Registering the App in Microsoft Entra ID

Before Azure Log Connector can collect data from your Azure and Microsoft 365 environment, you must create a dedicated App Registration in the Azure Portal. This article walks through the complete setup process step by step.

---

Before you begin:

Confirm the following:

• You have access to the Azure Portal with Global Administrator or Application Administrator privileges
• You have a secure location ready to store the Client Secret value — it is only shown once
• You have completed the prerequisites checklist in the Prerequisites for Azure Log Connector article

---

Step 1 — Create the App Registration:

1. Sign in to the Azure Portal
2. In the search bar, type Microsoft Entra ID and select it
3. In the left navigation menu, click App Registrations
4. Click New Registration
5. Configure the registration:
   • Name — enter LT Auditor ^MP Azure Log Collector
   • Supported Account Types — select Accounts in this organizational directory only (Single Tenant)
   • Redirect URI — leave blank
6. Click Register

---

Step 2 — Record your Tenant ID and Client ID:

On the App Registration overview page, locate and copy the following values:

Value	Field Name in Azure Portal
Client ID	Application (client) ID
Tenant ID	Directory (tenant) ID

Store these securely — you will need them during the Azure Log Connector configuration step.

---

Step 3 — Configure API permissions:

1. In the left navigation menu, click API Permissions
2. Click Add a Permission

Add Microsoft Graph permissions:

1. Select Microsoft Graph
2. Select Application Permissions
3. Search for and add each of the following permissions:

Permission

AuditLog.Read.All

Directory.Read.All

Application.Read.All

Domain.Read.All

Files.Read.All

GroupMember.Read.All

IdentityProvider.Read.All

IdentityRiskyServicePrincipal.Read.All

IdentityRiskyUser.Read.All

Policy.Read.All

RoleManagementAlert.Read.Directory

User.Export.All

User.Read.All

UserAuthenticationMethod.Read.All

4. Click Add Permissions

Add Office 365 Management API permission:

1. Click Add a Permission again
2. Select Office 365 Management APIs
3. Select Application Permissions
4. Add the following permission:

Permission

ActivityFeed.Read

5. Click Add Permissions

After adding all permissions, the API Permissions page will list all 15 permissions with a status of Not granted.

---

Step 4 — Grant Admin Consent:

All application permissions require Admin Consent from a Global Administrator before they become active.

1. On the API Permissions page, click Grant admin consent for [Your Organization Name]
2. Click Yes to confirm
3. Confirm all 15 permissions update to show a green checkmark and status of Granted for [Your Organization Name]

If the Grant admin consent button is greyed out, you do not have sufficient privileges. Contact your Global Administrator to complete this step.

---

Step 5 — Create a Client Secret:

1. In the left navigation menu, click Certificates & Secrets
2. Click New Client Secret
3. Configure the secret:
   • Description — enter LT Auditor ^MP Collector
   • Expires — select an expiration period (recommended: 24 months)
4. Click Add

Copy the secret Value immediately. It is only displayed once. If you navigate away before copying it, you will need to delete the secret and create a new one.

Store the Client Secret securely alongside the Tenant ID and Client ID recorded in Step 2.

---

Step 6 — Verify the App Registration:

Before proceeding to installation, confirm the following:

1. The application name shows as LT Auditor ^MP Azure Log Collector
2. The Application (client) ID and Directory (tenant) ID are recorded
3. All 15 API permissions are listed and show status Granted
4. All permissions are listed as Application type — not Delegated
5. The client secret is listed with a future expiry date and the value has been copied and stored

---

Managing secret expiry:

Client secrets expire based on the duration selected at creation. To avoid service interruptions:

• Note the secret expiry date and set a reminder 30 days before it expires
• When renewal is needed, generate a new secret in Certificates & Secrets, update the Azure Log Connector configuration with the new value, and delete the old secret

[Your administrator should document the secret expiry date and assign ownership of the renewal process to ensure Azure Log Connector is not interrupted by an expired secret.]

---

Summary of values to retain:

Value	Description
Application (Client) ID	Unique identifier for the App Registration
Directory (Tenant) ID	Unique identifier for your Entra ID tenant
Client Secret Value	Secret used to authenticate the App Registration
Secret Expiry Date	Date the client secret expires — for renewal planning