Create the Microsoft Entra App Registration

App Store for Intune uses one app registration in your tenant. It plays two roles, both bound to the same client ID:

• Sign-in: the portal’s sign-in page redirects users here, then receives an access token scoped to access_as_user.
• Token validation: the backend API trusts only tokens whose audience matches this client ID, then checks the scope.

A single app registration can do both: expose the access_as_user scope (the audience) and configure a Single-page application platform with redirect URIs (the sign-in surface).

Why the app registration looks ‘empty’

The only delegated permission this app uses is User.Read, which is added by default when you register the app (it renders the signed-in user’s profile photo in the portal header). There is no client secret, and there are no Microsoft Graph application permissions on the app registration itself.

That’s intentional. Microsoft Graph application permissions live on the App Service’s system-assigned managed identity, not on the app registration. You grant those permissions to the managed identity after deploy by running a single PowerShell snippet, see Grant Microsoft Graph permissions to the App Service. If a reviewer looks at the App Store app registration and asks “where are the Graph permissions?”, the answer is “on the App Service’s managed identity, by design.”

Register the application

1. Go to Azure Portal > Microsoft Entra ID > App registrations.

2. Select New registration.

3. Name: App Store for Intune.

4. Supported account types: Single tenant only.

5. Redirect URI: leave empty for now. After the deploy completes you’ll add the App Service URL, see Add the production redirect URI.

6. Select Register.

7. Record the Application (client) ID: you’ll supply this to the Deploy to Azure wizard. This is the only value you need from this registration, the tenant ID is detected automatically during deployment, and this registration never gets a client secret.

   Note

   This is the registration people sign in against, and it stays exactly as described here. If you later enable unattended API access, a separate registration is created for that, holding only an audience and application roles: no client secret, no certificate, no Graph or Intune permissions. It is optional, it is not part of installation, and it does not change anything on this page. See Call the API from Azure Automation.

Expose the access_as_user scope

This is what the backend uses to validate incoming tokens, and what the portal asks the user to consent to during sign-in.

1. Select Expose an API > Add a scope.
2. Application ID URI: accept the default (api://<client-id>).
3. Select Save and continue.
4. Scope name: access_as_user
5. Who can consent: Admins and users
6. Admin consent display name: Access App Store for Intune
7. Admin consent description: Allows the app to access the App Store for Intune backend as the signed-in user.
8. User consent display name: Access App Store for Intune
9. User consent description: Allows the app to access the App Store for Intune backend on your behalf.
10. State: Enabled
11. Select Add scope.

Grant consent for the profile photo

The portal shows the signed-in user’s profile photo in the header, which it reads from Microsoft Graph using the delegated User.Read permission. User.Read lists Admin consent required: No, so it is easy to assume no action is needed, but the portal requests this permission silently (it is not part of the sign-in consent prompt), so it has to be consented in advance. Without consent the photo call fails and users see their initials instead.

1. On the app registration, select API permissions.
2. Confirm Microsoft Graph > User.Read (Delegated) is listed. If it is not, select Add a permission > Microsoft Graph > Delegated permissions, search for User.Read, select it, then Add permissions.
3. Select Grant admin consent for [your tenant], then Yes. User.Read then shows a green check in the Status column.

Note

This is the only permission the app registration needs consent for. Microsoft Graph application permissions are granted separately, to the App Service managed identity, after deploy (see Grant Microsoft Graph permissions to the App Service).

Next step

Continue to Deploy to Azure.