Register the Entra ID application

CtrlShare puts documents into OneDrive on a user’s behalf, so unlike the other CtrlDocs products it signs in as a person rather than as itself. That is why its registration needs a redirect URI and delegated permissions, and why the authorisation step later in the setup path asks somebody to sign in.

Before you start

• Permission to create an application registration in Microsoft Entra ID.
• Someone who can grant consent for the tenant.
• The OneDrive account CtrlShare will use, decided in advance. The authorisation later in the setup path is done as that account.

Steps

1. Sign in to the Azure portal and open Microsoft Entra ID from the search bar at the top.

   

   Microsoft Entra ID was called Azure Active Directory until 2023, and older tenants still show that name.

2. Select App registrations under Manage, then New registration.

   

3. Fill in the registration:

   • Name — something that says what it is for, such as CtrlShare. If the registration will be shared with another product, name it for both: a registration named after one product is the sort of thing somebody deletes while tidying up.
   • Supported account types — Accounts in this organizational directory only (single tenant).
   • Redirect URI — Web, set to http://localhost/ctrlshare.

   

4. Select Register. On the Overview page that appears, copy the Application (client) ID and the Directory (tenant) ID.

   

5. Open Certificates & secrets and select New client secret. Give it a description and an expiry — 24 months is a reasonable choice.

   

6. Copy the secret Value — not the Secret ID — and record it somewhere you can find it again.

   

7. Open API permissions, add the permissions listed below, and have a tenant administrator select Grant admin consent.

The secret is shown once, and it expires

Entra shows a secret's value only on the screen where it is created. Copy it before leaving that page.

Record the expiry date somewhere a person will see it. When the secret expires, CtrlShare stops reaching Microsoft with an authentication error, and nothing warns you beforehand.

The permissions CtrlShare needs

These are delegated permissions: CtrlShare acts as the signed-in account, and can only do what that account could do itself.

Permission	What CtrlShare does with it
Files.ReadWrite.All	Creates the working copy in OneDrive, and reads it back on check-in
offline_access	Keeps working after the sign-in session would otherwise expire

No directory or user permissions are needed. Sharing, including invitations to people outside the organisation, runs as the connected account through OneDrive’s own invitation flow.

The redirect URI has to match exactly

CtrlShare completes its authorisation against the Redirect URI in its configuration, which defaults to http://localhost/ctrlshare. Nothing needs to run at that address. A registration created without it, or with a trailing slash added, fails at the authorisation step with an error from Microsoft rather than from CtrlShare.

Check

• The registration lists http://localhost/ctrlshare as a Web redirect URI.
• Both permissions show as granted in the Entra portal.
• You have the tenant ID, the client ID and the client secret value recorded. The secret is shown once.

Next

Set up CtrlShare — step two, installing the application.