Contents

Why does Tamarac need Global Admin? Can Tamarac access all our data? Are credentials stored? What happens after onboarding?

 

For more information, see Tamarac CRM (Dynamics 365) access, permissions & tenant consent.

Why does Tamarac need Global Admin?

Because Microsoft requires Global Admin approval for tenant‑wide consent. This access is temporary and can be revoked immediately after setup.

This role cannot be replaced by lower roles due to the Microsoft security model.

Can Tamarac access all our data?

No, there is no direct user-level access. Access is restricted to application and service principal identities and limited to:

• Directory read (users/groups).

• CRM data necessary for integration.

All access is application-based and auditable.

Are credentials stored?

No. Authentication uses secure OAuth tokens and application identities—no user credentials are stored.

What happens after onboarding?

Elevated access can be removed, and Tamarac CRM continues running under least‑privilege application permissions.