Skip to content

Create Azure App Registration

Synchronizing data from Intune, Azure AD, Log Analytics, and other cloud data sources is done using application permissions. Here we are configuring the permissions required for Power BI to connect to the data sources to get the data.

Prerequisites: The user performing this step requires Global Admin and Subscription Admin rights.

Step 1: Open App registrations in Azure

  1. Log in to portal.azure.com or entra.microsoft.com using a global administrator account.
  2. Search for and select App registrations.
  3. Select New registration.

Step 2: Register a new application

  1. Enter a Name for the application. (This will not be seen by anyone other than admins.)
  2. Specify who can use the application as Accounts in this organizational directory only.
  3. Select Register.

Step 3: Navigate to API Permissions

  1. On the Enterprise App page select API Permissions.

Step 4: Remove the User.Read permission

  1. Remove the User.Read permission.

Step 5: Confirm permission removal

  1. When prompted to remove the permission, select Yes, remove.

Step 6: Add a new permission

  1. Select Add a permission.

Step 7: Select Microsoft Graph

  1. Select Microsoft Graph.

Step 8: Select Application permissions

  1. Select Application permissions.

Step 9: Add DeviceManagement permissions

  1. Search for DeviceManagement.
  2. Select the following permissions:
    • DeviceManagementApps.Read.All
    • DeviceManagementConfiguration.Read.All
    • DeviceManagementManagedDevices.Read.All
    • DeviceManagementRBAC.Read.All
    • DeviceManagementServiceConfig.Read.All
  3. Do not select the Add permissions button yet — you will do so in a later step.

Step 10: Add Directory.Read.All permission

  1. Search for Directory.
  2. Select Directory.Read.All.
  3. Do not select the Add permissions button yet — you will do so in a later step.

Step 11: Add AuditLog.Read.All permission

  1. Search for AuditLog.
  2. Select AuditLog.Read.All.
  3. Do not select the Add permissions button yet — you will do so in a later step.

Step 12: Add Policy.Read.All permission

  1. Search for Policy.
  2. Select Policy.Read.All.
  3. Do not select the Add permissions button yet — you will do so in a later step.

Step 13: Add CloudPC.Read.All permission

Note

Only required for Windows 365 (Cloud PC).

  1. Search for CloudPC.
  2. Select CloudPC.Read.All.
  3. Do not select the Add permissions button yet — you will do so in the next step. cloudpc readall

Step 14: Add Reports.Read.All and apply

  1. Search for Reports.
  2. Select Reports.Read.All.
  3. Select Add permissions.

Step 15: Add another permission

Note

Skip directly to Step 20 if you do not plan to use the Custom Inventory solution.

  1. Select Add a permission.

Step 16: Select organization APIs

Note

Only required for Custom Inventory.

  1. Select APIs my organization uses.

Step 17: Select Log Analytics API

Note

Only required for Custom Inventory.

  1. Search for Log Analytics.
  2. Select Log Analytics API.

Step 18: Select Application permissions

Note

Only required for Custom Inventory.

  1. Select Application Permissions.

Step 19: Add Data.Read permission

Note

Only required for Custom Inventory.

  1. Select Data.Read.
  2. Select Add permissions.
  1. Select Grant admin consent for your tenant.
  1. Select Yes at the prompt.

Step 22: Create a new client secret

  1. Select Certificates & secrets.
  2. Select New client secret.

Step 23: Configure the client secret

  1. Enter a Description.
  2. Select a value for Expires.
  3. Select Add.

Step 24: Record the client secret value

  1. Record the Value data as the Azure AD Client Secret. This will be used later in the installation process. The value can only be displayed once, if you fail to record it here you will have to create a new one.

Step 25: Record the application IDs

  1. Select Overview.
  2. Record the Application (client) ID as the Azure AD Client ID. This will be used later in the installation process.
  3. Record the Directory (tenant) ID as the Azure AD Tenant ID. This will be used later in the installation process.
  4. The Azure AD Application registration is now complete.