoint with client_id, client_secret, and scope. Dynamics 365 Web API base path: {instanceUrl}/api/data/v9.2/ OData endpoint examples: - GET /api/data/v9.2/accounts — list all accounts - GET /api/data/v9.2/accounts?$select=name,revenue&$filter=statecode eq 0&$top=50 — filtered, projected - POST /api/data/v9.2/leads — create a lead - PATCH /api/data/v9.2/accounts({id}) — update an account Important Dynamics 365 API headers: Requests must include 'OData-MaxVersion: 4.0' and 'OData-Version: 4.0'. The 'Prefer: odata.include-annotations=OData.Community.Display.V1.FormattedValue' header returns human-readable values for option sets (e.g., the text label for a status code number). Dynamics entity IDs are GUIDs (e.g., '00000000-0000-0000-0000-000000000000'). When creating records (POST), Dynamics returns the new record ID in the OData-EntityId response header — not in the response body. Parse this header to get the created record's ID. OData $filter syntax for common operations: - equals: name eq 'Acme Corp' - contains: contains(name,'Acme') - active records: statecode eq 0 - date after: estimatedclosedate ge 2026-01-01

1import { serve } from 'https://deno.land/std@0.168.0/http/server.ts'
2
3const corsHeaders = {
4  'Access-Control-Allow-Origin': '*',
5  'Access-Control-Allow-Headers': 'authorization, x-client-info, apikey, content-type',
6}
7
8async function getAccessToken(): Promise<string> {
9  const clientId = Deno.env.get('DYNAMICS_CLIENT_ID')!
10  const clientSecret = Deno.env.get('DYNAMICS_CLIENT_SECRET')!
11  const tenantId = Deno.env.get('DYNAMICS_TENANT_ID')!
12  const instanceUrl = Deno.env.get('DYNAMICS_INSTANCE_URL')!
13
14  const tokenUrl = `https://login.microsoftonline.com/${tenantId}/oauth2/v2.0/token`
15  const resp = await fetch(tokenUrl, {
16    method: 'POST',
17    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
18    body: new URLSearchParams({
19      grant_type: 'client_credentials',
20      client_id: clientId,
21      client_secret: clientSecret,
22      scope: `${instanceUrl}/.default`,
23    }),
24  })
25  const data = await resp.json()
26  if (!data.access_token) throw new Error('Azure AD token acquisition failed: ' + JSON.stringify(data.error_description || data))
27  return data.access_token
28}
29
30serve(async (req) => {
31  if (req.method === 'OPTIONS') return new Response('ok', { headers: corsHeaders })
32
33  try {
34    const { action, entityType = 'accounts', params = {} } = await req.json()
35    const instanceUrl = Deno.env.get('DYNAMICS_INSTANCE_URL')!
36    const accessToken = await getAccessToken()
37
38    const odataHeaders = {
39      Authorization: `Bearer ${accessToken}`,
40      'Content-Type': 'application/json',
41      'OData-MaxVersion': '4.0',
42      'OData-Version': '4.0',
43      Accept: 'application/json',
44      'Prefer': 'odata.include-annotations=OData.Community.Display.V1.FormattedValue',
45    }
46
47    const apiBase = `${instanceUrl}/api/data/v9.2`
48    let resp: Response
49
50    switch (action) {
51      case 'list_records': {
52        const query = new URLSearchParams()
53        if (params.select) query.set('$select', params.select)
54        if (params.filter) query.set('$filter', params.filter)
55        if (params.top) query.set('$top', String(params.top))
56        if (params.orderby) query.set('$orderby', params.orderby)
57        if (params.expand) query.set('$expand', params.expand)
58        resp = await fetch(`${apiBase}/${entityType}?${query.toString()}`, { headers: odataHeaders })
59        break
60      }
61
62      case 'get_record':
63        resp = await fetch(`${apiBase}/${entityType}(${params.id})${params.select ? '?$select=' + params.select : ''}`, { headers: odataHeaders })
64        break
65
66      case 'create_record':
67        resp = await fetch(`${apiBase}/${entityType}`, {
68          method: 'POST',
69          headers: odataHeaders,
70          body: JSON.stringify(params.data),
71        })
72        // For create, Dynamics returns the ID in the OData-EntityId header
73        if (resp.status === 204) {
74          const entityId = resp.headers.get('OData-EntityId')
75          return new Response(JSON.stringify({ success: true, entityId }), {
76            headers: { ...corsHeaders, 'Content-Type': 'application/json' },
77          })
78        }
79        break
80
81      case 'update_record':
82        resp = await fetch(`${apiBase}/${entityType}(${params.id})`, {
83          method: 'PATCH',
84          headers: odataHeaders,
85          body: JSON.stringify(params.data),
86        })
87        if (resp.status === 204) {
88          return new Response(JSON.stringify({ success: true }), {
89            headers: { ...corsHeaders, 'Content-Type': 'application/json' },
90          })
91        }
92        break
93
94      default:
95        return new Response(JSON.stringify({ error: 'Unknown action' }), {
96          status: 400, headers: { ...corsHeaders, 'Content-Type': 'application/json' },
97        })
98    }
99
100    const data = await resp.json()
101    return new Response(JSON.stringify(data), {
102      status: resp.ok ? 200 : resp.status,
103      headers: { ...corsHeaders, 'Content-Type': 'application/json' },
104    })
105  } catch (error) {
106    return new Response(JSON.stringify({ error: error.message }), {
107      status: 500, headers: { ...corsHeaders, 'Content-Type': 'application/json' },
108    })
109  }
110})

With the Edge Function deployed, use Lovable's chat to build dashboards that surface Dynamics 365 data. The OData query parameters are your primary tool for shaping the data returned. For an account dashboard, invoke list_records with entityType 'accounts' and OData parameters: filter 'statecode eq 0' (active accounts only), select 'name,revenue,statecode,customertypecode', top 50, orderby 'revenue desc'. This returns active accounts sorted by revenue with only the fields you need. For an opportunity pipeline, use entityType 'opportunities' with filter 'statecode eq 0' (open opportunities), expand 'parentaccountid($select=name)' to include the account name, and select 'name,estimatedvalue,estimatedclosedate,stepname,parentaccountid'. The stepname field contains the deal stage description. For creating leads from your app, call create_record with entityType 'leads' and a data object using Dynamics 365 lead attribute names: firstname, lastname, emailaddress1, telephone1, companyname. The lead entity in Dynamics uses 'emailaddress1' not 'email'. Check the Dynamics 365 field schema in your environment for exact attribute names. For complex Dynamics 365 integrations involving custom entities, complex lookups, or bulk data operations, RapidDev's team can help design the correct OData query patterns and entity relationship navigation.