Entra ID App Registration for Microsoft Graph

Steps to Complete

~10

Minutes to Complete

Read-Only

Permissions Required

Prerequisites

✅ What You Need Before Starting

An active Microsoft 365 tenant with admin access
A user account with Global Administrator or Application Administrator role in Entra ID
Access to the Azure Portal at portal.azure.com or entra.microsoft.com
The Aiyoda console installed and ready to configure

Step-by-Step App Registration

Navigate to App Registrations

Open the Azure Portal and go to Microsoft Entra ID

🌐 portal.azure.com› Microsoft Entra ID› App registrations› + New registration

In the search bar at the top, type "Microsoft Entra ID" and select it.

In the left sidebar, click "App registrations" under the Manage section.

Click the "+ New registration" button at the top of the page.

Register the Application

Fill in the app details and create the registration

Name: Enter a meaningful name, e.g. "Aiyoda-Discovery"

Supported account types: Select "Accounts in this organizational directory only (Single tenant)"

Redirect URI: Leave this blank, Aiyoda uses client credentials flow (no user redirect needed)

Click the "Register" button to create the app.

💡 After registering, you will land on the app's Overview page. Copy and save the Application (client) ID and Directory (tenant) ID, you'll need these for the Aiyoda configuration.

Create a Client Secret

Generate credentials for Aiyoda to authenticate with

App Overview› Certificates & secrets› + New client secret

In the left sidebar click "Certificates & secrets" under Manage.

Click "+ New client secret".

Description: Enter "Aiyoda Secret" (or similar).

Expires: Select an appropriate expiry period.12 months (recommended).

Click "Add". Immediately copy the Secret Value shown as it will be hidden after you leave this page.

⚠️ Important: Copy the secret Value immediately. Once you navigate away from this page, the full value is hidden and you will need to create a new secret.

Assign Graph API Permissions

Grant Aiyoda the read-only permissions it needs

App Overview› API permissions› + Add a permission› Microsoft Graph

Click "API permissions" in the left sidebar.

Click "+ Add a permission" → Select "Microsoft Graph" → Select "Application permissions".

Search and add each of the required permissions listed in the table below.

Click "Add permissions" to save, then click "Grant admin consent for [your tenant]" and confirm.

Permission	Type	Purpose
User.Read.All	Application	Read all users in your M365 tenant
Device.Read.All	Application	Read all devices in your M365 tenant
Directory.Read.All	Application	Read directory data (users, groups, devices)
Organization.Read.All	Application	Read organization/tenant information
DeviceManagementApps.Read.All	Application	Read Microsoft Intune apps
DeviceManagementManagedDevices.Read.All	Application	Read Intune managed device inventory
AuditLog.Read.All	Application	Read audit log data for licence compliance
Subscription.Read.All	Delegated	Read licence assignments for users
IdentityRiskyUser.Read.All	Application	Read all identity risky user information
Policy.Read.ConditionalAccess	Application	Read your organization's conditional access policies
Policy.Read.All	Application	Read your organization's policies
Reports.Read.All	Application	Read all usage reports
SecurityEvents.Read.All	Application	Read your organization’s security events
Sites.Read.All	Application	Read items in all site collections
UserAuthenticationMethod.Read.All	Application	Read all users' authentication methods
ReportSettings.Read.All	Application	Read all admin report settings

⚠️ Admin consent required: Application permissions require a Global Administrator to click "Grant admin consent". Without this step, the app will receive authentication errors.

Configure Aiyoda with Your App Details

Enter the details into the Aiyoda console

In the Aiyoda console, navigate to the Microsoft 365 Scan configuration and enter the following values collected from the previous steps:

                        Tenant ID     : xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx  // From App Overview → Directory (tenant) ID
                        Client ID     : xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx  // From App Overview → Application (client) ID
                        Client Secret : your-secret-value-here               // From Certificates & secrets → Value
                    

Open the Aiyoda Console and navigate to Scan Settings → Microsoft 365.

Paste your Tenant ID, Client ID, and Client Secret into the respective fields.

Click "Test Connection" to verify Aiyoda can authenticate successfully.

Once the connection test passes, you can run a Microsoft 365 Discovery.

✅ Success indicator: After a successful connection test you are now ready to scan your M365 environment.

Security Best Practices

Keeping Your App Secure

Rotate secrets regularly — Set calendar reminders before expiry (12 months recommended)
Limit permissions — Only grant the permissions listed above, nothing more
Store secrets securely — Never store the client secret in plain text or source control
Monitor sign-ins — Review the app's sign-in logs in Entra ID periodically
Dedicated app — Use a dedicated registration for Aiyoda only

Troubleshooting Common Issues

401 Unauthorized — Check that admin consent was granted for all permissions
403 Forbidden — A required permission may be missing from the list
Secret expired — Create a new client secret and update Aiyoda config
Invalid tenant — Verify the Tenant ID matches your M365 directory
Consent not granted — Global Admin must approve permissions in Entra ID