Register the Entra ID application

CtrlSync reaches SharePoint and Microsoft Teams through the Microsoft Graph API, and signs in as itself rather than as a person. That needs an application registration in Microsoft Entra ID, with permissions a tenant administrator has consented to.

Before you start

• Permission to create an application registration in Entra ID.
• Someone who can grant admin consent for the tenant. This is frequently a different person, and waiting for them is what usually holds up a deployment.
• If CtrlTMS will be installed in the same vault, read Share one Entra registration first. One registration can serve both.

Steps

1. Sign in to the Azure portal and open Microsoft Entra ID from the search bar at the top.

   

   Microsoft Entra ID was called Azure Active Directory until 2023, and older tenants still show that name.

2. Select App registrations under Manage, then New registration.

   

3. Fill in the registration:

   • Name — something that says what it is for, such as CtrlSync. If the registration will be shared with another product, name it for both: a registration named after one product is the sort of thing somebody deletes while tidying up.
   • Supported account types — Accounts in this organizational directory only (single tenant).

   

4. Select Register. On the Overview page that appears, copy the Application (client) ID and the Directory (tenant) ID.

   

5. Open Certificates & secrets and select New client secret. Give it a description and an expiry — 24 months is a reasonable choice.

   

6. Copy the secret Value — not the Secret ID — and record it somewhere you can find it again.

   

7. Open API permissions, add the permissions listed below, and have a tenant administrator select Grant admin consent.

The secret is shown once, and it expires

Entra shows a secret's value only on the screen where it is created. Copy it before leaving that page.

Record the expiry date somewhere a person will see it. When the secret expires, CtrlSync stops reaching Microsoft with an authentication error, and nothing warns you beforehand.

The permissions CtrlSync needs

All of these are application permissions, not delegated ones: CtrlSync runs as itself, with no signed-in user.

Permission	What CtrlSync does with it
Directory.Read.All	Reads directory information — the names of sites, drives and folders in Teams, OneDrive and SharePoint
Files.Read.All	Reads files in all site collections
Group.Read.All	Reads groups, which is how a team’s SharePoint site is found
Team.ReadBasic.All	Lists the teams in the tenant

Writing back needs more than this

The list above covers reading from Microsoft 365. A deployment that also pushes documents from the vault into SharePoint needs the write equivalents, which the customer’s tenant administrator has to consent to in the same way.

Check

• Every permission in the table shows as granted in the Entra portal, not as Not granted.
• You have the tenant ID, the client ID and the client secret value recorded. The secret is shown once.

Next

Set up CtrlSync — step two, installing the application.