> For the complete documentation index, see [llms.txt](https://docs.aohwv.dev/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.aohwv.dev/getting-started/02-app-registration.md).

# Step 1 — App Registration

AOH Sync uses an Azure App Registration to authenticate your users via Microsoft Entra ID. You only need to complete this step once. This typically takes about **5 minutes**.

{% stepper %}
{% step %}
**Create the registration**

1. Sign in to the [Azure Portal](https://portal.azure.com).
2. Navigate to **Microsoft Entra ID** → **App registrations** → **New registration**.
3. Fill in the form:
   * **Name:** `AOH Sync` (or any name you prefer)
   * **Supported account types:** *Accounts in this organizational directory only*
   * **Redirect URI:** Leave this blank for now — you will add it after deployment in [Step 5](/getting-started/06-redirect-uri.md).
4. Click **Register**.

{% hint style="info" %}
Copy the **Application (client) ID** shown on the overview page. You will need it during the browser setup wizard in [Step 4 — First Login](/getting-started/05-first-login.md).
{% endhint %}
{% endstep %}

{% step %}
**Configure API permissions**

1. Go to **API permissions** → **Add a permission** → **Microsoft Graph** → **Delegated permissions**.
2. Add the following four permissions:

| Permission  | Type      | Purpose                       |
| ----------- | --------- | ----------------------------- |
| `email`     | Delegated | View users' email address     |
| `openid`    | Delegated | Sign users in                 |
| `profile`   | Delegated | View users' basic profile     |
| `User.Read` | Delegated | Sign in and read user profile |

3. Click **Grant admin consent for \[your organization]** and confirm.

{% hint style="success" %}
All four permissions should show a green **Granted** status before you proceed. See [Entra ID Permissions](/trust-security-and-data-handling/entra-permissions.md) for details on why each permission is required.
{% endhint %}
{% endstep %}

{% step %}
**Create a client secret**

1. Go to **Certificates & secrets** → **New client secret**.
2. Enter a description (for example, `aoh-sync-vm`) and choose an expiry period.
3. Click **Add**.
4. **Copy the secret value immediately** — Azure will not show it again after you leave this page.

{% hint style="warning" %}
Store the client secret in a safe location. You will be prompted to enter it in the browser setup wizard in [Step 4 — First Login](/getting-started/05-first-login.md). It is **not** entered during the Marketplace deployment — AOH Sync collects it over TLS in the browser wizard to keep it out of ARM deployment logs.
{% endhint %}
{% endstep %}
{% endstepper %}

## How to check it worked

All four Microsoft Graph permissions show **Granted** (green checkmark) in the **API permissions** list, and you have copied both the **Application (client) ID** and the **client secret value**.

## Related

* [Prerequisites](/getting-started/01-prerequisites.md)
* [Step 2 — Azure Marketplace](/getting-started/03-deploy.md)
* [Entra ID Permissions](/trust-security-and-data-handling/entra-permissions.md)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.aohwv.dev/getting-started/02-app-registration.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.