App registration

The steps in the Microsoft Entra admin center

CA Policy Manager signs in through an app registered in your tenant. You do this once, at the start. Client secrets and certificates are not used.

Prerequisites

• License: Microsoft Entra ID P1 or P2
• Role of the user who signs in: Global Reader is recommended. It can read the Conditional Access results and every policy property. With Reports Reader alone, the applied policy information is left out of the response.
• Admin consent: a Privileged Role Administrator grants it.

1. Register the app

1. In the Microsoft Entra admin center, open Entra ID > App registrations > New registration.
2. Enter a Name (for example, CA Policy Manager).
3. Under Supported account types, select the type that covers only your organization's tenant, then register.

2. Add the redirect URIs

1. In the registered app, open Authentication > Redirect URI configuration > Add Redirect URI > Mobile and desktop applications > Custom redirect URIs > Configure.
2. Add these two URIs and save. Replace <client ID> with the Application (client) ID shown on Overview.
   • ms-appx-web://microsoft.aad.brokerplugin/<client ID> (used for a normal sign-in)
   • https://login.microsoftonline.com/common/oauth2/nativeclient (used when the sign-in shows a browser)

3. Add the permissions

Open API permissions > Add a permission > Microsoft Graph > Delegated permissions, select these permissions, then select Add permissions. These are the permissions the app shows in its connection settings.

Permission	Type	Used for
AuditLog.Read.All	Required	Reading sign-in logs
Policy.Read.All	Required	Reading Conditional Access policy definitions and named locations
User.Read.All	Required	Reading users' group membership and type (such as guest)
Application.Read.All	Optional	Reading application display names. All other features remain available without it.
GroupMember.Read.All	Optional	Reading group names, members, and parent groups. All other features remain available without it.

4. Grant admin consent

Under API permissions, select Grant admin consent for {tenant}. A Privileged Role Administrator does this. The app asks for consent to optional permissions when they are needed.

5. Note the IDs

Note the Application (client) ID and the Directory (tenant) ID shown on Overview, and enter them in the connection settings.

Last updated: 2026-11-03