How This Briefing Works
This dossier opens with key findings, then maps the gap between what Dynamics Microsoft discloses and what BLACKOUT observed at runtime. From there: what it means for your organization, what to do about it, and the detection evidence underneath. BLACKOUT observes runtime browser behavior and cites the regulations that address each pattern — legal determinations are your counsel's call.
At a Glance
across 6 sites
vendor fires before consent
Briefing
Microsoft Dynamics positions as business automation platform but embeds comprehensive tracking via client-side SDKs and embedded forms. Scanner detections reveal defeat device tactics, behavioral biometrics capture, persistent storage abuse, identity resolution tied to Microsoft Graph, and GTM exploitation patterns consistent with Microsoft's cross-product surveillance infrastructure.
What This Means For You
Sites embedding Dynamics inherit Microsoft's cross-product tracking network from first SDK load. CRM identity resolution links form submissions to Microsoft Graph and LinkedIn profiles. Behavioral biometric capture creates lead scoring liability beyond disclosed CRM functions. Persistent storage enables long-term tracking across customer properties. GTM abuse extends surveillance beyond declared form functionality. GDPR exposure if Dynamics loads before consent.
Risk Channel Breakdown
Dynamics fingerprinting and CRM tracking distorts attribution by tying form submissions and engagement to Microsoft's broader enterprise identity profiles, corrupting measurement of organic lead generation.
Device fingerprints, behavioral data, and CRM identities collected via Dynamics scripts feed Microsoft's advertising network and LinkedIn targeting, subsidizing competitors' lead acquisition.
Expands attack surface
Fingerprinting, session recording, and CRM tracking initiate on Dynamics SDK load without user consent, creating GDPR liability for sites embedding Microsoft forms and chat widgets.
Threat Indicators
Runtime-observed (BTI-C)
Evasion infrastructure, auditor bypass
Keystroke/mouse tracking
Full session replay
Identity stitching
Ignoring CMP signals
Device identification
Long-lived identifiers
PII deanonymization
Container/loader (neutral)
Per-code narrative explanations of what each detected behavior means for your organization
Per-code evidence with full attribution chain, severity rankings, and consequence narratives See pricing →
Claims vs. Reality
BLACKOUT analyzed Dynamics Microsoft's public claims against observed runtime behavior and identified 1 contradiction.
Full claim-vs-reality gap analysis with claim text, observed behavior, severity, regulatory citations (GDPR, CCPA, ePrivacy), and evidence pointers per gap See pricing →
What To Do
6 for current users · 4 for evaluators
contractual leverage points
Role-specific actions (security / legal / marketing / procurement), full negotiation brief with contractual language, and BTI-code-specific consequences See pricing →
Supply Chain & Pairings
Full supply-chain mapping (loads / loaded-by lists with vendor identities) and the undisclosed-subprocessor list with observation evidence See pricing →