user_impersonation on the organization URL. Table-level access is a Dataverse security role, not an OAuth scope. Sites.Selected does not apply.
Minimal scopes per action
Each Dynamics 365 connection also requests
openid and offline_access. Replace {organization-url} with the Dataverse environment URL, for example https://org12345.crm.dynamics.com/user_impersonation.| Action | Description | Minimum scopes |
|---|---|---|
| Close opportunity as lost | Closes a Sales opportunity as lost. | /user_impersonation |
| Close opportunity as won | Closes a Sales opportunity as won. | /user_impersonation |
| Create record | Creates a Dataverse record. | /user_impersonation |
| Delete record | Deletes a Dataverse record. | /user_impersonation |
| Describe table | Describes a Dataverse table and its columns. | /user_impersonation |
| Disqualify lead | Disqualifies a Sales lead. | /user_impersonation |
| Get record | Gets a Dataverse record by ID. | /user_impersonation |
| List records | Lists records from a Dataverse table. | /user_impersonation |
| List tables | Lists Dataverse tables in the environment. | /user_impersonation |
| Qualify lead | Qualifies a Sales lead. | /user_impersonation |
| Recalculate opportunity | Recalculates a Sales opportunity. | /user_impersonation |
| Update record | Updates a Dataverse record. | /user_impersonation |