Paminga for Dynamics 365

Paminga for Dynamics 365 is a managed Dataverse solution that puts the Paminga CRM panel on your Account, Contact, and Lead forms, and Paminga's score and attribution columns on Contact and Lead. It is the same panel Salesforce customers get from the Managed Salesforce Package, so if you have seen one you have seen the other.

Installing it is four pieces of work: create a Paminga API token, import the solution, add the panel to your forms, and connect the sync. An admin who is comfortable in the Power Apps maker portal can do all of it in an afternoon.

Before You Start

You need:

• A Paminga login with permission to create users and Personal Access Tokens
• System Administrator (or equivalent) in the Dataverse environment where you will import the solution
• A Global Administrator or Application Administrator in your Microsoft Entra tenant, for the one-time admin consent when you connect the sync
• Your Dynamics environment URL (for example https://yourorg.crm.dynamics.com); Paminga asks for it when you connect the sync
• The solution zip from the download page. The page lists every release with its SHA-256; verify the file you downloaded against it before you import.

What Is in the Solution

Component	What it does
paminga_ApiToken ("Paminga API Token") environment variable	Authenticates the panel to Paminga. No default; the import dialog prompts you for it.
paminga_PanelBaseUrl ("Paminga Panel Base URL") environment variable	Where the panel loads from. Defaults to https://crm.paminga.com/crm/panel/. EU customers change it after import (see below).
paminga_/scripts/panel.js	The form script that loads the panel for the record on screen.
paminga_/config/index.html	The solution's Configuration page: the form steps below, plus a Test token button.
paminga_/pages/missing.html, paminga_/images/paminga-32.png	The message shown when a record has no email or name (or the token is not set), and the panel icon.
Eight columns on Contact and Lead	Paminga Lead Score, Paminga Most Recent Visit Date, Paminga First Touch Date, Paminga Last Touch Date, Paminga First Touch Marketing Channel, Paminga Last Touch Marketing Channel, Paminga First Touch Source, Paminga Last Touch Source: the same eight fields as the Salesforce package. The Paminga sync writes them; the panel does not.
Paminga Sync security role	For the application user the sync runs as.
Paminga User security role	Read on environment variables. Only needed for tenants whose salespeople are on hardened custom roles instead of Basic User.

The solution ships no forms, sitemap, or app. You decide which of your forms get the panel and where it sits.

The solution unique name is PamingaForDynamics365, the publisher is Paminga, and the customization prefix is paminga_. Version 1.0.0.x.

Create the Paminga API Token

The panel authenticates with a single Personal Access Token per Dynamics organization. Every Dynamics user who opens a record sees the panel through that one token, so it should belong to a user that exists for this purpose and nothing else.

First, create a user in Paminga dedicated to the Dynamics panel, and give it restrictive permissions. Paminga does not charge per user, so there is no reason to reuse a real person's account.

Then mint the token:

• Log into Paminga as that user
• In the upper right, hover the user initials and click Personal Settings
• In the left nav, click Personal Access Tokens
• Click Generate Token
• Name the token Dynamics panel token
• Click Create Token
• Copy the token. You will paste it into the import dialog in the next section.

Import the Solution

1. Go to the Power Apps maker portal and pick the environment you are installing into.
2. In the left nav, select Solutions, then Import solution on the command bar.
3. Choose Browse, select the Paminga for Dynamics 365 zip, and select Next.
4. The import dialog prompts for the Paminga API Token environment variable. Paste the token you copied. You are not asked for the Paminga Panel Base URL: it has a default (the US host) and is only changed after import, by EU accounts (next section).
5. Select Import. The import runs in the background; managed solutions arrive published, so there is nothing to publish afterward.

Microsoft's own walkthrough of the import dialog is at Import solutions in Power Platform.

