App registrations

An install needs two Microsoft Entra ID app registrations. A third is optional and only needed when Power BI or other tools should read loaded data through the Data API. All of them live in the tenant Cloud Connector is installed into. Create the first two before you run the deployment wizard; it asks for their client IDs and secrets.

Registration	Needed	Used by	What it is for
Cloud Connector	Always	The web UI and the backend API	Users sign in to the UI with it, and the UI's token is addressed to it. The backend uses its secret to call the Python service, Microsoft Graph and Connect… sign-ins.
Cloud Connector Service	Always	The Python service	The service's own identity. The backend calls the service with a token for it, and the service calls the backend with its secret.
Cloud Connector Data	Optional	The Data API (/api/data)	The only way into the Data API. Power BI and scripts get tokens for it.

:::info One registration for the UI and the backend

Earlier versions of this guide described a separate "Frontend" registration for the UI. Installs have never used one: the UI signs in with the Cloud Connector app and asks for a token for that same app. If you created a Frontend registration, it is unused.

:::

Token flows

  User in the browser
    │  signs in with Cloud Connector
    │  token for api://<Cloud Connector client id>/access
    ▼
┌──────────────────────┐   client credentials, api://<Service id>/.default  ┌──────────────────────┐
│  Backend API         │ ─────────────────────────────────────────────────► │  Python service      │
│                      │                                                    │                      │
│  accepts tokens for  │ ◄───────────────────────────────────────────────── │  accepts tokens for  │
│  api://<CC id>       │   client credentials, api://<CC id>/.default       │  api://<Service id>  │
│                      │                                                    └──────────────────────┘
│  /api/data accepts   │ ◄── Power BI and scripts:
│  only tokens for     │     token for Cloud Connector Data (https://<backend host>)
│  Cloud Connector Data│
└──────────────────────┘

Cloud Connector

The registration the installer calls Cloud Connector: the UI's sign-in and the backend API's identity.

Create the registration

1. Microsoft Entra ID > App registrations > + New registration
   • Name: Cloud Connector
   • Supported account types: Single tenant
   • Redirect URI: leave blank for now. The URLs exist only after the deployment (see After deployment: redirect URIs).
2. Copy the Application (client) ID.

Leave the token version at its default (v1). The backend only accepts v1 tokens for this app, so do not set requestedAccessTokenVersion to 2 here. That setting belongs on Cloud Connector Data only.

Expose an API

1. Expose an API > Application ID URI > Add, and accept the default api://<client id>.
2. + Add a scope
   • Scope name: access — the UI asks for exactly this name.
   • Who can consent: Admins and users
   • Display name: Access Cloud Connector
   • State: Enabled

Create an app role

The Python service calls the backend without a user, and its token needs this role to read decrypted credentials and secret variables. Without it, loads that use a stored secret fail.

1. App roles > + Create app role
   • Display name and value: Service.ReadWrite
   • Allowed member types: Applications
   • Description: Lets the Cloud Connector Service read and write configuration

Registrations created from older versions of this guide may call the role Read.Write.All. The backend accepts both names.

Create a client secret

Certificates & secrets > + New client secret, and copy the value immediately. The installer asks for it.

API permissions

Under API permissions > + Add a permission, add these, then Grant admin consent:

Permission	Type	Needed for
Cloud Connector Service → Service.Execute	Application	The backend calling the Python service. Add it after creating the Service registration below.
Microsoft Graph → Application.Read.All	Application	Recommended. Setup → Access shows whether Assignment required is on and links to Users and groups. The Data API's app search also uses it.
Microsoft Graph → User.Read.All	Application	Only with the Data API: finding users for roles on the Data access page.
Microsoft Graph → GroupMember.Read.All	Application	Only with the Data API: finding groups, and checking group membership on every request a group member answers. Without it, group members of roles get nothing.

User.ReadBasic.All is not enough for the user search: Microsoft Graph only lets an app without a signed-in user list users with User.Read.All.

Optionally, also add this app's own access permission (Delegated) and grant admin consent, so users are not asked to consent the first time they sign in.

After deployment: redirect URIs

The managed application's Outputs show the UI and API URLs. On this registration's Authentication blade, add:

1. Single-page application: the UI URL, for example https://ccui-….azurecontainerapps.io. Users sign in through it.
2. Web: the API URL followed by /api/auth/oauth/callback, for example https://ccapi-….azurecontainerapps.io/api/auth/oauth/callback. The Connect… buttons on Microsoft sign-in actions and instances return here.

