Navigate to Microsoft AAD App registrations and select New registration:
Give the app a name and select Supported account types Accounts in this organizational directory only (Single tenant). You can leave the redirect URI empty.
Navigate to Expose an API and select Add Application ID URI. This will generate Application ID URI. Click Save at the bottom of the view.
Next, we need to create an app role for the application. The application we created defines and publishes the app roles and interprets them as permissions during authorization. This is the reason why we need to create an Administrator app role for the application user so that we can access the Management API.
Navigate to App roles - Create app role:
Display name: Admin,
Allowed member types: Applications,
Value: Administrator,
Description: Admin
Remember to check that "Do you want to enable this app role?" is enables.
Navigate to Certifications & secrets and add New client secret. You can leave the Description empty. Copy the value and store it in a safe location.
Go to API permissions and Add permission. Select APIs my organization uses and select the app you just created. Check the box Administrator. Finish permission by Granting admin consent. Admin consent will grant access to the actual Management API requests. You are still able to fetch the access token even if the admin consent is not granted but the Management API requests will fail to unauthorized exceptions.
After that you are all set. Navigate to the Overview and collect information from there for the subscription of the application to Frends Support. The information needs to be in json format:
{
"tenant": "<tenant-name>.onmicrosoft.com",
"audience": "<Application ID URI>",
"allowedIps": [
{
"ipAddress": "0.0.0.0",
"subnetMask": "255.255.255.255"
},
{
"ipAddress": "0.0.0.0",
"subnetMask": "255.255.255.255"
}
]
}
Put every public IP address with a subnet mask where the Management API is to be used from e.g. your Frends Agent's static IP addresses. These machines will be the only places that can make requests to Management API.
Send this information to support@frends.com as a json file.