← Back to home
Security & architecture

How it connects, what it keeps and what it never does.

So you and your security team can review it before connecting an environment. Everything here describes how the tool works today.

1delegated Dynamics permission. Nothing more.
0passwords stored. Sign-in is handled by Microsoft.
0existing records modified or deleted.
7 daysand each import’s data deletes itself.

The path your data takes

How data moves between your organization, ImportToD365 and your Dynamics 365Your organizationImportToD365 · Microsoft AzureYour Dynamics 365You, in the browserYou upload the Excel and decideMicrosoft Entra IDYour work sign-inReviewValidates, maps and detectspossible duplicatesTemporary storageSeparated by organizationDeleted after 7 daysYour DataverseYour permissionsand security roles applyNothing existing is modified1You sign in2Excel + token3Reads and compares4Creates only approved records5Report6Import data
  1. 1You sign in with your work account. Microsoft handles the sign-in: we never see your password.
  2. 2You upload the Excel file. It travels together with the token Microsoft issued for your user.
  3. 3We read your Dynamics configuration and look for possible duplicates. Read-only.
  4. 4After your confirmation, only the new records you approved are created.
  5. 5You download the Excel report, row by row: it’s your permanent record.
  6. 6Import data is stored separately per organization and deletes itself after 7 days.

Your data’s lifecycle

  1. UploadThe file reaches Azure encrypted.
  2. ReviewValidation and duplicates, without writing anything.
  3. DecideYou fix and approve what goes in.
  4. ImportOnly new records, with your permissions.
  5. DownloadThe Excel report stays with you.
  6. DeletedAfter 7 days, automatically.

Your permissions, not one more

All of your Dynamics 365
What your security role lets you do
ImportToD365Create the new records you approved

The tool uses a single delegated Dynamics permission (user_impersonation) and acts as you. If your security role doesn’t let you create contacts, ImportToD365 can’t either.

There are no service accounts or secrets with access to your environment: there’s no master key that can get into your CRM.

The token Microsoft issues is short-lived and expires on its own. It’s stored with each import’s data so the import can resume if it’s interrupted, and it’s deleted along with that data.

What ImportToD365 never does

With your CRM

  • It doesn’t update, merge or delete existing records
  • It doesn’t write anything without your confirmation
  • It doesn’t do anything your user can’t do

With your data

  • It doesn’t use it for anything other than your import
  • It doesn’t process it with AI models
  • It doesn’t keep it beyond 7 days

What your security team usually asks

Where does it run?

On Microsoft Azure: Azure Container Apps for the application and Azure Storage for temporary data.

What permissions does it ask for?

Just one, delegated: user_impersonation on Dynamics 365. The first time, Microsoft asks for your consent.

What if my organization requires admin approval?

Microsoft’s standard admin consent flow is used.

Can it modify or delete data?

No. It only creates new records you approved. It never updates, merges or deletes.

Do you use my data to train AI?

No. Your data isn’t processed with AI models or used for anything other than your import.

How are connections protected?

HTTPS with HSTS in production, signature verification of every token against Entra ID, and usage limits.

The legal documents are in Terms of Service and Privacy Policy. Need more detail? Write to us.

Try it with your own data.Free plan: 500 rows per month, every feature, no card.

Start free Write to us