> For the complete documentation index, see [llms.txt](https://docs.aohwv.dev/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.aohwv.dev/getting-started/02-app-registration.md).

# Step 1 — App Registration

AOH Sync uses an Azure App Registration to authenticate your users via Microsoft Entra ID. You only need to complete this step once. This typically takes about **5 minutes**.

{% stepper %}
{% step %}
**Create the registration**

1. Sign in to the [Azure Portal](https://portal.azure.com).
2. Navigate to **Microsoft Entra ID** → **App registrations** → **New registration**.
3. Fill in the form:
   * **Name:** `AOH Sync` (or any name you prefer)
   * **Supported account types:** *Accounts in this organizational directory only*
   * **Redirect URI:** Leave this blank for now — you will add it after deployment in [Step 5](/getting-started/06-redirect-uri.md).
4. Click **Register**.

{% hint style="info" %}
Copy the **Application (client) ID** shown on the overview page. You will need it during the browser setup wizard in [Step 4 — First Login](/getting-started/05-first-login.md).
{% endhint %}
{% endstep %}

{% step %}
**Configure API permissions**

1. Go to **API permissions** → **Add a permission** → **Microsoft Graph** → **Delegated permissions**.
2. Add the following four permissions:

| Permission  | Type      | Purpose                       |
| ----------- | --------- | ----------------------------- |
| `email`     | Delegated | View users' email address     |
| `openid`    | Delegated | Sign users in                 |
| `profile`   | Delegated | View users' basic profile     |
| `User.Read` | Delegated | Sign in and read user profile |

3. Click **Grant admin consent for \[your organization]** and confirm.

{% hint style="success" %}
All four permissions should show a green **Granted** status before you proceed. See [Entra ID Permissions](/trust-security-and-data-handling/entra-permissions.md) for details on why each permission is required.
{% endhint %}
{% endstep %}

{% step %}
**Create a client secret**

1. Go to **Certificates & secrets** → **New client secret**.
2. Enter a description (for example, `aoh-sync-vm`) and choose an expiry period.
3. Click **Add**.
4. **Copy the secret value immediately** — Azure will not show it again after you leave this page.

{% hint style="warning" %}
Store the client secret in a safe location. You will be prompted to enter it in the browser setup wizard in [Step 4 — First Login](/getting-started/05-first-login.md). It is **not** entered during the Marketplace deployment — AOH Sync collects it over TLS in the browser wizard to keep it out of ARM deployment logs.
{% endhint %}
{% endstep %}
{% endstepper %}

## How to check it worked

All four Microsoft Graph permissions show **Granted** (green checkmark) in the **API permissions** list, and you have copied both the **Application (client) ID** and the **client secret value**.

## Related

* [Prerequisites](/getting-started/01-prerequisites.md)
* [Step 2 — Azure Marketplace](/getting-started/03-deploy.md)
* [Entra ID Permissions](/trust-security-and-data-handling/entra-permissions.md)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.aohwv.dev/getting-started/02-app-registration.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.