Share one Entra registration

CtrlSync and CtrlTMS each authenticate to Microsoft Graph with an application registration in Microsoft Entra ID. In a CtrlTeams deployment they can share one, which is the recommended arrangement: one client secret to rotate, one consent to obtain, one thing to audit.

The registration holds the union of the two permission sets. Neither application checks that it has only the permissions it needs, so the shared registration is broader than either would be alone.

Before you start

• Permission to create an application registration in Entra ID, and someone who can grant admin consent for the tenant. These are frequently different people.
• Decide where the client secret will be recorded and who is responsible for renewing it.

Record the expiry date

Entra shows a client secret’s value once, at creation. Copy it immediately. When the secret expires, both applications stop reaching Microsoft at the same moment, with an authentication error and no warning beforehand.

Steps

1. Create one application registration.

   Follow Register the Entra ID application up to the point where the registration exists and has a client secret. Name it for the pair rather than for one of them — a registration called CtrlSync that CtrlTMS also uses is the sort of thing that gets deleted by someone tidying up.

2. Add the permissions both applications need.

   Add the application permissions listed on CtrlSync’s page and on CtrlTMS’s page. Where the two lists name the same permission, add it once. Where CtrlTMS asks for a broader form of something CtrlSync asks for — Files.ReadWrite.All against Files.Read.All — add both; Entra treats them as separate permissions.

   All of them are application permissions, not delegated ones. Both applications run as themselves, with no signed-in user.

3. Grant admin consent.

   Nothing works until a tenant administrator consents. The permission list in Entra shows Not granted against each one until they do.

4. Put the same three values in both configurations.

   Tenant ID, client ID and client secret go into the Graph settings of both CtrlSync and CtrlTMS. They are separate settings in separate configurations that happen to hold the same values.

5. Verify each application separately.

   Check that CtrlSync synchronises a connection, and that CtrlTMS lists teams. A permission missing for one of them looks like a working deployment from the other’s point of view.

Check

• Every permission on both products’ lists shows as granted in the Entra portal.
• CtrlSync synchronises a connection, and CtrlTMS lists teams. Check both — a permission missing for one of them looks like a working deployment from the other’s point of view.
• The secret’s expiry date is recorded somewhere a person will see it before it passes.

When to use two registrations instead

Two registrations are the better choice when the two applications are administered by different people, when your tenant’s policy is one registration per workload, or when you want to be able to revoke one application’s access without stopping the other. Nothing in either product prefers a shared registration; it is a smaller thing to operate, not a required one.

Rotating the secret

Both applications read the secret from their own configuration, so rotating it is two edits. Create the new secret in Entra before removing the old one, update both configurations, then delete the old secret. Doing it in that order means no window in which neither value is valid.