Skip to content

Create a Microsoft Azure Application Registration machine

Create a Microsoft Azure Application Registration machine so Certificate Manager - SaaS can discover the certificates that are uploaded as credentials to the app registrations in your tenant. One machine covers every app registration in the tenant. There are two machine types. One runs the connector in the cloud, and the other runs it on a VSatellite in your network.

Before you begin

  • The System Administrator, PKI Administrator, or Resource Owner role. If you have the Resource Owner role, you must own or belong to at least one team.
  • If you want the connector to run on a VSatellite, an active VSatellite that can reach Microsoft Entra ID and the Microsoft Graph API on port 443.
  • The ID of your Microsoft Entra tenant.
  • An app registration in the tenant that Certificate Manager - SaaS signs in as, and a client secret for it.
  • The Microsoft Graph Application.Read.All application permission on that app registration, with admin consent granted for the tenant. In the app registration, select API permissions > Add a permission > Microsoft Graph > Application permissions, add Application.Read.All, and then grant admin consent. The permission is read-only, and Certificate Manager - SaaS needs no write access.

To create a Microsoft Azure Application Registration machine

  1. Sign in to Certificate Manager - SaaS.
  2. Click Installations > Machines.
  3. Click New, and then select Azure Application Registration. To run the connector on a VSatellite, select Azure Application Registration (VSatellite) instead.
  4. On the Properties step, in Name, enter a name for the machine.
  5. For Owning Team, choose the team that owns the machine. System Administrators and PKI Administrators can choose any team. Resource Owners can choose only a team they own or belong to.
  6. If you chose Azure Application Registration (VSatellite), for VSatellite, choose a VSatellite that can reach Microsoft Entra ID and Microsoft Graph. A VSatellite that's the primary of a high availability group shows its number of active replicas, and Certificate Manager - SaaS can run the machine's operations on any healthy VSatellite in the group.
  7. In Tenant ID, enter the ID of your Microsoft Entra tenant. Enter it as a universally unique identifier (UUID) in lowercase letters, for example 0a1b2c3d-4e5f-6a7b-8c9d-0e1f2a3b4c5d.

  8. For Credential Type, choose how to provide the credentials:

    • Enter Credentials to enter the credentials in the next step. This is the default.
    • Select Credentials to use shared credentials from a credential manager integration. Then, for Credential, choose the credential.

    Note

    Select Credentials requires the credential manager capability, which requires additional licensing. Without it, Credential shows No credentials are available. System Administrators and PKI Administrators can choose any credential. Resource Owners can choose only the credentials that belong to their teams.

  9. If you chose Enter Credentials, in Client ID, enter the application (client) ID of the app registration, and in Client Secret, enter the client secret's value. Enter the secret's value, not its secret ID. If you chose Select Credentials, the stored credential must hold the client ID as its username and the client secret as its password.

    Note

    Certificate Manager - SaaS encrypts the credentials you enter and doesn't display them again. On the machine's Properties tab, they appear masked. To keep a stored credential when you edit the machine, leave its masked value unchanged. Keep your own secure record of the credentials in case you need them again.

  10. Click Test Access. After the connection succeeds, click Continue. The Discovery step opens.

    Note

    A successful test confirms that Microsoft Entra ID accepts the client ID and client secret and that the app registration can list the tenant's app registrations through Microsoft Graph. If the app registration doesn't have the Application.Read.All permission with admin consent, the test fails with an "Insufficient privileges to complete the operation" error.

  11. (Optional) To skip certificates that have already expired, enable Exclude Expired Certificates.

    Discovery searches every app registration in the tenant and finds the certificates uploaded to each one as a credential. It doesn't discover client secrets. Certificate Manager - SaaS identifies each discovered certificate by the app registration's Application (client) ID and Application Display Name and the certificate's Certificate (key) ID.

  12. (Optional) To discover certificates on a schedule, enable Schedule. For Repeat every, choose Day, Week, or Month, and then in At, enter the time. For Week, select the days of the week. For Month, enter the days in Day of month. Times are in Coordinated Universal Time (UTC).

  13. Click Finish.

What's next?

This machine type discovers certificates but doesn't provision them. To track the certificates on your app registrations, run discovery on the machine at any time.