Create a custom Azure Privileged Identity Management (PIM) role that includes the necessary Exchange Online and D365 permissions to configure contact syncing and message tracking in D365. Currently, to enable this on has to have BOTH the Exchange Online Administrator and CRM Administrator roles in Azure PIM. This is quite a lot of privileges just to enable account-level integration between D365 and Exchange Online.