What is “Enabling Mobility”?

  • Technology Involved
  • How it works
  • The 5-step Process
  • Technical Steps – Quick walk-through

Mobility” allows your staff to access CRM, NAV and SharePoint from any mobile device as long as they have internet access – this means you get access to your information and systems Anywhere, Anytime from Any Device. This includes:




What is the technology involved?

CRM\NAV Mobility uses what is called “Internet Facing Deployment” (IFD).

Internet Facing Deployment – is a secure method of providing access to CRM, NAV and SharePoint via the Public Internet without requiring a VPN.

It gives you full access to CRM and NAV Web, Tablet and Browser Clients as well as SharePoint from anywhere with an internet connection.

IFD is a combination of software (IIS, SSL Certificates, ADFS, CRM\NAV\SharePoint) and Configurations (IIS Bindings, Ports\Firewall settings, DNS entries, etc.).

It uses standard Microsoft software so there is no additional software purchase required.

It does require a Wildcard SSL Certificate which costs approx. $300\yr.


There are 3 Possible Connection Scenarios…

Scenario 1: “Normal LAN connections (i.e. within the Office)

In a normal LAN (local office) environment, CRM\NAV authentication is based on the PC communicating directly with the Active Directory (Domain) Server.

The Devices must be on the network and communications are not encrypted. Remote access is not possible unless you use Terminal Services (an additional server and additional cost).




Scenario 2: using a VPN without IFD outside of the Office

In a Non-IFD WAN environment, devices must connect using VPN software. The devices must have special configurations and\or software on them in order to connect to the Domain (Active Directory).

Communication is then still occurring directly between the Domain and the Device.

Devices cannot connect “out of the box”.


Scenario 3: IFD – Access is still based upon Active Directory Authentication (Domain) but it provides a secure middle piece called “ADFS” (Active Directory Federation Services).

ADFS functions as a secure go-between between the “outside” connection and the Active Directory Server. All communications are encrypted using the “https” protocol.

No special software or configurations are required on the Devices – you connect out of the box Anywhere, Anytime from Any Device

The 5-step process

1.Purchase a “wildcard” SSL Certificate – used to enable the “Https” protocol, which is the secure version of “http”. It ensures that all communications between the browser and the websites are encrypted.

Available from GoDaddy, and other ISPs – approximately $300 per year – your IT must purchase this.

2.One-time Setup and Configuration of ADFS (Active Directory Federation Services) – Vox works with your IT group to do this.

3.One-time Configurations of IIS, Claims Based Authentication within CRM, IFD and Internal DNS entries – Vox works with your IT group to do this.

4.One-time Configuration of your Firewall to allow certain Ports (typical ones are: 444, 446, 447, 449) – your IT must perform this but Vox will provide the details.

One-time Configuration of External (Public facing) DNS entries under your company’s xxxx.com domain (typical entries are “CRM”, “adfs2016”, “auth2016”, “dev2016”, “NAV2016”, “SP2016”) – your IT must perform this but Vox will provide the details.

Technical Steps – Quick Walk-through

1.Obtain SSL Certificate (GoDaddy, etc.)

2.Install SSL Certificate and Bind to IIS Websites

3.Configure Internal and External (public-facing) DNS entries (typical entries are “CRM”, “adfs2016”, “auth2016”, “dev2016”, “NAV2016”, “SP2016”)

4.Install ADFS (available from Server Manager utility)

5.Configure ADFS

6.Configure Claims Based Authentication and IFD within CRM Deployment Manager

7.Complete ADFS Configuration

8.Open Ports on Firewall (typical ones are: 444, 446, 447, 449)

1.& 2. Obtain and Install\Bind Wildcard SSL Certificate:

a.Generate a CSR (Certificate Signing Request) from the CRM Server (Create Certificate Request)

b.Go to GoDaddy or other similar provider and request a “Wildcard SSL Certificate” (*.company.com) – you will need the CSR you generated



3.Configure Internal\External DNS:

Add Entries for each of the services with the Internal IP Address of the Servers running the services (when specifying the external DNS you would use the external IP addresses)…

adfs2016 à specifiy the IP of the ADFS Server

auth2016 à specifiy the IP of the CRM Server

dev2016 à specifiy the IP of the CRM Server

NAV2016 à specifiy the IP of the NAV Server

SP2016 à specifiy the IP of the SharePoint Server

“CRM_Org” à specifiy The CRM_Org name must also be added, using the IP of the CRM Server




4.Install ADFS:

a.Usually installed on the CRM Server

b.Installed via the Server Manager Utility


5.Configure ADFS:

Use the Wizard (details can be found in http://www.youtube.com/watch?v=cR7ku934x8Q)


6.Configure Claims Based Authentication within CRM:

a.Use the CRM Deployment Manager to launch the Configure Claims Based Authentication Wizard

b.You will be prompted to select the SSL Certificate you installed earlier…




6.Configure IFD within CRM:

a.Use the CRM Deployment Manager to launch the Configure Internet Facing Deployment Wizard



6.Open Ports on Firewall:

Typical Ports used are 444, 446, 447, 449.

Recommend using Port 444 for ADFS rather than the default 443 as 443 is often already in use by Outlook Web access or other products.

These ports should correspond to the “IFD URLs” you intend to use for your systems:

e.g. a sample “set” of IFD URLs might be:




NAV 2016 Web Client:



NAV 2016 Tablet Client:


NAV 2016 Phone Client:


SharePoint IFD URL:



Example of Non-IFD CRM URL (e.g. “internal” URL):


-Accessible only from devices that are logged onto the Network (LAN)

-NOT Accessible outside of the Network unless using VPN.

-Requires Authentication directly against the Active Directory Server

-CRM Server name appears in the URL

Example of IFD CRM URL (e.g. “external” URL):


-Accessible Anywhere, Anytime from Any Device that has an internet connection and Browser

-Does not require VPN

-Authentication is against Active Directory via the secure ADFS Service and encrypted https protocol

Let’s See it for real

IFD for CRM 2016


IFD for CRM 2016 Mobile Client


IFD for NAV 2016 Web Client


IFD for NAV 2016 Tablet Client


IFD for NAV 2016 Phone Client


IFD for SharePoint