--- title: Setup App Registrations slug: setup-app-registrations createdAt: 2025-07-15T01:26:29.274Z --- To set up Activate in your Microsoft Entra ID environment, you’ll need to create one or more app registrations. These applications allow Activate to interact with Azure services and, optionally, provide user authentication. The table below outlines each app registration and its purpose. | App Registration | Purpose | Notes | | ----------------- | -------------------------------------------------------------------- | --------------------------------------------- | | Admin Application | Enables Activate to perform Azure administration tasks | Requires elevated permissions in Azure | | Login Application | Allows end users to authenticate with Activate, both Web and Studio. | Only required if using OAuth on Web or Studio | :::hint{type="info"} It is strongly recommended to register one Admin Application per Activate instance (e.g. Production, UAT, Dev). This approach prevents exceeding Azure's maximum number of simultaneous PowerShell connections. ::: :::hint{type="info"} Azure portal layouts change frequently. The steps below are accurate at time of writing but may differ slightly from the current Azure Portal UI. ::: *** # Obtain Tenant Details ## Sign In to Azure - Sign into the **Azure Portal** using a **Global Admin account**: 👉 [https://portal.azure.com](https://portal.azure.com) *** ## Locate Tenant Details - Navigate to the **Entra ID** blade. - Click **Overview**. - Note down the following details for later: - **Tenant Name** - **Primary Domain** - **Tenant ID** *** # Setup Orchestrator Application This application is the core connector that Activate Orchestrator relies on to interact with Entra ID. It enables Activate to securely read from and write to Entra ID, powering identity lifecycle changes and access automation. ## Register a New Application - Navigate to **App registrations**. If it isn't visible on the homepage, use the **search bar** at the top. - Click **New registration**. - Enter the following details: | Field | Value | | --------------------------- | ---------------------------------------------------------------------------------------------------------------------------- | | **Name** | `Activate Orchestrator - `(This is an example, name the application appropriate to your company standards) | | **Supported account types** | Accounts in this organisational directory only *(yourTenantName – Single tenant)* | | **Redirect URI (optional)** | (Leave blank) | - Click **Register**. - Record the **Application (client) **ID for later ## Configure API Permissions - Select **API permissions** in the left-hand menu. - Click **Add a permission**. - Select **Microsoft Graph**. - Choose **Application permissions**. - Click **Add a permission **and select appropriate permissions - `User.Read.All` – Read users - `Group.Read.All` – Read groups - `RoleManagement.Read.Directory` – Role synchronisation :::hint{type="info"} For more information on Azure permissions required for your project, refer to\:For more information on Azure permissions required for your project, refer to [Microsoft Graph Permissions Reference ](https://learn.microsoft.com/en-us/graph/permissions-reference)and [Permissions](docId\:R3L2moI_KMloIEqFiuZ2-) ::: - Then click **Grant admin consent for your TenantName**, and confirm by clicking **Yes**. :::hint{type="info"} The consent status may take a few minutes to appear on the API permissions screen. ::: ## Create a Client Secret - Navigate to **Certificates & secrets** in the left menu. - Click **New client secret**. - Enter a **description**. - Select an appropriate **expiry period** (note the expiry date as the secret will need renewal for continued integration). - Click **Add**. - **Copy the client secret value**. It is only visible in full for a short time before it becomes obfuscated, if it does before you are able to copy it, delete the secret and create new one. :::hint{type="warning"} If the secret value starts with an `=`** sign**, please delete it and generate a new one. Secrets starting with `=` can cause unexpected issues. ::: *** # Setup Login Application Activate uses a separate application to authenticate users when they are using the Web or Studio components of Activate. This is a basic application, used only to authenticate the user, no additional permissions are required. :::hint{type="info"} This step is only required if you are using OAuth authentication for Web or Studio authentication. ::: ## Register new Application - Navigate to **App registrations**. If it isn't visible on the homepage, use the **search bar** at the top. - Click **New registration**. - Enter the following details: | Field | Value | | --------------------------- | --------------------------------------------------------------------------------------------------------------------- | | **Name** | `Activate Login - `(This is an example, name the application appropriate to your company standards) | | **Supported account types** | Accounts in this organisational directory only *(yourTenantName – Single tenant)* | | **Redirect URI (optional)** | (Leave blank) | - Click **Register**. - Note down the **Application (client) ID **for later. - Click **API permissions** - Click **Grant admin consent for MSFT** - Click **Yes** :::hint{type="info"} It is recommended that Assignment Required is enabled for this application to control who has access to Activate. See [How to enable Assignment Required](docId:6tcndOL1l7YrpIQkEw3E4) for more information. ::: ## Configure Web Authentication - Navigate to the Authentication section of the Login application registration - Click Add a platform - Select **Single-page application** - Enter the **Redirect URI**, this will be the URI that your end users use to access Activate Web, e.g. https\://example.com. Retain this value, you'll need it later to configure Activate. - Click **Configure** - Note down the **Application (client) ID **for later. ## Configure Studio Authentication :::hint{type="info"} This is currently only required for cloud-only environments that require OAuth authentication for Activate Studio ::: - Navigate to the Authentication section of the Login application registration - Click **Add a platform** - Select **Mobile and desktop applications** - Enter a **Redirect URI **of http\://localhost - Click **Configure** - Note down the **Application (client) ID **for later. ****