Ryan, thanks for all the ideas. It looks like I forgot to select DynamicsCRM role under "User Access" to let it access the app. Apparently this checkbox fixes my issue. More details here:
Robertson, you mention another app in the catalog that provides federation for MS Dynamics CRM. There are three apps listed: MS Dynamics CRM (WS-Fed), MS Dynamics CRM Live and MS Dynamics CRM onMicrosoft. I try MS Dynamics CRM (WS-Fed) but I cannot find Provisioning / Role mapping settings for this app. Should I use another app?
So I use Office 365 app now for both O365 E3 / E4 and Dynamics CRM. Should I leave it this way? Or is there a better way?