Entra app registration

IntensiveReports reads your tenant as one app registration in Entra ID. The same registration also signs people in to the app. You need it before the app can show any data.

What the registration needs

Part	Used for
Client secret	the reports that read Microsoft Graph directly (most of them)
Certificate	the reports that read through PowerShell (Exchange Online, SharePoint, Teams, Purview)
Application permissions with admin consent	reading the data. About 80 permissions across Microsoft Graph, Exchange Online, SharePoint Online and Defender for Endpoint. List: Permission reference.
Global Reader directory role	Exchange Online and Teams PowerShell decide app-only access by directory role
Redirect URIs and ID tokens	signing people in to the app
App role IR.Admin (optional)	IntensiveReports administrators who are not Global Administrators

The registration needs both the secret and the certificate. Without the secret, every Graph report fails; without the certificate, every Exchange, SharePoint, Teams and Purview report fails.

Who can do this

• Steps 1 to 3: an Application Administrator or Cloud Application Administrator (or a Global Administrator).
• Step 4: a Global Administrator. Granting application permissions on Microsoft Graph and assigning a directory role need Privileged Role Administrator rights, which a Global Administrator has.
• Step 2 also needs a local administrator on the web server.

The scripts are in the setup folder of the release package. Install the PowerShell modules first (Installation); Grant-IrPermissions.ps1 needs the Microsoft Graph modules.

1. Create the app registration

In the Entra admin centre, go to App registrations > New registration:

Field	Value
Name	IntensiveReports (any name)
Supported account types	Accounts in this organizational directory only (single tenant)
Redirect URI	platform Web, https://<your-host>/signin-oidc

<your-host> is the address people use to open IntensiveReports, for example reports.example.com. If the app runs in an IIS application below the site root, include its path: https://reports.example.com/IntensiveReports/signin-oidc.

Copy the Application (client) ID and the Directory (tenant) ID from the overview page.

Then open Authentication:

Setting	Value
Redirect URIs (Web)	https://<your-host>/signin-oidc and https://<your-host>/signout-callback-oidc
Front-channel logout URL	https://<your-host>/signout-oidc (optional: signs people out of IntensiveReports when they sign out of another Microsoft app)
ID tokens (used for implicit and hybrid flows)	ticked. Without it, sign-in fails with AADSTS700054.

2. Create the certificate

On the web server, in PowerShell as administrator:

# app pool runs as NETWORK SERVICE
.\setup\New-IrCertificate.ps1

# app pool runs as its own identity
.\setup\New-IrCertificate.ps1 -AppPoolIdentity 'IIS AppPool\IntensiveReports'

The script:

1. creates a self-signed certificate CN=IntensiveReports, valid for 2 years, in LocalMachine\My;
2. exports the public key to C:\Temp\IntensiveReports.cer;
3. gives the app pool identity Read on the private key;
4. prints the thumbprint.

Parameter	Default	Meaning
-AppPoolIdentity	NETWORK SERVICE	the account the IIS app pool runs as
-Years	2	validity
-Subject	CN=IntensiveReports	certificate subject
-ExportPath	C:\Temp\IntensiveReports.cer	where the public key is written

Then, in the app registration: Certificates & secrets > Certificates > Upload certificate, and upload the .cer file. Check that the thumbprint shown there matches the script’s output. Keep the thumbprint for MsGraphCredentials:CertificateThumbprint.

If granting the key fails

The script finds the private key in either key store. If you create the certificate another way, grant the right by hand: certlm.msc > Personal > Certificates > right-click the certificate > All Tasks > Manage Private Keys > add the app pool identity with Read.

3. Create a client secret

In the app registration: Certificates & secrets > Client secrets > New client secret. Copy the Value (not the Secret ID) at once; it is shown only once. It goes into MsGraphCredentials:ClientSecret and EntraID:ClientSecret (Configuration).

