Entra ID App Registration for Azure
Step-by-step guide to creating an Entra ID App Registration for Aiyoda's Azure discovery capabilities.
v3.5 · Updated 2026
Step-by-step guide to creating an Entra ID App Registration for Aiyoda's Azure discovery capabilities.
Open the Azure Portal and go to Microsoft Entra ID
Sign in to portal.azure.com with your admin account.
In the search bar at the top, type "Microsoft Entra ID" and select it.
In the left sidebar, click "App registrations" under the Manage section.
Click the "+ New registration" button at the top of the page.
Fill in the app details and create the registration
Name: Enter a meaningful name, e.g. "Aiyoda-Discovery"
Supported account types: Select "Accounts in this organizational directory only (Single tenant)"
Redirect URI: Leave this blank, Aiyoda uses client credentials flow (no user redirect needed)
Click the "Register" button to create the app.
Generate credentials for Aiyoda to authenticate with
In the left sidebar click "Certificates & secrets" under Manage.
Click "+ New client secret".
Description: Enter "Aiyoda Secret" (or similar).
Expires: Select an appropriate expiry period.12 months (recommended).
Click "Add". Immediately copy the Secret Value shown as it will be hidden after you leave this page.
Grant subscription-level read access via Management Groups
In the Azure Portal search bar type "Management Groups" and select it.
Select "Tenant Root Group" (or the root group of your tenant).
Click "Access Control (IAM)" in the left sidebar, then click "+ Add" → "Add role assignment".
Search for the role, select it, then click "Next". Under Members click "+ Select members", search for your app registration by name (e.g. "Aiyoda-Discovery"), select it, then click "Review + assign".
Repeat for both roles in the table below.
Grant access to Reserved Instance data — this must be done via the Reservations blade, not Management Groups
Microsoft.Capacity — a tenant-level provider scope that is not covered by Management Group IAM. The Reservations Reader role must be assigned directly inside the Reservations blade.In the Azure Portal search bar type "Reservations" and select it.
Click on any reservation in the list to open it.
In the left sidebar click "Access Control (IAM)".
Click "+ Add" → "Add role assignment".
Search for "Reservations Reader", select it, then click "Next".
Under Members click "+ Select members", search for your app registration (e.g. "Aiyoda-Discovery"), select it, then click "Review + assign".
Repeat for each reservation order if you need to grant per-order access, or use the PowerShell method below to assign it at the full capacity scope in one step.
Alternative: Assign via PowerShell (covers all reservations at once)
Enter the details into the Aiyoda portal
In the Aiyoda portal, navigate to the Horizon Azure API configuration and enter the following values collected from the previous steps:
Login to the Aiyoda Portal and navigate to Horizon → Azure Api.
Paste your Tenant ID, Client ID, and Client Secret into the respective fields.
Click "Test Connection" to verify Aiyoda can authenticate successfully.
Once the connection test passes, you can run an Azure Discovery.