Graph API Settings

[AkosBakos]

When we would like to use the tool in general, which Graph API settings should we set first? We have to request and document these changes for our CISO. In the GitHub docs we were not finding so much around that.

Could somebody help us out?

[Micke-K]

Hello!

I'm so sorry. I completely missed answering this.

This depends on how you are using it. Are you going to use it for automation or just as an UI for admin?

For UI usage, you just need an Azure AD App with the permissions. You might already have an Azure App approved eg if you allowed the Graph PowerShell module.

For automation, you would need an Azure App with permissions + a certificate or a secret. I would also recommend a Workload Identities license so you can lock it down with Conditional Access.

The log file will show a list of the required permissions.

There are plenty of blogs on how to get started with this if you can't use one of the built in supported apps. One place to start is the MS documentation:

https://learn.microsoft.com/en-us/graph/auth-register-app-v2

I hope this is enough to get started. Let me know if you need more.

Cheers!

[GaelCCF]

Hello Micke,

Thank you for your tool I discovered at the MEM Summit at Paris.

I don't have the ability to edit the Microsoft Graph PowerShell app permission, so I started to create a dedicated one for Intune Manager.
I encounter some issue regarding the retdirect URIs.

both https://login.microsoftonline.com/common/oauth2/nativeclient and http://localhost are currently configured.
I'm not familiar with Enterprise applications
Can you help me providing URIs your tool is expecting ?

Thank you

[Micke-K]

Hello,

Have you had a look at this?

https://learn.microsoft.com/en-us/entra/identity-platform/quickstart-register-app

Might see if I can get the chance to document this but I hope the Microsoft documentation about it should be enough.

Thank you!

Cheers!