# Client credentials
## Introduction
This walkthrough details the process of registering a Microsoft Entra ID (formerly Azure AD) application, granting it high-level API permissions, and securely connecting it to the Mindflow platform.
On Mindflow, the related credential we will create will be of type **OAuth 2.0 Client Credentials**
## Registering the Application in Azure
1. To begin, you must register a new application within your Microsoft Entra tenant to establish an identity for the integration.
2. **Navigate to App Registrations**: In the Microsoft Azure portal, go to the Microsoft Entra ID directory and select **App registrations** from the sidebar.
3. **Create New Registration**: Click on **+ New registration**.
4. **Configure Application Settings**:
1. **Name**: Enter a display name, such as "**TEST**".
2. **Supported Account Types**: Select **Accounts in this organizational directory only (Single tenant)**.
5. **Complete Registration**: Click **Register**. Once created, note the **Application (client) ID** and **Directory (tenant) ID** from the Essentials overview for later use.
## Configuring API Permissions
1. By default, new apps have limited access. You must explicitly grant the permissions required for the app to interact with Microsoft Graph data.
2. **Access Permissions Menu**: From the app's sidebar, select **API permissions**.
3. **Add Permissions**: Click **+ Add a permission** and select **Microsoft Graph** from the list of commonly used APIs.
4. **Choose Permission Type**: Select **Application permissions**. This is used for services that run without a signed-in user.
5. **Select Specific Scopes**:
1. Now, lets search for and select user-related permissions. You can either scroll down or search
1. Look for and select the following permissions: **User.ReadWrite.All**, **User.DeleteRestore.All**, and **User.RevokeSessions.All**.
1. Click **Add permissions** at the bottom of the pane.
6. **Grant Admin Consent**: The status will initially show "Not granted".
7. Click **Grant admin consent** and confirm with **Yes** to authorize these high-level permissions for the entire tenant.
## Generating Authentication Credentials
To allow Mindflow to authenticate as this application, you must generate a client secret.
1. **Create Secret**: Navigate to **Certificates & secrets** and click **+ New client secret**.
2. **Set Expiration**: Provide a description (e.g., "TEST") and choose an expiration period (recommended: 180 days).
3. **Secure the Value**: Immediately copy the **Secret Value**.
:::note
**Note:** This value is hidden after you leave the page and is required for the credential configuration in Mindflow. Store it safely!
:::
## Integrating with Mindflow
1. Finally, use the Azure details to create a functional credential within Mindflow.
1. Secret Value you just generated.
2. Application (Client) ID:
1. OAuth Token URL
2. In Mindflow, open the Environments panel and, within the Global Environment or a specific one, click the `+` icon to create a credentials.
3. **Select Service. Either:**
1. **Graph** (Portfolio): If you want to be able to use this credential for all API comprised within Graph (Users, Mail, Files, Sites, Devices, etc.)
2. **Microsoft Graph - Users:** If you want to only allow this credential to be used with MsGraph - Users endpoints.
4. **Configure Connection**: Create a new credential and fill in the following:
1. **Credential Type**: OAuth 2.0 Client Credentials.
1. **Client ID**: Paste the Application ID from Phase 1.
2. **Client Secret**: Paste the Secret Value from Phase 3.
3. **Access Token URL**: Use the format `https://login.microsoftonline.com/{tenant-id}/oauth2/v2.0/token`, replacing `{tenant-id}` with your actual Directory ID.
1. Then, click `Advanced` to enable `Scopes`
1. Enter `https://graph.microsoft.com/.default`.
5. **Test the Action:** Once the credential is saved, you can run a "List users" action. Don’t forget to assign the newly created credential to the step within `Settings` tab!
6. A successful integration will return a **200 OK** status and the user data in the output logs.
