Directory Connection Configuration

section 1 azure registered app – graph api field description example value tenant name the azure ad tenant domain contoso onmicrosoft com application id the client id of the registered app a1b2c3d4 e5f6 7890 abcd 1234567890ef application secret the client secret generated in azure s3cr3tv\@lu3! redirect url must match the uri registered in azure https //myserver 750 select administrator group button to choose an azure ad group for admin access (click to select group) distinguished name optional ldap style name cn=activateadmins,ou=groups,dc=contoso,dc=com section 2 azure registered app – authentication field description example value same tenant name and application id as above checkbox to reuse the graph api app checked tenant name only needed if not using the same app contoso onmicrosoft com application id only needed if not using the same app f1e2d3c4 b5a6 7890 abcd 0987654321fe use default scope and redirect checkbox to auto fill scopes and redirect uri checked scopes oauth scopes for authentication a1b2c3d4 e5f6 7890 abcd 1234567890ef/ default redirect url uri for post login redirection http //localhost button test authentication verifies that the authentication configuration is working by initiating a login flow and checking token retrieval why use separate applications? activate highly recommends using separate applications for graph api access and user authentication, as it supports the principle of least privilege, which means each app is granted only the minimum permissions it needs to function for example, the authentication app only needs sign in and basic profile scopes, while the graph api app might require broader directory read or write permissions keeping these responsibilities separate reduces the risk of over permissioning, limits the impact of a potential security breach, and makes it easier to audit and manage access