Azure App Registration Setup

You create two app registrations in the MSP/home tenant. (For a fully customer-owned deployment, both are created in the customer's own tenant instead.)

App 1 — CET2 Portal (user sign-in + API)

1. Create → Name CET2 Portal → Supported account types: Accounts in any organizational directory (Multitenant).
2. Authentication → add a Single-page application platform → Redirect URI = your portal URL (e.g. https://cet.contoso.com). Add every hosting/redirect URL you'll use.
3. Expose an API → set the Application ID URI to api://{portal-client-id} → add a scope named access_as_user, requiring admin and user consent.
4. API permissions → add Microsoft Graph delegated permissions: openid, profile, User.Read. Grant admin consent.
5. Token configuration → add the optional claim auth_time to the access token. This is required for step-up authentication freshness checks on Elevated/Destructive actions — without it, those actions will loop indefinitely asking for re-authentication.
6. Record the Application (client) ID.

Where these values are used in CET2:

Value	Used in
Portal client ID	SPA authConfig.ts (CLIENT_ID), API AzureAd:Audience
Authority	SPA authority = https://login.microsoftonline.com/organizations, API AzureAd:Authority = https://login.microsoftonline.com/organizations/v2.0

App 2 — CET2 Data (app-only, certificate, per-tenant Graph)

1. Create → Name CET2 Data Collector → Multitenant.
2. Certificates & secrets → upload the public key of your Graph certificate. The private key never leaves Key Vault (Azure hosting) or the mounted PFX file (self-hosted). :::danger Do not use a client secret in production CET2's startup guard blocks a client-secret credential in a production environment unless an explicit override is set — certificate authentication is the intended and supported path. :::
3. API permissions → add Microsoft Graph Application permissions (see Graph Permissions). Admin consent for these is granted per customer tenant during onboarding, not here.
4. Record the Application (client) ID.

Where these values are used in CET2:

Cet2:GraphAuth:ClientId        = {data-client-id}
Cet2:GraphAuth:CredentialKind  = Certificate
Cet2:GraphAuth:CertificateName = <Key Vault secret name, or PFX file path>
Cet2:GraphAuth:KeyVaultUri     = <Azure hosting only>
Cet2:GraphAuth:HomeTenantId    = <MSP/home tenant ID>

ID summary

Value	Source	Used in
Portal client ID	App 1	authConfig.ts, AzureAd:Audience
Data client ID	App 2	Cet2:GraphAuth:ClientId
Home tenant ID	MSP tenant	Cet2:GraphAuth:HomeTenantId, AzureAd:TenantId
Customer tenant ID	Customer	Registered during Tenant Onboarding

Continue to Microsoft Graph Permissions.