Before you start
- A role in Entra ID that lets you register applications and grant admin consent.
- The workspace address TenCrown gave you, for example yourcompany.app.tencrown.com.
- The Microsoft Entra admin centre. Menu names change over time, so look for the closest match.
1. Register the application
Step 1: Create the registration
In Entra, open App registrations and choose New registration. Name it TenCrown and choose accounts in this organisational directory only.Step 2: Add the two redirect addresses
Under Authentication, add a Web platform with these two redirect URIs. Replace yourcompany with your own name, and copy them exactly.Redirect URI 1 https://yourcompany.app.tencrown.com/oauth/openid/callback Redirect URI 2 https://yourcompany.app.tencrown.com/api/admin/oauth/openid/callback
2. Create the four app roles
Under App roles, create four roles. The value must be exactly as shown, including capitals and underscores. Allowed member types: users and groups.
| TC_USER | Your staff. Can sign in and use the workspace. |
|---|---|
| TC_CUSTOMER_ADMIN | Your admins. Can use the admin panel. |
| TC_OPERATOR | TenCrown staff, for support. Assigned to our guest account. |
| TC_BREAKGLASS | TenCrown emergency access. Leave it unassigned. |
About TC_BREAKGLASS
Leave this role unassigned. If we ever need full access to fix a serious problem, we will ask you in writing to assign it to our guest account, and we will ask you to remove it afterwards. It means nobody at TenCrown holds full access to your environment without your say-so.
3. Expose a scope and grant permissions
Step 1: Expose an API scope
Under Expose an API, add a scope named access_as_user.Scope name access_as_user Step 2: Add six delegated Microsoft Graph permissions
Under API permissions, add these as delegated permissions. All are read-only, and delegated means the app acts as the signed-in person, so it can only see what that person can already see.Permission User.Read Permission Mail.Read Permission Calendars.Read Permission Files.Read Permission Files.Read.All Permission Sites.Read.All Step 3: Grant admin consent
Choose Grant admin consent for your organisation. Without it, sign-in works but the connector cannot read anything.
4. Assign people to roles
Step 1: Assign your staff and your admins
Open the TenCrown application under Enterprise applications, then Users and groups. Assign a group of your staff to TC_USER, and your admins to TC_CUSTOMER_ADMIN. Anyone with no role is refused at sign-in.Step 2: Invite our support account as a guest
We will tell you which email address to invite. Invite it as a guest and assign it TC_OPERATOR. This is how we help you with support.
5. Send us three values
Under Certificates and secrets, create a client secret. Note the date it expires. Then send us these:
| Directory (tenant) ID | From the Overview page of the registration |
|---|---|
| Application (client) ID | From the Overview page of the registration |
| Secret expiry date | When the client secret stops working |
Never email the secret itself
The three values above are safe to email to [email protected]. The client secret is not. Once we have the three values, we send you a one-time secure link. Paste the secret into it. The link works once, and we enter the secret into your environment ourselves.
If your staff will use the SharePoint file picker, also tell us your SharePoint host, for example contoso.sharepoint.com.
Renewing the secret
When the client secret expires, sign-in stops. We set a reminder 30 days before the date you gave us. Create a new secret before then, and send it to us through a new one-time secure link, with the new expiry date. Email us and we will send the link.
If something goes wrong
- A redirect error at sign-in. Almost always a redirect URI typed differently from the two above. Compare them character by character.
- “Refused” after signing in. The person has no role. Assign them TC_USER.
- Still stuck. Email [email protected] and tell us the error text.