The Microsoft Dynamics CRM team recently published an article entitled
If you have a large organization and use AD to manage your users and groups, setting up synchronization will help you avoid the need to manage multiple user accounts and passwords. Your
With SSO set up, users will not need to enter a user name and password to access Microsoft Dynamics CRM Online. When they go to the CRM Online website, users will be automatically authenticated with their existing AD credentials.
DirSync is the tool you use to control and manage user accounts by using AD users and computers. Many of the attributes from your local AD global address list (GAL) can be automatically synchronized with Microsoft CRM Online.
You can also use the DirSync tool to control multiple CRM organizations via AD security groups. For example, you may have a test instance of CRM that you don't want all of your employees with a CRM license to be able to access. The CRM Online Instance Picker enables you to control which users have access to each CRM instance by specifying AD security groups.
For more detail and system requirements for using DirSync, see the linked article.