The tenant decides who you are.
In a Microsoft estate, Entra ID is the fact everything else hangs off — who a person is, what they may see, which tenant holds the record. Dynamics sits next door, Fabric and Synapse read the whole thing, and security asks all of it before a CRM is allowed to talk to anything.
The integration is fine. The security review is the project.
The build takes weeks. Getting a third-party system approved to hold customer data alongside the Microsoft estate takes longer — tenancy, conditional access, where the records physically sit, who can be an admin, what happens when someone leaves. Teams start that conversation after the architecture is fixed, which is the expensive order.
The directory decides access.
AzureWhat we build in the estate.
Entra ID as the single identity
Single sign-on, groups and conditional access carried through to every connected system, so joiners and leavers are handled once in the directory. Nobody keeps a second list of who works here.
Dynamics and HubSpot side by side
A contract that says which system owns the account, the contact and the opportunity, and what a conflict resolves to. Not a bidirectional sync that overwrites whichever record was touched last.
Fabric and Synapse as the reporting layer
CRM, service and product data landed where the rest of the business already reports from, modelled rather than copied. Analysts keep the tooling they know instead of learning a second warehouse.
Tenancy and residency answered first
Which tenant, which region, which records may leave it, written down before the build rather than discovered in review. The answer shapes the architecture, so it comes first.
Private networking and key handling
Integrations that run inside your network boundary, with secrets in Key Vault and managed identities instead of a shared API key in a workflow. Every call is attributable to something a security team can audit.
The review pack
Data flow diagrams, retention, access model and subprocessor list assembled as the build proceeds. Security gets a document to read, not a meeting to schedule.
Chart, clear, build, embed.
Chart
The estate as it actually stands — tenants, directories, which system holds which record, and where data is allowed to sit.
Clear
The security and residency questions taken to your reviewers early, with the architecture still open enough to change on their answers.
Build
Identity, integration and reporting built against that cleared design, with logging and retries in the parts that cross a boundary.
Embed
Runbooks, the access model and the review pack, walked through with your IT and security people until they can answer for it without us in the room.
Identity gets bolted on last.
Provisioning is treated as configuration and left to the end. Then a department reorganises, a contractor keeps access for months, and reporting starts disagreeing with the directory about who the account team is. Identity is the schema everything else inherits — it is scoped first or it is retrofitted expensively.
Tell us what your security review keeps blocking.
Tell us what you are running
What the system does today, where it breaks, and when it has to work. An engineer reads it — you get an answer inside one business day, not a sequence.