Skip to main content

Register an app in Microsoft Entra ID

Privilege Secure manages a Microsoft Entra ID tenant through an app registration. You create the registration in the Microsoft Entra admin center, then enter its values in Privilege Secure as a service account and a tenant resource.

This task needs three values from Entra ID:

ValueUsed for
Application (client) IDThe App ID of the Entra ID service account.
Client secret valueThe App Secret of the Entra ID service account.
Directory (tenant) IDThe Tenant ID when you add the tenant as a resource.

Prerequisites​

  • You can sign in to Microsoft Entra ID as an administrator who can register applications, grant admin consent, and assign directory roles.
  • You have the Administrator role in Privilege Secure.

Create the app registration​

  1. In the Microsoft Entra admin center, go to Entra ID > App registrations.

  2. Click New registration.

  3. Enter a name, for example Privilege Secure. Keep the default settings, and click Register.

  4. Under Manage, click API permissions.

  5. Add these Microsoft Graph Application permissions:

    • Directory.ReadWrite.All
    • Group.ReadWrite.All
    • GroupMember.ReadWrite.All
    • RoleManagement.ReadWrite.Directory
    • User-PasswordProfile.ReadWrite.All
    • User.EnableDisableAccount.All
    • User.ReadWrite.All
    • UserAuthenticationMethod.ReadWrite.All

  6. Click Grant admin consent.

After consent succeeds, the Configured permissions page shows the message "Successfully granted admin consent for the requested permissions".

Create a client secret​

  1. In the app registration, click Certificates & secrets.
  2. Click New client secret.
  3. Enter a description, choose an expiration date, and click Add.
  4. Copy the secret Value before you leave the page. Entra ID doesn't show it again.
  5. Open the Overview page, and copy the Application (client) ID and the Directory (tenant) ID.

Note the expiration date. Before the secret expires, create a new secret and enter it in App Secret on the service account.

Assign directory roles to the app​

Assign the app registration to two Entra roles. Repeat these steps for each role.

  1. Go to Entra ID > Roles & administrators.
  2. Click the role name, User Administrator or Privileged Authentication Administrator. Don't select the checkbox next to the name.
  3. Click Add assignments.
  4. Under Select members, click No member selected, search for the app registration, click it, and click Select.
  5. Click Next. Set Assignment type to Active and Duration to Permanently assigned, enter a justification, and click Assign.
note

User Administrator is the least privileged option and can't manage Global Administrator accounts. To manage the Global Administrator role, assign the Global Administrator role to the app registration instead of User Administrator.

To rotate passwords of accounts that hold administrator roles, the app registration needs Privileged Authentication Administrator (or Global Administrator). User Administrator covers accounts that hold no administrator role. Deployments set up before 2026 may not have needed it, so add it to older registrations.

note

Microsoft allows User Administrator to reset passwords for users who have no administrator role and for a small set of low-privilege roles. Resetting the password of a Global Administrator or most other administrator roles needs Privileged Authentication Administrator or Global Administrator. Password Administrator can reset a subset of what User Administrator can reset, so it adds nothing to either role. If rotation fails with a permissions error, check the roles assigned to the app registration against the target account's roles. See Microsoft Entra roles.

Add the service account and the tenant​

  1. In Privilege Secure, select Configuration > Service Accounts, and click +.
  2. Set Platform to Entra ID.
  3. Enter the App ID (the application client ID) and the App Secret (the client secret value), and click Save. See Service accounts.
  4. Add the tenant as a resource with the Tenant ID and this service account. See Microsoft Entra ID tenants.

Rotate passwords in a hybrid tenant​

To rotate the passwords of accounts in a hybrid Entra ID tenant, turn on password writeback in Microsoft Entra ID. With writeback on, a password change in either on-premises Active Directory or Entra ID syncs to the other. Without it, every password change for a hybrid account fails.

Password writeback isn't specific to Privilege Secure. See Tutorial: Enable Microsoft Entra self-service password reset writeback to an on-premises environment in the Microsoft documentation.