It should be automatic. When you assign a Dynamics 365 Customer Engagement license to one of your users in Active Directory, the system will add the corresponding System User record in Dynamics 365 CE.
Occasionally, this doesn’t happen correctly. We saw this recently when setting up a trial instance for a customer’s CRM. The environment had been created, and the license had been assigned, but the user could not launch Dynamics 365 CE, despite having the Global Administrator role in the Office 365 portal.
The error received was:
You are not a member of this organization
You (email@example.com) do not belong to the organization contoso.
Verify the organization name and try to sign in again.
Error Code: notMemberOfOrg
Fortunately, Microsoft has provided a way to force AD to synchronize the user record. This feature was still in Preview at the time of this posting, but it solved our problem. Go to the PowerApps Admin Center in your tenant by clicking on the Admin icon in the Dynamics 365 App Launcher, and then click on All Admin Centers. Click on Power Apps icon to the launch the admin center.
Click on the Environment record to open it.
Click on the Security tab. Enter the email address of the user in the Step 1 box. Click Add User.
A confirmation banner will be displayed as show below. It may take a few minutes for the user to synchronize from AD, but when you click on the “list of users” link, you should see your user record in Dynamics 365 CE. Assign the appropriate security role(s) and carry on.