Preparations

In the Microsoft Azure portal, and in the main menu, select App registrations.

Select New registration.

In Name, enter a suitable name for the app such as Azure AD Discovery SIM app.

Set Supported account types to Accounts in this organizational directory only.

To save the new application, select Register.

In the Microsoft Azure portal, select App registrations.

Select the app you created in Step 1

Select API Permissions and then select Add a permission in this view.

In Request API permissions, select Microsoft Graph.

Select Application permissions, and configure the list of permissions:

1. Select User > User.Read.All (Read all users' full profiles).

2. Select Device > Device.Read.All (Read all devices).

3. Select AuditLog > AuditLog.Read.All (Read all audit log data).

   This is for getting the SignInActivity field in the user objects and DirectoryAudit objects to find WhenChanged for users and devices.

If the User > User.Read permission is checked in Delegated permissions, then clear the checkbox.

Select Add permissions.

Select Grant admin consent for [your company name].

In the Microsoft Azure portal, navigate to the app you created in Step 1

Make a note of the value in the Directory (tenant) ID. This value will be used as the Directory id when configuring the connector.

In the Microsoft Azure portal, navigate to the app you created in Step 1

Make a note of the value of the Application (client) ID field. The value will be used as the Application id when configuring the connector.

In the Microsoft Azure portal, navigate to the app you created in Step 1

Select Certificates & secrets.

Create a new client secret using the following information:

1. Select New client secret.

2. In Add a client secret, enter a suitable Description for the client secret.

3. In Expires, set a suitable expiration date.

Select Add. The client secret is shown.

Note the value of the client secret. This value is used as the Application secret when configuring the connector.