App Registration for Azure Connectors

Introduction

To enable ManagementStudio connectors to access data within Azure, an App registration must be created in Azure Active Directory. The App registration defines the permissions and access rights granted to ManagementStudio. It is recommended, though not required, to create a separate App registration for each connector used.

Creating an Azure App Registration

1. Open the Azure portal.
2. Navigate to App registrations.
3. Select New registration.
   • Enter a name, such as ManagementStudio AAD Connector.
   • Choose Accounts in this organization only.
   • Leave the Redirect URI blank.

4. Click Register.

Authentication and Permissions

The required configuration varies depending on the authentication method selected: User/Password or Client Secret.

Auth: User/Pass

1. Authentication
   • Enable Enable the following mobile and desktop flows by setting it to Yes.
   • Save the settings.
2. API Permissions
   • Add permissions as Delegated permissions.
   • Refer to the lists in the Permissions section.
   • Grant admin consent for the added permissions.

Auth: Client Secret

1. Certificates & Secrets
   • In the left navigation, select Certificates & secrets.
2. 
   • Click New client secret.
3. 
   • Provide a name (e.g., ManagementStudio Secret).
   • Set Expires to 24 months (for ENGAGE assessments, set to 1 week).

4. 

5. 
   
   • Click Add.
   • Important: Record the secret Value immediately. The value is displayed once and cannot be retrieved again.
   • API Permissions
     • Select API permissions in the left navigation.
     • Add permissions as Application permissions.
     • Refer to the lists in the Permissions section.
6. 
   • Click Add permissions.

   • 

   • Grant admin consent for the added permissions.

   • 

   • Collect Required Information
     • Go to Overview.
     • Copy the Application (Client) ID.
     • Copy the Directory (tenant) ID.
     • Use the secret Value saved earlier.

Permissions

Azure AD Connector

Required Microsoft Graph Permissions

Intune Connector

Required Microsoft Graph Permissions

SMTP Email Send / Receive

Note: Only delegate access is supported for these permissions.

Required Microsoft Graph Permissions

Azure Email API

Required Azure Email API Permission

Single Sign-On

Required Microsoft Graph Permission