Create the Entra ID App Yourself
4 minute read
Docusnap creates the application required for the Microsoft 365 inventory in a wizard-guided process and equips it with all necessary permissions, secrets and certificates (see Create Azure Apps).
If this is not possible in the tenant — for example because of applicable policies or a missing role — the application must be created directly in Entra ID. This chapter describes how it has to be configured so that the full inventory scope is available.
This chapter is intended for administrators who are familiar with Entra ID. It names the settings that Docusnap requires. It describes how to create and authorize the Entra ID app for the Microsoft 365 inventory. If mailbox permissions and public folders are to be inventoried as well, the app is subsequently extended by a certificate and the corresponding rights.
Microsoft 365 inventory
All steps are performed in the Microsoft Entra admin center under App registrations.
1. Register the app
Select New registration and assign a name of your choice.
2. Assign API permissions
All permissions originate from Microsoft Graph and are granted as application permissions — with the exception of User.Read, which is selected in the same dialog under Delegated permissions. If a single permission is missing, the affected area is inventoried incompletely.
| Area | Permissions |
|---|---|
| Directory, users and devices | Directory.Read.All, Organization.Read.All, User.Read.All, UserAuthenticationMethod.Read.All, GroupMember.Read.All, RoleManagement.Read.Directory, Policy.Read.All, Application.Read.All, AppCatalog.Read.All, Device.Read.All, AuditLog.Read.All, Reports.Read.All |
| Teams | Team.ReadBasic.All, TeamMember.Read.All, TeamSettings.Read.All, Channel.ReadBasic.All, ChannelMember.Read.All, ChannelSettings.Read.All, TeamsTab.Read.All, TeamworkDevice.Read.All, TeamworkTag.Read.All |
| SharePoint and OneDrive | Sites.Read.All, Sites.FullControl.All, SharePointTenantSettings.Read.All, Files.Read.All |
| Exchange Online | Mail.ReadBasic, MailboxSettings.Read, Calendars.Read, Contacts.Read |
| Sign-in | User.Read (delegated) |
Then select Grant admin consent. Without consent, the permissions have no effect.
3. Create a client secret
Copy the value of the client secret immediately.
4. Enter the details in Docusnap
The application ID and the directory ID are shown in the Overview of the app. Together with the secret, they are entered in Docusnap: Add Azure Apps Manually.
Mailbox permissions and public folders
For mailbox permissions, mailbox folder permissions as well as public folders and their permissions, the client secret is not sufficient. The app additionally requires a certificate, a permission outside of Microsoft Graph and a role assignment.
1. Provide a certificate
A self-signed certificate, a certificate from your own PKI or one issued by a commercial certification authority can be used. The requirements for the X.509 certificate are an exportable private key as .pfx and the public certificate as .cer.
-KeySpec KeyExchange parameter in the following example ensures this.If no suitable certificate is available, it can be created in an elevated PowerShell session:
# Create a self-signed certificate
$cert = New-SelfSignedCertificate -DnsName "docusnap.contoso.com" `
-CertStoreLocation "cert:\CurrentUser\My" `
-NotAfter (Get-Date).AddYears(1) `
-KeySpec KeyExchange
# Export the private key as PFX (for Docusnap)
$cert | Export-PfxCertificate -FilePath docusnap.pfx -Password (Get-Credential).password
# Export the public certificate as CER (for Entra ID)
$cert | Export-Certificate -FilePath docusnap.cer
2. Attach the certificate to the app
In the app, open Certificates & secrets and the Certificates tab, select Upload certificate and add the .cer file. The private key is not uploaded — it remains with Docusnap as a .pfx file.
3. Add the Exchange permission
Access to Exchange resources requires the application permission Exchange.ManageAsApp from the Office 365 Exchange Online API.
Then select Application permissions, set Exchange.ManageAsApp and select Grant admin consent again.
4. Assign the role
In addition to the permission, the app requires a role in Entra ID. Docusnap uses the Exchange Recipient Administrator for this purpose; Microsoft lists this role as supported.
The assignment is performed in the Microsoft Entra admin center under Roles and administrators: select the role, choose Add assignments, select Service principals in the selection dialog and mark the app.
5. Add the details in Docusnap
In addition to the application ID, directory ID and secret, the .pfx file and the password assigned for it are entered: Add Azure Apps Manually.