---
title: Directory Connection Configuration
slug: directory-connection-configuration
createdAt: 2025-07-23T21:39:29.650Z
---



## Section 1: Azure Registered App – Graph API

| Field                      | Description                                          | Example Value                                 |
| -------------------------- | ---------------------------------------------------- | --------------------------------------------- |
| Tenant Name                | The Azure AD tenant domain.                          | contoso.onmicrosoft.com                       |
| Application ID             | The Client ID of the registered app.                 | a1b2c3d4-e5f6-7890-abcd-1234567890ef          |
| Application Secret         | The client secret generated in Azure.                | s3cr3tV\@lu3!                                 |
| Redirect URL               | Must match the URI registered in Azure.              | https\://myserver:750                         |
| Select Administrator Group | Button to choose an Azure AD group for admin access. | (Click to select group)                       |
| Distinguished Name         | Optional LDAP-style name.                            | CN=ActivateAdmins,OU=Groups,DC=contoso,DC=com |

## Section 2: Azure Registered App – Authentication

| Field                                        | Description                                    | Example Value                                 |
| -------------------------------------------- | ---------------------------------------------- | --------------------------------------------- |
| Same tenant name and application ID as above | Checkbox to reuse the Graph API app.           | Checked                                       |
| Tenant Name                                  | Only needed if not using the same app.         | contoso.onmicrosoft.com                       |
| Application ID                               | Only needed if not using the same app.         | f1e2d3c4-b5a6-7890-abcd-0987654321fe          |
| Use default scope and redirect               | Checkbox to auto-fill scopes and redirect URI. | Checked                                       |
| Scopes                                       | OAuth scopes for authentication.               | a1b2c3d4-e5f6-7890-abcd-1234567890ef/.default |
| Redirect URL                                 | URI for post-login redirection.                | http\://localhost                             |

## Button: Test Authentication

Verifies that the authentication configuration is working by initiating a login flow and checking token retrieval.

## Why Use Separate Applications?

Activate highly recommends using separate applications for Graph API access and user authentication, as it supports the principle of least privilege, which means each app is granted only the minimum permissions it needs to function. For example, the authentication app only needs sign-in and basic profile scopes, while the Graph API app might require broader directory read or write permissions. Keeping these responsibilities separate reduces the risk of over-permissioning, limits the impact of a potential security breach, and makes it easier to audit and manage access.