x365 › App Registration Guide
~5 minutes · Entra ID access required

Register your Azure AD application

x365 runs entirely in your browser. To connect to Microsoft Graph, you register a single-tenant app in your own Entra ID — this gives you full control over what permissions are granted and ensures no third-party ever holds your credentials.

You only need to do this once. Once the app is registered and you've noted your Tenant ID and Client ID, you can use them every time you open x365. Your Tenant ID and Client ID are not secrets — they identify your app registration, not your credentials.
✓

Prerequisites

What you'll need before you start

  • ① An account with Application Administrator, Cloud Application Administrator, or Global Administrator role in your Entra ID tenant — required to register apps and grant admin consent.
  • ② Access to the Microsoft Entra admin centre at entra.microsoft.com.
  • ③ For the best audit results, use an account that also holds Intune Administrator and Security Reader roles. x365 uses only delegated permissions scoped to your own access level.
1

Create the app registration

Register a new single-tenant application in Entra ID

Entra admin centre › Applications › App registrations › + New registration
  • 1 Sign in to entra.microsoft.com.
  • 2 In the left sidebar, expand Applications and click App registrations.
  • 3 Click + New registration at the top of the page.
  • 4 Set a Name — for example: x365 Audit Tool
  • 5 Under Supported account types, select "Accounts in this organizational directory only (Single tenant)". This is critical — it ensures the app only works within your own tenant.
  • 6 Leave the Redirect URI blank for now — you'll set it in the next step.
  • 7 Click Register.
Do not select multi-tenant Selecting "Accounts in any organizational directory" would allow sign-in from any Microsoft tenant. Keep it as single-tenant so the app is scoped exclusively to your organisation.
2

Set the redirect URI

Tell Entra ID where to send the user after sign-in

App registration › Authentication › + Add a platform
  • 1 In your new app registration, click Authentication in the left sidebar.
  • 2 Click + Add a platform.
  • 3 Select Single-page application (SPA). This enables Authorization Code flow with PKCE, which is the most secure option for browser-based apps.
  • 4 Enter the following redirect URI:
https://x365.theadminstack.com
  • 5 Leave all other checkboxes at their defaults. Ensure Access tokens and ID tokens are not checked under Implicit grant — these are not needed for PKCE flow.
  • 6 Click Configure, then Save.
Do not add a client secret x365 is a public client (browser-based SPA). Client secrets are not supported in browser apps and would be exposed to anyone inspecting the page source. PKCE replaces the need for a secret.
3

Add API permissions

Grant the Microsoft Graph permissions required for each audit module

App registration › API permissions › + Add a permission

Click API permissions in the sidebar, then + Add a permission → Microsoft Graph → Delegated permissions. Search for and add each permission below.

Permission Type Required for Status
User.Read Delegated Basic sign-in, tenant details Required
User.Read.All Delegated Identity audit — read all user profiles, sign-in activity Required
Group.Read.All Delegated Intune — resolve policy assignment groups Required
GroupMember.Read.All Delegated Intune — expand group membership for coverage analysis Required
Policy.Read.All Delegated Identity — Conditional Access policies Required
DeviceManagementConfiguration.Read.All Delegated Intune — compliance & configuration profiles Required
DeviceManagementManagedDevices.Read.All Delegated Intune — managed device inventory and compliance state Required
DeviceManagementRBAC.Read.All Delegated Intune — RBAC role assignments Required
DeviceManagementServiceConfig.Read.All Delegated Intune — service configuration settings Required
UserAuthenticationMethod.Read.All Delegated Identity — MFA registration report Required
RoleManagement.Read.All Delegated Identity — directory role members, PIM assignments Required
PrivilegedAccess.Read.AzureAD Delegated Identity — PIM eligible role assignments Required
Application.Read.All Delegated Applications — app registrations & credential expiry Required
Directory.Read.All Delegated Applications — tenant OAuth consent grants Required
SecurityEvents.Read.All Delegated Defender module (future v1.1) Optional
Delegated permissions only — no application permissions All permissions above are Delegated. When you select "Microsoft Graph → Delegated permissions", the access is scoped to what the signed-in admin is themselves authorised to see. x365 will never see data beyond your own admin account's access level.
4

Grant admin consent

Approve the permissions on behalf of your organisation

API permissions › Grant admin consent for [your tenant]

Several of the permissions above require admin consent before any user in your tenant can use them. On the API permissions page, click the button:

  • 1 On the API permissions page, find the button labelled "Grant admin consent for [your tenant name]" and click it.
  • 2 Confirm the prompt. All permissions should now show a green "Granted for [tenant]" status.
Admin consent is required Without admin consent, users signing in will see an error when x365 tries to acquire tokens for the broader Graph permissions. If you don't have Global Administrator rights, ask your tenant admin to grant consent.

Once consent is granted, any administrator in your organisation can use the same Tenant ID and Client ID to sign in to x365. Each user's access is still bounded by their own Microsoft role assignments.

5

Copy your credentials

Note the two identifiers you'll need to connect x365

App registration › Overview

In your app registration, click Overview in the sidebar. You'll find both values on this page:

  • 1 Application (client) ID — a GUID that identifies your app registration. Shown prominently at the top of the Overview page.
  • 2 Directory (tenant) ID — the unique ID of your Entra ID tenant. Also shown on the Overview page, below the client ID.
These are not secrets Your Tenant ID and Client ID are identifiers, not credentials. They don't grant anyone access to your tenant on their own — a valid signed-in session from your tenant is still required to use them with x365. However, avoid posting them in public forums as a matter of hygiene.
✓

Connect to x365

You're ready — paste your credentials and sign in

  • 1 Return to x365.theadminstack.com.
  • 2 Paste your Tenant ID and Client ID into the Connect form.
  • 3 Click Sign in with Microsoft. A Microsoft login popup will open — sign in with your admin account.
  • 4 Once authenticated you'll be redirected to the audit dashboard. Click Run Audit to start.

Registration complete?

Head back to x365 and enter your Tenant ID and Client ID to begin your first audit. The process takes 1–3 minutes depending on your tenant size.

Connect your tenant → Open Entra admin centre ↗