How to integrate Microsoft Entra ID account?

Overview

To authenticate, you will need to provide the following information:

• Client ID
• Client Secret
• Tenant ID
• Redirect URL

Step 1: Login to Microsoft Entra (Azure AD) Portal

1. Go to Microsoft Azure
2. Sign in with the Microsoft account that has access to your Entra tenant (typically an admin account).

Step 2: Register Your Application

1. Once logged in, select "App registrations" from Azure Services.
2. Click on "+ New registration".

3. Fill the registration details:

• Name: Give your app a name (e.g., Demo App)
• Supported account types: Choose
  • Accounts in any organizational directory (Any Microsoft Entra ID tenant - Multitenant)
• Redirect URI: Add your Redirect URL (e.g.,http://api.unizo.ai/callback/oauth for Unizo app or https://yourapp.unizo.ai/oauth/callback for testing)

4. Click Register.

Step 3: Get the Client ID and Tenant ID

1. After the app is registered, you will land on the app overview page.

2. Copy the following:

   • Application (client) ID → This is your Client ID
   • Directory (tenant) ID → This is your Tenant ID

   

Step 4: Generate Client Secret

1. Go to Certificates & secrets in the left sidebar

2. Under Client secrets, click + New client secret
3. Add: - Description: (e.g., App Secret) - Expires: Select an expiration duration (e.g., 6 months or 1 year)
4. Click Add
5. Copy the Value immediately — this is your Client Secret

Microsoft Graph Permissions → OAuth Flow Mapping

Permission	Type	Client Credentials (Application)	Authorization Code (Delegated)
AuditLog.Read.All	Application / Delegated	✅ (full tenant audit logs)	✅ (if user has audit log access)
Directory.Read.All	Application / Delegated	✅ (all directory read)	✅ (limited by user access, may require admin consent)
Directory.ReadWrite.All	Application / Delegated	✅	✅ (admin consent required)
Group.Read.All	Application / Delegated	✅	✅
Group.ReadWrite.All	Application / Delegated	✅	✅
RoleManagement.Read.Directory	Delegated / Application	✅	✅
RoleManagement.ReadWrite.Directory	Delegated / Application	✅	✅
Policy.Read.All	Delegated / Application	✅	✅
Policy.ReadWrite.ConditionalAccess	Delegated / Application	✅	✅
User.Read	Delegated	❌	✅
User.Read.All	Delegated / Application	✅	✅ (requires admin consent)
User.ReadWrite.All	Delegated / Application	✅	✅ (requires admin consent)
UserAuthenticationMethod.Read.All	Application	✅	❌
UserAuthenticationMethod.ReadWrite.All	Application	✅	❌

How to Add these Permissions

1. Go to API Permissions from left navigation
2. Click + Add a permission

5. Select:
   • Microsoft Graph
   • Choose:
     • Application permissions for background apps
     • Delegated permissions for signed apps
6. Add the required permissions listed above and click Add permissions

   

7. Click Grant admin consent