EU Customers: Set the Panel Base URL

The import dialog only prompts for variables that have no default. paminga_PanelBaseUrl has one (the US host), so EU accounts set it after import. The value of a variable that arrived in a managed solution is only visible from the Default Solution, not from inside Paminga for Dynamics 365, so:

• In the maker portal, open Solutions → Default Solution → Environment variables
• Open Paminga Panel Base URL
• Under Current Value select New value, enter https://crm.eu.paminga.com/crm/panel/ (keep the trailing slash), and Save

Both behaviors, defaults at import time and values being visible only from the Default Solution, are documented in Use environment variables in Power Platform solutions.

Test the Token

Open the solution's Configuration page from the solution's Overview in the maker portal (Solutions → Paminga for Dynamics 365) and click Test token. It reads the token and base URL you just set, asks Paminga who the token belongs to, and tells you whether they work, before you have touched a single form. Nothing is written.

Add the Paminga Panel to Your Forms

Repeat these steps for each main form you want the panel on. Most customers do the Account, Contact, and Lead main forms. The steps are the same for all three except for which column's OnChange you wire up in step 4.

Open the form in the modern form designer (Solutions → your solution or the Default Solution → the table → Forms → the Main form → Edit).

1. Add the script. In the left nav select Form libraries, then Add library, and add paminga_/scripts/panel.js.

2. Add a tab. Add a new tab labeled Paminga with name tab_paminga, containing one section. Where it sits among your other tabs is up to you.

3. Add the frame. With that section selected, on the Components pane expand Display and select External website. Set:

   • Name: IFRAME_paminga_panel (the script finds the control by this name, so it must match exactly)
   • URL: about:blank (the script sets the real URL for each record)
   • Restrict cross-frame scripting, where supported: off. With it on, the platform sandboxes the frame and no script can run, so the panel never loads.
   • Pass row object-type code and unique identifiers as parameters: off. The script passes the record id itself; leaving it on does no harm.
   • Component height: enough rows for roughly 600px (about 20), or tick Use all available vertical space
   • Enable for mobile: on

   Make sure the Email column (Contact, Lead) or the Account Name column (Account) is on the form. It may be hidden. Add it under the frame's Table column dependencies so nobody removes it later. Without it the script has to fetch the value with an extra request on every record load, and you cannot register the OnChange handler in step 4.

4. Wire the events. Each of these handlers calls the function Paminga.Panel.load from the library you added, with Pass execution context as first parameter checked:

   • The IFRAME_paminga_panel control's OnReadyStateComplete event
   • The Email (emailaddress1) column's OnChange event on Contact and Lead forms, or the Account Name (name) column's OnChange on the Account form. This is what refreshes the panel when someone corrects the address or name.
   • The form's OnLoad event, so the panel starts loading as early as possible. This one is a complement, not a substitute: the frame's own event is required.

5. Add the Paminga columns (Contact and Lead forms only; optional but recommended). The eight columns exist on Contact and Lead, so an Account form gets only the panel. On Contact and Lead, put the eight Paminga columns in the Paminga tab above the panel so score and attribution are visible without scrolling. We suggest a two-column section: Paminga Lead Score and Paminga Most Recent Visit Date on the first row, then the first and last touch dates, the first and last touch marketing channels, and the first and last touch sources. Mark all eight read-only: the sync owns them, and a value typed into Dynamics is overwritten on the next sync and never reaches Paminga. Lead scores are adjusted in the panel's Lead Scoring tab, if you allow that under Choose what the panel shows.

6. Save and publish.

OnReadyStateComplete in the modern designer

If you do not see an OnReadyStateComplete event on the frame in the modern designer, save the form first, then select Switch to classic, double-click the IFRAME, and on its Events tab add the handler and tick Pass execution context as first parameter, as in step 4. Do not skip it: a frame can finish loading after the form's OnLoad has run, and when it does the platform applies the frame's configured URL (about:blank) over the one the script set. The frame's own event is what re-applies the panel URL at that moment. Until it is registered, the form is not done.

Microsoft documents each of the pieces above: the External website component (including the classic designer's property sheet, where Enable for mobile lives), configuring event handlers, and the IFRAME OnReadyStateComplete event.

How the Panel Finds the Record

Contact and Lead records are matched to Paminga by email address. Account records are matched by account name. A record with no email (or no name, for an Account) shows a short Paminga message in the frame instead of the panel; fill the field in and the panel loads on the next change.

