Edit

Share via

Create a custom application

  • Article

Prerequisites

To create a custom application and grant it permissions, you need:

  • A Microsoft Entra user account. If you don't already have one, you can Create an account for free.
  • One of the following roles: Cloud Application Administrator, or Application Administrator.

Create an application in the Microsoft Entra admin center

To create custom applications for connecting to Microsoft Entra ID using Microsoft Entra PowerShell, follow the steps in the following section. Use the custom application to isolate and limit the permissions granted for a Microsoft Entra resource.

  1. Sign in to the Microsoft Entra admin center as at least a Cloud Application Administrator.

  2. Browse to Identity > Applications > App registrations and then select > New Registration.

  3. Enter a name for your application, for example Microsoft Entra PowerShell App.

  4. For Supported account types, select Accounts in this organization directory.

  5. For Redirect URI select: - Public client/native from the drop-down - URI value: http://localhost

  6. Select Register. To manage the resources that your application gets access to in your tenant, locate the application's service principal in the Enterprise applications pane.

  7. Browse to Identity > Applications > Enterprise applications > All applications and select the application you created.

  8. Under Manage, select Properties and set Assignment required? to Yes.

  9. Select Save.

  10. Under Manage, select Users and groups.

  11. Select Add user/group and add the users and groups permitted to use this application.

  12. Once you add all the users and groups, select Assign.

Note

In the app's Overview section, copy the Application (client ID) and Directory (tenant) ID. You use the values when connecting to Microsoft Entra ID.

Assign API permissions to the custom application

You need to set up Microsoft Graph permissions for the new application to connect to Microsoft Entra ID and manage Microsoft Entra resources.

  1. Browse to Identity > Applications > App Registrations > All applications and select the application you created.
  2. Under API permissions, select Add a permission > Select Microsoft APIs > Microsoft Graph.
  3. Choose the type of permissions you require, either delegated or application permissions.
    • If you need to sign in to the app to manage your resources in Microsoft Entra ID, select Delegated permissions.
    • If you want the app to access Microsoft Entra resources on its own without user interaction, select Application permissions
  4. Search for the required permission for example, User.Read.All.
  5. Select Grand admin consent for TenantName. Select Yes. Ensure the status shows a green checkmark.

You can now use the newly created app by connecting with:

Connect-Entra -ClientId <your-new-app-id>

For more connection options, see the Connect-Entra command details.