Creating a Microsoft 365 app registration for the Microsoft 365 extension

The CloudRadial AutomationAI Microsoft 365 extension connects to Microsoft 365 and Microsoft Entra ID through Microsoft Graph using an app-only (client-credentials) token, so it runs unattended with no signed-in user. This article walks through creating the Microsoft Entra ID app registration the extension needs and handing its credentials to your runner. It is for Admins and Owners, and it must be completed before the Microsoft 365 extension can automate anything.

We'll follow six main steps:

1. Understanding how the extension authenticates
2. Creating the app registration
3. Recording the Application and Directory IDs
4. Creating a client secret
5. Adding and admin-consenting Microsoft Graph permissions
6. Providing the credentials to your runner

Step 1: Understanding How the Extension Authenticates

Why are we doing this? Knowing the authentication model explains why you create an app registration and three secrets instead of signing in a user.

The extension calls Microsoft Graph (https://graph.microsoft.com/v1.0) with an app-only token acquired through the client-credentials flow. The token is built from three credentials your runner supplies from its Key Vault. The extension never asks a user for these credentials, so you create them once in Microsoft Entra ID and store them in the runner Key Vault.

Step 2: Creating the App Registration

Why are we doing this? The app registration is the identity Microsoft 365 recognizes when the extension calls Graph.

1. Open the Microsoft Entra admin center and go to app registrations.
2. Select to register a new application.
3. Give it a name you will recognize, such as AutomationAI Microsoft 365.
4. Register the application. Because the extension uses app-only authentication, you do not need to configure a redirect URI.

Step 3: Recording the Application and Directory IDs

Why are we doing this? These two IDs tell the extension which app and which tenant to authenticate as.

On the app registration's Overview page, record two values:

• The Application (client) ID, the GUID of the app registration
• The Directory (tenant) ID, your Entra tenant ID GUID (a verified domain also works)

You will store these as the M365-ClientID and M365-TenantID secrets.

Step 4: Creating a Client Secret

Why are we doing this? The client secret is the password the extension uses to prove it is the app.

Under the app registration's Certificates & secrets, create a new client secret and copy its value immediately, before you leave the page. This value becomes the M365-ClientSecret secret.

REQUIRED: Microsoft shows a client secret value only once. Copy it into your password manager right away; if you lose it you must create another.

Step 5: Adding and Admin-Consenting Microsoft Graph Permissions

Why are we doing this? The app can only do what its Graph permissions allow, and application permissions require an admin to consent on the tenant's behalf.

Under the app registration's API permissions:

• Add Microsoft Graph application permissions (for example, User.ReadWrite.All and Directory.ReadWrite.All).
• Grant admin consent for the tenant.

Select permissions that match the operations you intend to automate.

Step 6: Providing the Credentials to Your Runner

Why are we doing this? The runner reads these three secrets from its Key Vault to build the token at runtime.

Store three credentials in your runner's Key Vault with these exact names:

• M365-ClientID, the Application (client) ID GUID
• M365-TenantID, your Entra tenant ID GUID or verified domain
• M365-ClientSecret, the client secret value

What This Extension Cannot Do via Graph

Some operations are not available through Microsoft Graph, including SMTP mailbox forwarding, delegate permissions, and mailbox-to-shared-mailbox conversion. These require Exchange Online PowerShell or the Exchange admin center.

With the app registration created and its three secrets in the runner Key Vault, the Microsoft 365 extension can authenticate and automate.

If you are still having trouble, we're here to help! Submit a ticket here for assistance, and don't forget to check our status page to ensure there are no outages in your area.