Exposing Dynamics 365 Onebox to the LAN

by Eugen Glasow

The below instruction was inspired by the blog How to access AX 7 from other machine. However, I work not on a single notebook, but connect to a prosumer Windows Server 2016 machine with 32 GB RAM, 1 TB Samsung SSD 850 PRO, 4 core Intel i7-4790K CPU @4GHz, and an Oculus VR headset, a nerd’s dream come alive 🙂 The resulting performance is comparable – if not higher – to a D365 production instance.

  1. The first [time consuming] step is to download the latest Dynamics 365 for Finance and Operations, Enterprise edition 7.3 with Platform update 12. Once downloaded, unpack the 10x3GB RAR archives to a fast disc, preferably SSD. The Connect site some of us have been using semi-officially to download the latest releases and betas has been retired, but the latest VHD is available here: https://aka.ms/finandops73pu12, God knows for how long.
  2. Update 27.03.2018: the above SharePoint link has expired too. Use LCS to download the image.

  3. Install the Hyper-V role to the Windows Server, should it has not been done before.
  4. In the Virtual Switch manager of the Hyper-V manager, create a new Virtual Switch of the External network type, and Allow management operating system to share this network adapter:

    Contrary to this advice, there is no need for another Internal network, because the virtual machine is going to be an equal peer in the LAN, visible under a local IP address. Should your physical server be assigned a fixed IP and running its own DHCP service, note the IP address down before applying the changes, because the Hyper-V switch is going to take place of the original Ethernet connection and become the primary ‘gate’.
  5. Next, create a new Virtual Machine in the Hyper-V manager. Generation = 1, attach the VHD you have unpacked at step 1. Give it dynamic memory; a Dynamics 365 Onebox running under full steam consumes between 8 and 12 GB of memory. Hence, for a comfortable experience your physical server should possess no less than 24 GB RAM. Give the machine the Network Adaptor from step 3. An Automatic Start Action (delayed) makes sense for an always on, accessible anytime virtual machine.
  6. Start the VM. It should be able to boot and join the local area network. Connect to the machine using the default credentials: Username = CONTOSO/Administrator, Password = pass@word1 (you will be asked to change the password ASAP). Be aware the EN-US keyboard is active by default.
  7. Once connected, make yourself comfortable in the virtual machine: assign your native keyboard layout, localization options and the time zone. Dynamics is not going to let you in, though, for the admin provisioning tool has not been executed yet. Let the Windows Server 2016 running in the virtual machine download and install the latest updates. It is going to take a while.
  8. Create a snapshot of the VM to rollback any changes to this virgin state, if needed.
  9. Run the AdminUserProvisioning tool from the VM desktop to associate your personal Office 365 tenant account with the Admin user in Dynamics 365.
    FYI: the basic Office 365 Business Essentials subscription is as cheap as ~4 Euro a month.
  10. Try the Internet Information Server and the Dynamics 365 application by typing in https://usnconeboxax1aos.cloud.onebox.dynamics.com in the browser on the VM. The External network connection is mandatory, because the application is going to authenticate you against the Azure Active Directory.
  11. In the meantime, open your DHCP management console and assign a fixed local IP address to the virtual machine by the Hyper-V virtual MAC address. The VM must have gotten a lease already under the name ‘MININT-F36S5EH’. This lease can be Added to reservation to make the lease persistent, e.g. 192.168.0.201
  12. What the C:\Windows\System32\drivers\etc\hosts file does to the local machine, so is the DNS server for the local network. In the DNS console, create a new Forward Lookup Zone cloud.onebox.dynamics.com, and add a New Host (A) usnconeboxax1aos with the IP address from step 10 into this zone. The FQDN of the virtual machine in the local network becomes usnconeboxax1aos.cloud.onebox.dynamics.com:
  13. To test the connection, you may temporarily turn the firewall in the VM off for the internal network, and try to ping the VM by the name usnconeboxax1aos.cloud.onebox.dynamics.com from a different host in the LAN, then navigate to https://usnconeboxax1aos.cloud.onebox.dynamics.com in the browser. The browser is going to show an SSL certificate error.
  14. To circumvent the warning, export the SSL certificate from the IIS in the VM by opening Bindings… of the AOSService site, then Edit… > View… > Details > Copy to File, then save the file in a local network share, since your VM is able to browse the local network.
  15. Install the certificate on your notebook into the Trusted Root Certification Authorities repository of your Current User by double-clicking the .PFX certificate file from step 13 (you may review or delete them if needed in the Manage user certificate console).
  16. Try https://usnconeboxax1aos.cloud.onebox.dynamics.com again, voila!
  17. Update 27.03.2018: In order to download Office files from the machine or to use the Data management module you need to re-configure the Azure Storage Emulator in the OneBox, otherwise an error appears on the attempt to connect to the address http://127.0.0.1:10000.

  18. Open the configuration file C:\Program Files (x86)\Microsoft SDKs\Azure\Storage Emulator\AzureStorageEmulator.exe.CONFIG and replace 127.0.0.1 with usnconeboxax1aos.cloud.onebox.dynamics.com at 3 places.
  19. Open the configuration file C:\AOSService\webroot\web.CONFIG and replace the encoded connection string <add key="AzureStorage.StorageConnectionString" value="AQAAAHNm4l3JT6ikAPoAN abracadabra" />
    with <add key="AzureStorage.StorageConnectionString" value="UseDevelopmentStorage=true;DevelopmentStorageProxyUri=http://usnconeboxax1aos.cloud.onebox.dynamics.com" />
  20. In the Windows firewall, add a new Inbound rule and open the ports 10000, 10001, 10002 to the Private network.
  21. Restart the IIS application and the Azure Storage Emulator.

Exposing the same machine to the WAN seems to be difficult. Obviously, you do not own the domain dynamics.com, and for the global Domain Name System to redirect an HTTPS call to the external IP address of your router, you have to rename the URL of the Dynamics 365 application first. The instructions here and here do not appear to be working [anymore?], since authentication attempts from a fake URL such as dax.erconsult.eu fail with the error
AADSTS50011: The reply address 'https://dax.erconsult.eu/' does not match the reply addresses configured for the application: '00000015-0000-0000-c000-000000000000’
It appears that Microsoft has re-configured the Azure Active Directory to only perform redirects to one of the *.dynamics.com hosts. I would be glad to be mistaken.

Leave a Reply

Your email address will not be published. Required fields are marked *