Grant ProvisionPoint Additional permissions

Title

URL Name

Grant-ProvisionPoint-Additional-permissions

Question

Answer

When is an AAD App required?

Using M365 Mail as the notification Provider - Send Email Notifications from your Domain
Get Teams activity via Expiry compliance check - Configure Additional ChannelMessage.Read All Permissions for Teams Activity rules
Custom Actions that need additional permissions to complete their job - What are Custom Actions & How to Configure
Custom Service Types, to grant the permission to complete the creation of your choice. - What are Custom Service Types & How to Configure them
Add Terms to the Termstore (managed metadata) in SharePoint from the request form - Add a Term to a Term Store list from the Request Form

If you are using one of the use cases above, an App Registration will be required in the Microsoft Entra Admin Centre (EAC). The ProvisionPoint API app registration can be used or a new app registration can be created.

To authenticate we need to link the AAD App to ProvisionPoint and create a certificate to allow this to authenticate automatically.

Below are the instructions to complete this:

Create an app registration in EAC or use an existing app registration you already have
1. Add the Graph or other API permissions to that app registration, grant admin consent if required
2. Copy the application ID for the app registration (Overview page)
Open ProvisionPoint with a member of the App Manager role and go to Admin > Settings > AAD App
1. Paste the Application ID
2. Click + New Certificate and confirm
3. Once created, select the certificate and download it from the actions bar
4. When this downloads it may need you to confirm the file is safe
5. Click Save in ProvisionPoint, go to another page and then back to AAD App to ensure all settings have saved.
Upload the certificate to the App registration in EAC on the Certificates & Secrets tab