--- title: Entra ID Application Registration slug: entra-id-application-registration createdAt: 2025-08-06T19:49:22.551Z --- To manage Exchange Online (EXO) through Microsoft Graph for Exchange Online Powershell, Activate requires an application registration in Microsoft Entra ID with the right permissions. This guide walks you through creating and configuring that registration—ensuring secure, delegated access that keeps everything running smoothly behind the scenes. # Create a new App Registration. Login to Azure Portal as an appropriate administrator. Create new application registration, name this **\ - EXO** or according to your organisation naming standards. # API Permissions When using **App-Only authentication** to perform **Exchange Online PowerShell or Graph API operations**, you must: ### 1. Assign the correct Azure AD Directory Role For access to **mailboxes**, **shared mailboxes**, or EXO PowerShell, you must assign one of the following **Azure AD roles** to the application: | Scenario | Required Azure AD Role | | ---------------------------------------------- | -------------------------------------------------------------------------------------------------- | | Read-only mailbox access (Graph) | **Exchange Administrator** OR **Global Reader** | | Full access to mailboxes (Graph or PowerShell) | **Exchange Administrator** | | EXO PowerShell App-Only | **Exchange Administrator** (with **AppId** granted **ApplicationAccessPolicy** if scoping is used) | Assign this via: - Azure Portal > Entra ID > Roles and administrators - Find **Exchange Administrator** - Click **Add assignments** - Select **your app’s service principal** ### 2. Ensure Exchange Online Application Permissions Are Granted Go to: - **Azure Portal > App Registrations > Your App > API permissions** - Ensure you have **Exchange.ManageAsApp** permission added under **APIs my organization uses > Office 365 Exchange Online > Application Permissions** - Also, click **Grant admin consent** **for \ **after adding this permission.