Skip to main content

Create a New Azure App Registration

tip

This guide should only be performed once per Azure Tenant.
The App Registration should be created in the same tenant where the Azure Subscriptions are located.

important

In order to allow Microsoft 365 License optimization, you must grant admin consent for the Directory.Read.All, the Agreement.Read.All, the AuditLog.Read.All and the Reports.Read.All permissions. (Steps 5 to 18 in the Azure Portal method)

This guide will walk you through the process of creating a new Azure App Registration in your Azure Tenant.

Prerequisites​

In order to create a new Azure App Registration, you need the following prerequisites:

  • An Active Azure Tenant.
  • The following permissions Microsoft Entra ID Permissions:
    • microsoft.directory/applications/createAsOwner
    • microsoft.directory/oAuth2PermissionGrants/createAsOwner
    • microsoft.directory/servicePrincipals/createAsOwner
    • microsoft.directory/servicePrincipals/managePermissionGrantsForAll.microsoft-company-admin (the listed permissions are part of the Application Administrator role)
  • If you have Conditional Access Policies enabled, you need to ensure that the App Registration can bypass the policies.
    (Please contact our support for more information)

Instructions​

To create Chronom's App Registration, follow the steps below:

  1. Browse to the Application Registration Creation page in the Azure Portal.
    (Make sure you are logged in to the correct Azure Tenant)

    tip

    If the link does not work, you can navigate to the Entra ID service and click on the App registrations section inside Azure Portal,
    then click on the + New registration button.

  2. Fill in the following details:

    • Name: Chronom Read-Only App Registration
    • Supported account types: Accounts in this organizational directory only (Microsoft only - Single tenant)
    • Redirect URI:
      • Platform: web
      • URI: https://app.chronom.ai
    • Click on the Register button.

    Create App Registration

  3. Once the App Registration is created, Take note of the following details:

    • Application (client) ID
    • Directory (tenant) ID

    App Registration Details

    note

    After the initial creation, an enterprise application is created automatically. To configure API permissions and client secrets, you need to navigate to the App Registration. You can find it by going to Entra ID → App registrations → Chronom Read-Only App Registration, or by staying on the current page after registration.

  4. Navigate to the API permissions section under the Manage on the left-hand side menu.
    (If you already have the User.Read permission, you can skip to step 9.)

    API Permissions

  5. Click on the + Add a permission button and select Microsoft Graph from the list of APIs.

    Add Microsoft Graph Permission

  6. Select Delegated permissions and search for User.Read in the search bar.

    Select Delegated Permissions

  7. Under the User category, select the User.Read permission and click on the Add permissions button.

    Add User.Read Permission

  8. Click on the + Add a permission button and select Microsoft Graph from the list of APIs.

    Add Microsoft Graph Permission

  9. Select Application permissions and search for Directory.Read.All in the search bar.

    Select Application Permissions

  10. Under the Directory category, select the Directory.Read.All permission and click on the Add permissions button.

    Add Directory.Read.All Permission

  11. Click on the + Add a permission button and select Microsoft Graph from the list of APIs.

    Add Microsoft Graph Permission

  12. Select Application permissions and search for Agreement.Read.All in the search bar.

  13. Under the Policy category, select the Agreement.Read.All permission and click on the Add permissions button.

  14. Click on the + Add a permission button and select Microsoft Graph from the list of APIs.

    Add Microsoft Graph Permission

  15. Select Application permissions and search for AuditLog.Read.All in the search bar.

  16. Under the Audit Logs category, select the AuditLog.Read.All permission and click on the Add permissions button.

    Add AuditLog.Read.All Permission

  17. Click on the + Add a permission button and select Microsoft Graph from the list of APIs.

    Add Microsoft Graph Permission

  18. Select Application permissions and search for Reports.Read.All in the search bar.

  19. Under the Reports category, select the Reports.Read.All permission and click on the Add permissions button.

  20. Click on the Grant admin consent for <Your Tenant> button to grant the permissions and confirm by clicking Yes.

    Grant Admin Consent

  21. Navigate to the Certificates & secrets section under the Manage on the left-hand side menu.

    Certificates &amp; Secrets

  22. Click on the + New client secret button under the Client secrets tab and fill in the following details:

  • Description: Chronom Read-Only Secret
  • Expires: 730 days (24 months)
  • Click on the Add button.

Create Client Secret

  1. Once the secret is created, take note of the Value as it will be used to authenticate the App Registration in Chronom.
danger

Handle with Extreme Care!
Client Secret is considered a highly sensitive credential.
Make sure to store it in a secure location and only share it via Chronom's Integrations Page.
Chronom will never ask you for your Client Secret via email or any other communication channel.
Do not share your Client Secret with anyone else.

note

The Client Secret is only displayed once after creation.

Client Secret Value 24. On a new tab, navigate to Chronom's Integrations Page and click on the + Add a new Tenant button.

Add New Tenant 25. Fill in the Details and click on the Save button:

  • Tenant Name: The name of the Azure Tenant where the App Registration was created.
  • Tenant ID: The Directory (tenant) ID of the App Registration.
  • Application ID: The Application (client) ID of the App Registration.
  • Client Secret: The Value of the Client Secret created in the previous step.

Add Tenant Details

note

After adding your Azure Tenant and saving the details, you are ready to proceed to the next stage: connecting your Management Group(s) or Subscription(s) to Chronom.

tip

Continue to the Add Subscription guide to complete the integration process.

tip

Continue to the Add Management Group guide to complete the integration process.