Note the expiry date. When the secret expires, every Graph report fails at once (Operations).

4. Grant the permissions and the directory role

There are about 80 application permissions. Do not add them by hand: run the script as a Global Administrator, on any Windows computer with the Microsoft Graph modules (the web server is fine):

.\setup\Grant-IrPermissions.ps1 -AppId <application-client-id>

It signs you in with a device code (open https://login.microsoft.com/device and enter the code), then:

1. creates the enterprise application (service principal) if there is none yet;
2. grants each application permission with admin consent;
3. adds them to the registration’s API permissions list, so the portal shows them with green ticks;
4. assigns the directory role Global Reader to the app;
5. skips, with a warning, any API your tenant does not have (for example Defender for Endpoint), instead of failing.

Each line ends with granted or already. The script is safe to run again; run it again after every update, because a new version can need new permissions (Updating).

Check: in the app registration, API permissions shows Granted for <your organisation> on every row, and Roles and administrators > Global Reader lists the app.

Allow time

Graph usually accepts new permissions at once. Exchange Online and SharePoint can take about 30 minutes. Restart the app pool after that, so the app gets fresh tokens.

Optional permissions

Some permissions are left out on purpose. Add them only if you use the reports that need them:

Switch	Adds	Use it when
-IncludeMailRead	Graph Mail.Read	you want the older mailbox large-attachment report. It lets the app read every mailbox in the tenant.
-IncludeReadWrite	OnPremisesPublishingProfiles.ReadWrite.All, WindowsUpdates.ReadWrite.All, BackupRestore-Configuration.ReadWrite.All, RoleAssignmentSchedule.ReadWrite.Directory	you want the App Proxy, Windows Update, Microsoft 365 Backup or PIM activation reports. These APIs have no sufficient read-only permission. IntensiveReports only reads, but the permission would allow changes.
-IncludeComplianceAdmin	directory role Compliance Administrator	you use the Purview reports (retention, DLP, sensitivity labels)
-IncludeTeamsAdmin	directory role Teams Administrator	Teams voice and policy reports fail with Global Reader alone

.\setup\Grant-IrPermissions.ps1 -AppId <application-client-id> -IncludeComplianceAdmin -IncludeTeamsAdmin

5. Extras for some reports

These are not covered by the script. Each affected report names them under its ? button and on its page in the report reference.

Extra	Where	Reports
Azure role Reader for the app on the Tenant Root Group management group	Azure portal > Management groups > Tenant Root Group > Access control (IAM)	Azure subscription and role reports, AI Agent Inventory
Azure role Azure AI User on each Azure AI Foundry project	Azure portal > the project > Access control (IAM)	AI Agent Inventory lists unpublished agents too
Power Platform management application	New-PowerAppManagementApp -ApplicationId <client-id> (module Microsoft.PowerApps.Administration.PowerShell) or the Power Platform admin centre	Power Platform environment, app and flow reports
Intune role with Endpoint Privilege Management > View Reports, assigned to the app	Intune admin centre > Tenant administration > Roles	Endpoint Privilege Management reports

6. Sign-in and the administrator role

People sign in with the same app registration (OpenID Connect, ID token only). It needs no extra API permission.

Administrators of IntensiveReports can save settings for everyone, set the default dashboard, manage API clients and open PowerShell Diagnostics. A signed-in user of your tenant is an administrator when they are a Global Administrator or hold the app role IR.Admin. To give the role to other IT staff:

1. In the app registration, open App roles > Create app role: display name IntensiveReports administrator, allowed member types Users/Groups, value IR.Admin.
2. In Enterprise applications > IntensiveReports > Users and groups, assign the role to the people or a group.

The role name can be changed with IntensiveReportsConfig:DashboardAdminRole. To limit who may open the app at all, see Sign-in and access.

7. Fill in the configuration

Put the IDs, the secret and the thumbprint into appsettings.json on the server (Configuration), then continue with Installation.