Skip to main content

How-to Register Your Application

Microsoft packages — Teams, Outlook, OneDrive, SharePoint — authenticate through the Microsoft Graph API, and Graph needs an app registration. This is how you create one.

Azure Active Directory is now Microsoft Entra ID

Microsoft renamed Azure AD to Microsoft Entra ID in 2023. The service, its app registrations and every existing id are unchanged — only the name and where it sits in the portal's navigation. Older guides, including this one until recently, tell you to look for "Azure Active Directory"; look for Microsoft Entra ID instead.

App Registration​

  1. Sign in to the Azure portal.

  2. Search for Microsoft Entra ID in the portal's top search bar, or find it under All services. (This is the step that used to say Azure Active Directory.)

  3. Click App registrations in the Microsoft Entra ID page.

    App registrations

  4. Click New registration in the top navigation bar.

    New registration

  5. Give your application a Name.

  6. Choose the supported account types, then click Register.

    Create the app

    Which account type

    Single tenant if the automation only touches your own organisation — the usual answer, and the most restrictive. Multitenant only if it genuinely has to work across organisations.

  7. Open the app's Manifest and update the replyUrlsWithType field as shown, then Save.

    The app manifest

    note

    The manifest editor has been through more than one format. If what you see does not match the screenshot, the same setting is available under Authentication → Redirect URIs, which is the more reliable route.

API Permissions for Microsoft Graph​

  1. In your application, click API permissions in the left-hand navigation.

    API permissions

  2. Click Add a permission.

  3. Select Microsoft Graph.

    Microsoft Graph

  4. Select Delegated permissions.

    Delegated permissions

  5. Choose the permissions your automation needs.

  6. Click Add permissions.

  7. Grant admin consent if your tenant requires it — many do, and without it the flow fails at run time with an authorisation error rather than at registration.

Ask for the least you need

Permissions are easy to add later and awkward to justify in a security review. Start with the narrowest scope that works — Mail.Send rather than Mail.ReadWrite, and delegated rather than application permissions unless the flow must run with no signed-in user.

Next​

You will need the Application (client) ID, the Directory (tenant) ID and a client secret to authenticate. Creating the secret and storing it safely is covered in Microsoft Teams, and the secret belongs in a vault rather than in a node property.