Entra ID App Registration for Microsoft Graph
Step-by-step guide to creating an Entra ID App Registration for Aiyoda's Microsoft 365 Graph discovery capabilities.
v3.6 · Updated 2026
Step-by-step guide to creating an Entra ID App Registration for Aiyoda's Microsoft 365 Graph discovery capabilities.
Open the Azure Portal and go to Microsoft Entra ID
Sign in to portal.azure.com with your admin account.
In the search bar at the top, type "Microsoft Entra ID" and select it.
In the left sidebar, click "App registrations" under the Manage section.
Click the "+ New registration" button at the top of the page.
Fill in the app details and create the registration
Name: Enter a meaningful name, e.g. "Aiyoda-Discovery"
Supported account types: Select "Accounts in this organizational directory only (Single tenant)"
Redirect URI: Leave this blank, Aiyoda uses client credentials flow (no user redirect needed)
Click the "Register" button to create the app.
Generate credentials for Aiyoda to authenticate with
In the left sidebar click "Certificates & secrets" under Manage.
Click "+ New client secret".
Description: Enter "Aiyoda Secret" (or similar).
Expires: Select an appropriate expiry period.12 months (recommended).
Click "Add". Immediately copy the Secret Value shown as it will be hidden after you leave this page.
Grant Aiyoda the read-only permissions it needs
Click "API permissions" in the left sidebar.
Click "+ Add a permission" → Select "Microsoft Graph" → Select "Application permissions".
Search and add each of the required permissions listed in the table below.
Click "Add permissions" to save, then click "Grant admin consent for [your tenant]" and confirm.
Enable Power Apps, Power Automate and Power BI discovery for the Power Platform Insights dashboard
Power Platform and Power BI are administered separately from Microsoft Graph, so they use their own access grant rather than an API permission. Both use the same Client ID and Client Secret from Step 3, so no new credentials are needed.
In Microsoft Entra ID, go to Roles and administrators and search for "Power Platform Administrator".
Click "+ Add assignment", search for the app registration by name (e.g. "Aiyoda-Discovery"), and select it.
The role alone is not enough for an app — the Power Platform admin APIs also require it to be registered as a management app. A Global Administrator or Power Platform Administrator runs the following once in Windows PowerShell, signing in when prompted and replacing the ID with the app's Application (client) ID from Step 3:
Confirm the registration with Get-PowerAppManagementApps — the app's client ID should be listed. Together with the role, this lets Aiyoda read environments, Power Apps and Power Automate flows through the Power Platform admin APIs.
In the Fabric admin portal, open Tenant settings → Admin API settings and enable "Service principals can access read-only admin APIs." This is not the similarly named "Service principals can use Fabric APIs" under Developer settings.
Apply the setting to a security group, then add this app registration's service principal to that group.
This lets Aiyoda read workspaces, reports, datasets, dashboards and viewer activity through the Power BI admin APIs.
Enter the details into the Aiyoda console
In the Aiyoda console, navigate to the Microsoft 365 Scan configuration and enter the following values collected from the previous steps:
Open the Aiyoda Console and navigate to Scan Settings → Microsoft 365.
Paste your Tenant ID, Client ID, and Client Secret into the respective fields.
Click "Test Connection" to verify Aiyoda can authenticate successfully.
Once the connection test passes, you can run a Microsoft 365 Discovery.