App registration in Microsoft Entra ID

Several invoiceR functions access your Microsoft 365 tenant: the mailbox for email import, sending email, SharePoint as storage, user import and sign-in with Microsoft. This requires an app registration in Microsoft Entra ID (formerly Azure Active Directory). Your IT creates it; the app only receives the rights the respective function needs.

You can use one app for all functions or a separate one per function. For security reasons, separate apps with minimal rights are preferable.

Creating the app

1. Sign in at https://portal.azure.com and open Microsoft Entra ID.
2. Note the Tenant ID on the overview.
3. Click App registrations > New registration.
4. Enter a meaningful Name, for example invoiceR mailbox or invoiceR SharePoint, and click Register.
5. Note the Application (client) ID.
6. Under Certificates & secrets, click New client secret, enter a description and choose the validity period.
7. Note the Value of the new secret immediately. It is only shown once.

Overview of an app registration in Microsoft Entra ID with the Application (client) ID and Directory (tenant) ID highlighted

Granting permissions

Under API permissions > Add a permission, add the rights the respective function needs. Many rights then require admin consent: a user with administrator rights in the tenant clicks Grant admin consent for ….

Function	Permissions	Guide
Email import from Microsoft 365	Office 365 Exchange Online: IMAP.AccessAsApp (application)	Mailbox connection
Sending email through Microsoft Graph	Microsoft Graph: Mail.Send (application)	Sending and importing email
SharePoint as storage	SharePoint: Sites.Selected (application), plus a certificate	Document storage and archive
User import	Microsoft Graph: User.Read.All, Group.Read.All, GroupMember.Read.All (application)	Users and sign-in
Sign-in with Microsoft	Redirect URI, ID tokens, claim email	Users and sign-in

Handing the values to enio

For the setup in invoiceR, enio needs:

• Tenant ID
• Application (client) ID
• Client Secret (value), if the function needs one
• depending on the function, further details such as the object ID of a group or the certificate

Caution

The client secret is a password. Only transmit it through a secure channel, never by plain email. Note the expiry date: once the secret expires, the connected functions stop working until a new secret is stored.