Register a Microsoft Entra ID sync application

Register a sync application in Microsoft Entra ID (formerly Azure Active Directory). This guide helps administrators configure Microsoft Graph permissions and create a client secret.

Before you begin

Have access to the Microsoft 365 admin centre and Microsoft Entra ID.

Steps

Register the application

Sign in to the Microsoft 365 admin centre.
Open App registrations in Microsoft Entra ID.
Select New registration on the App registrations page.
Enter BrandQuantum Entra ID Sync in Name.
Select the single-tenant option under Supported account types.
Select Register.

Configure API permissions

Copy the Application (client) ID and Directory (tenant) ID for later use.
Select API permissions in the application menu.
Open the context menu for the default User.Read delegated permission.
Select Remove permission.
Select Yes, remove to confirm.
Select Add a permission.
Select Microsoft Graph.
Select Application permissions, not Delegated permissions.
Select the permission search field.
Enter Group.Read.All in the permission search field.
Select the Group.Read.All permission from the list.
Replace the search text with User.Read.All.
Expand User in the search results.
Select the User.Read.All permission from the list.
Select Add permissions.
Select Grant admin consent for your company.
Select Yes to confirm.

Create a client secret

Select Certificates & secrets in the application menu.
Select New client secret.
Enter Default in Description.
Select 730 days (24 months) under Expires.
Select Add.
Copy the new secret from the Value column.

Prepare the sync details

Create a TXT file containing the following values:
- Application (client) ID
- Directory (tenant) ID
- Application secret copied from the Value column
- The exact name of every unique Active Directory group created for BrandQuantum
Share the file with the BrandQuantum technical team.

For example, separate groups for BrandOffice and BrandMail could be named BQ-BrandOffice and BQ-BrandMail.

Check it worked

The API permissions page shows Group.Read.All and User.Read.All as application permissions with consent granted. The new secret appears under Client secrets.