This tutorial demonstrates how to connect and link Dynamics LCS (Lifecycle Services) to your Azure subscription.


This tutorial assumes you have access to a valid Azure AD account which has:

  • Owner privileges to an active Azure subscription. Can be any kind of subscription as long as it’s active and you’re able to deploy resources.
  • Global Administrator privileges to the Azure AD / Office 365 tenant to which the Azure subscription above is associated to.

Preparation steps

  1. Navigate to the LCS portal ( and sign in using your admin account as described above.

    Sign in to the LCS portal

  2. If you’re attempting to access LCS for the first time, you will be prompted to read and accept the online service agreement and privacy statement. Finally, click Accept.

    Read and accept LCS service agreement

  3. At the top right corner, click your account name and verify if the organization status does not equal “Prospect Organization”. Instead, it should be listed as “Customer” or “Partner”.

    LCS prospect organization

  4. So, if your tenant is listed as Prospect Organization, the LCS portal will deny any attempts to deploy D365FO to an Azure subscription because you’re not a registered customer. Luckily, there are two options to overcome this issue:

    Option A: Find and contact a Dynamics 365 partner nearby and let them arrange an environment for you. Personally I would recommend this option because ERP software is not something you “just simply enroll” in your organization.


    Option B: Sign up for a trial Dynamics 365 Finance & Operations license yourself, by following this direct URL:

    If you’re already logged in to Azure AD, the following message should appear.

    Add Dyn365 F&O trial license
    If not, click Sign in at the top right corner.
    Otherwise, click Yes, add it to my account when you’re sure you’re logged in with the right account.

    (By the way: noticed “On-Prem Trial”? We’re just using this this license to activate the “customer” status in able to deploy the Cloud version of D365FO.)

  5. Sign out and log in to LCS again. Now repeat step 3 and ensure the “Prospect” status is changed, probably to “Customer” or “Partner” as shown in the exhibit below.

    LCS customer status

  6. Now it’s time to hook up your Azure subscription to LCS.
    Let’s first create a new LCS project by clicking the + (plus) sign.

    Create new LCS project

  7. Fill in all required fields. You can enter whatever you would like to name it, as long as you set the product name and product version to the value: Dynamics 365 for Finance and Operations.
    Finally click Create.

    Create LCS project 2

  8. Your newly created project should be added to the list of projects. Click it’s name to open the project dashboard. Then go to the main menu (= button) at the top ribbon, and click Project settings.

    LCS project settings button

  9. Navigate to the Azure connectors section, make sure your organization is listed as Customer and click Authorize to deploy the needed service principals to your tenant and subscription. You will be prompted to consent permissions. Click Accept.

    LCS authorize

    Noticed how the Dynamics Deployment Services [wsfed-enabled] service principal is added and authorized to your tenant? It will be used to deploy and maintain the deployable Azure resources.

    LCS authorize tenant

  10. Make sure the authorization status has been switched to Authorization complete as shown below.

    LCS authorization complete

  11. Open up a second browser tab, navigate to the Azure portal ( and go to your subscription. Click Access control (IAM), and assign the Contributor role the Dynamics Deployment Services [wsfed-enabled] service principal as shown below.

    Pre-authorize service principal in Azure

    Also, make sure your account is added directly (as Owner or Contibutor) to the subscription access controls. Group-based role inheritance will prevent LCS from proceeding in connecting to Azure (and that’s a pity!)

  12. Go back to the LCS browser tab, and navigate to the Azure connectors settings (as described in step #9 above) and click the + Add button to connect LCS to your Azure subscription.

    LCS add Azure connector 1

  13. LCS will now require some details about your subscription:

    Name: give it a descriptive name, doesn’t need to match your subscription name
    Azure subscription ID: copy and paste from the Azure portal
    Azure subscription AAD tenant domain: let it autofill, it should match the tenant name of the account you’re using
    Configure to use ARM: of course 😉

    LCS add Azure connector

  14. LCS now detects if your account is eligible to deploy D365FO resources to Azure.
    It validates your Contributor permissions. If it is not successful, give it a few minutes and retry. Otherwise, check the FAQ section below.

    LCS ARM authorize

  15. You can continue the wizard since you’re already authorized to the Azure subscription (step #11).
    LCS will ask to select an Azure region to deploy resources by default. Go ahead and select your preferable region. If you’re located in the Netherlands, select West Europe for best (client latency) performance.

  16. Ensure the connector is added to the LCS project as shown below.

    LCS Azure connector is added

  17. All preparations are now completed to deploy a D365FO sandbox. Go ahead and move on to the next section.

  18. Your LCS project is now connected to your Azure subscription.
    You can now deploy environments to Azure, by following my how-to guide.

Happy DAX’ing! 😉 If you have any questions, feel free to drop a comment below.

FAQ – Common issues

Q: I cannot select “Dynamics 365 for Finance and Operations” during LCS project creation. For example, the only option is “Dynamics NAV” or “Dynamics AX 2012”.

A: Make sure you’re logged in with an Azure AD account, and not a Microsoft/Live/Passport account. Also, make sure your organization status is not set to “prospect organization” at the top right. If it is prospect, go back to preparation step #4.

Q: I get this error when I try to connect LCS to Azure, or when deploying a sandbox:
“This action cannot be performed by prospect users. Please contact support with ID: {0}.

A: This error pops up when your LCS organization status is set to “Prospect organization”. You can change it by following preparation step #4 above. If it’s already non-prospect, try to create a new LCS project. Sometimes the “old” organization status will stick to the LCS project.

Q: I get this error message randomly within LCS:
“An unexpected client error has occurred”.

A: It seems the LCS portal is having some issues with a few kind of browsers, like Firefox.
Try using another browser like Edge, Internet Explorer (ieuw!), or Google Chrome. If the error persists, try to clear browser cache and sign-out and sign-in again. Still persisting? Maybe there is some trouble (uh ohh), and retry in a few hours.

Q: My organization authorization (admin consent) keeps remaining status “pending” and isn’t switching to “Authorization complete”. Now I’m unable to deploy a sandbox.

A: First of all, wait a few minutes to allow LCS to discover your subscription. Make sure the service principal (Dynamics Deployment Services [wsfed-enabled]) is given the right role assignment on your Azure subscription. It should have “Contributor” permissions.

Q: During creation of the Cloud-hosted environment sandbox, the wizard won’t let me pass the permissions check (Contributor on admin account).

A: Make sure your account is added directly to the subscription RBAC access controls. There seems to be issues with discovering your permissions via group-based inheritance.