Azure App Registration

The platform uses one Entra ID app registration for Teams SSO, Microsoft web SSO, and Graph on-behalf-of email. You create this once for the whole deployment.

:::info Two kinds of registration This page covers the platform SSO registration. Email-to-ticket uses this same registration — there are no longer any per-tenant Azure credentials to collect. It does, however, need extra Mail permissions on top of the SSO scopes; see Mail permissions below and Connection Modes. :::

1. Create the Registration

1. Entra ID → App registrations → New registration
2. Name: Ticku Platform
3. Supported account types: Multitenant if customers sign in from more than one Azure AD directory; Single tenant if the platform serves only your own directory.
4. Redirect URI (Web): https://<your-domain>/api/auth/callback/microsoft

Record the Application (client) ID and Directory (tenant) ID.

:::note Per-tenant SSO trust For each customer tenant, a platform admin can record that customer's Azure directory id (entraDirectoryId). Azure-SSO logins whose token tid matches are auto-approved into that tenant; otherwise sign-in falls back to email-domain trust. See Authentication. :::

2. Create a Client Secret

Certificates & secrets → New client secret. Record the value immediately — it is shown only once.

caution

Note the expiry date. When the secret expires, sign-in and email ingestion fail. Schedule rotation before expiry.

3. Expose an API (Teams SSO)

1. Expose an API → Set Application ID URI: api://<your-domain>/<client-id>
2. Add a scope: access_as_user — admin and user consent enabled
3. Add authorized client applications (the Teams client IDs), each with the access_as_user scope:
   • 1fec8e78-bce4-4aaf-ab1b-5451cc387264 (Teams desktop/mobile)
   • 5e3ce6c0-2b1f-4285-8d4b-75ee78787346 (Teams web)

4. API Permissions

Add Microsoft Graph → Delegated:

• User.Read (sign-in, profile)
• Mail.Send (notification email via Graph on behalf of users)

Click Grant admin consent for the directory.

Mail permissions for email-to-ticket

Email-to-ticket runs on this same registration, so its permissions belong here too. Add Microsoft Graph → Application (not Delegated):

• Mail.ReadWrite
• Mail.Send

Then Grant admin consent again.

:::danger Without these, app-only mail fails with 403 The graph_app connection mode authenticates as the application against each tenant's registered Entra directory. If these two application permissions are missing or unconsented, every mail call returns 403 and no tickets are created.

The delegated imap_oauth mode does not depend on them — it authenticates per mailbox — so it's the workable path while consent is outstanding. :::

Values to Carry Forward

Value	Used as
Tenant ID	ENTRA_TENANT_ID
Client ID	ENTRA_CLIENT_ID, webApplicationInfo.id in the Teams manifest
Client secret	ENTRA_CLIENT_SECRET
Application ID URI	webApplicationInfo.resource in the Teams manifest