Choose What the Panel Shows

On Contact and Lead records the panel has tabs for Engagement, Lead Scoring, Marketing Lists, and Subscription Lists. On Account records it shows the Activity Stream of the account's contacts. What your salespeople can see and change is controlled once, per Paminga account, under Settings → Account → CRM iFrame:

• Show Marketing List membership, and whether salespeople can change it
• Show Subscription List membership, and whether salespeople can change it
• Allow manual Lead Score adjustment

These settings apply to every CRM you have connected, so a change here shows up in Dynamics and Salesforce alike.

Connect the Sync

The panel and the sync are independent. The panel needs the token; the sync needs Microsoft admin consent and an application user in your environment.

1. In Paminga go to Settings → Account → Integrations → Dynamics → D365 Authorization, enter your Dynamics environment URL (for example https://yourorg.crm.dynamics.com), then click Connect Dynamics Account.
2. You are sent to Microsoft to grant admin consent. Sign in as a Global Administrator or Application Administrator. The consent screen shows the app name Paminga with Microsoft's verified-publisher badge for Paminga, Inc. Accept. Paminga then lands you on D365 Sync Settings.
3. Create the application user the sync runs as. In the Power Platform admin center: Environments → your environment → Settings → Users + permissions → Application users → New app user.
4. Select Add an app and search by client ID: f41adf61-824b-41ba-8c81-0f17fe22b244. Enterprise applications do not appear in that picker, so searching by name will come up empty; the ID works.
5. Choose the Business unit, then under security roles add Paminga Sync. Create the user.
6. Back on D365 Sync Settings in Paminga, finish the setup: map your fields, tick Syncs Enabled, and run your first full sync.

Microsoft's references for these steps: Grant tenant-wide admin consent to an application and Manage application users in the Power Platform admin center.

Security Notes

Who can read the token. The API token is stored as a Dataverse environment variable. Any Dynamics user with Basic User privileges can read it through the Web API. That is much like the Salesforce package, where the token lives in a custom metadata record and travels in the panel's frame address, so any Salesforce user who can open the panel can read it. It is also why the token belongs to a dedicated, permission-restricted Paminga user: the blast radius of a leaked token is whatever that user can do, and you decide what that is.

Rotation. Generate a new token for the same Paminga user and set it as the Current Value of Paminga API Token, from Solutions → Default Solution → Environment variables (the value is not editable from inside the managed solution). Then ask users to reload Dynamics (a full browser refresh, not just opening another record: the form script keeps the token it read for as long as the page is open), and only then revoke the old token. There is no restart and no re-import.

Cross-frame scripting. The Restrict cross-frame scripting option on the frame has to be off for the panel to load. The frame only ever points at the Paminga host you set in Paminga Panel Base URL.

What the sync can touch is governed entirely by the Paminga Sync role you assigned to the application user, so you can review it in the Power Platform admin center at any time.

Troubleshooting

The frame says "crm.paminga.com refused to connect". Your Dynamics host is not on Paminga's embed allow-list. This is on our side, not yours: email support@paminga.com with your Dynamics URL and the exact message.

The frame says "Paminga is not connected yet" for some users although the token is set. Those users cannot read environment variables, so the script never gets the token. This happens on tenants that replaced Basic User with a hardened custom role. Assign them the Paminga User role that ships with the solution.

The frame is completely blank. Restrict cross-frame scripting, where supported is on for the IFRAME_paminga_panel control, which sandboxes the frame so no script can run. Turn it off, save, and publish.

"Unable to authenticate to Paminga". The token was revoked, or the base URL points at the wrong region (a US account pointed at crm.eu, or the reverse). Check both variables, then use Test token on the Configuration page.

AADSTS50011 during consent. The redirect URI Microsoft received does not match what is registered for the Paminga app. Email support@paminga.com with the full error text.

Mobile. The panel is best-effort in the Dynamics 365 mobile app. If it does not load there, it is not something you have misconfigured.