Connect… sign-ins use this app unless the action or instance names another one. The scopes they ask for are consented when someone first connects.

Restrict who can sign in

By default any user in the tenant can sign in to Cloud Connector, and every user who can sign in can change its configuration.

1. Microsoft Entra ID > Enterprise applications, open Cloud Connector.
2. Properties > Assignment required? = Yes, then Save.
3. Users and groups > + Add user/group, and assign who may use Cloud Connector.

This is done on the Enterprise application (the service principal), not on the app registration. Setup → Access in Cloud Connector shows whether it is on.

Cloud Connector Service

The Python service that runs loads.

Create the registration

1. App registrations > + New registration
   • Name: Cloud Connector Service
   • Supported account types: Single tenant
   • Redirect URI: leave blank. Nobody signs in to the service.
2. Copy the Application (client) ID.

Leave the token version at its default (v1), as for Cloud Connector.

Expose an API

Expose an API > Application ID URI > Add, and accept the default api://<client id>. No scope is needed: only the backend calls the service, and it calls without a user.

Create an app role

App roles > + Create app role

• Display name and value: Service.Execute
• Allowed member types: Applications
• Description: Lets the Cloud Connector backend run loads and previews

Then grant it to the Cloud Connector registration, as listed in its API permissions above.

Create a client secret

Certificates & secrets > + New client secret, and copy the value immediately. The installer asks for it.

API permissions for the service

API permissions > + Add a permission > APIs my organization uses > Cloud Connector > Application permissions > Service.ReadWrite, then Grant admin consent. This is the role from the Cloud Connector registration. Without it the service cannot read decrypted credentials.

Cloud Connector Data (optional)

Power BI and other external tools read loaded data through GET /api/data/{schema}.{dataset}. Without this registration the Data API stays closed.

:::info Prerequisite: Business Plus

The Data API is part of the Business Plus feature set, which Datawareness switches on per deployment, independent of the plan tier. Without it the Data API is closed whatever is configured, the client ID below is refused, and Cloud Connector shows none of this setup.

:::

The Data API is closed by default and opens only when both are true:

1. the caller holds a token issued for this app registration. A Cloud Connector sign-in token is refused, and API keys never reach the Data API;
2. an enabled role covers the data and names the caller, a group the caller is in, or the calling app. Roles are set up per environment on Cloud Connector's Data access page: each has members and data — per source system, which datasets crossed with which instances (only the rows those instances loaded), each side either all, including new ones, or specific ones.

It must be a separate registration. Power BI asks Entra for a token whose audience is the API's own address (https://<backend host>), so this app owns that address as its Application ID URI. Kept apart from Cloud Connector, a Power BI user never holds a token that opens the Cloud Connector UI.

Create the Data registration

1. App registrations > + New registration
   • Name: Cloud Connector Data
   • Supported account types: Single tenant
   • No redirect URI, no client secret.
2. Manifest → set "requestedAccessTokenVersion": 2 (under api) and save. Do this before step 3. Entra refuses an https:// Application ID URI on a domain the tenant has not verified — which *.azurecontainerapps.io is not — for apps issuing v1 tokens, and exempts v2 apps.
3. Expose an API
   • Application ID URI: https://<backend host> — the scheme and host of the Cloud Connector API, nothing after it, no trailing slash. Shown on Setup → Access.
   • + Add a scope: Data.Read — Read loaded data, Admins and users can consent, Enabled.
   • + Add a client application, ticking Data.Read, for both Power BI clients (the Microsoft standard app grants on Setup → Access):
     • a672d62c-fc7b-4e81-a576-e60dc46e951d — Power BI Desktop, Excel and the on-premises gateway
     • b52893c8-bc2e-47fc-918b-77022b299bbc — Power BI service (scheduled refresh)
4. On the Cloud Connector registration, consent the Graph permissions the Data access page needs (see API permissions).
5. In Cloud Connector, Setup → Access → Data API: paste this app's Application (client) ID and save. That switches the Data API on.
6. Set up roles on the Data access page, which appears under Configuration once the client ID is saved. Roles are per environment.

:::tip If step 3 is still refused

The tenant's identifier-URI policy blocks the host. Put a custom domain that is verified in the tenant on the backend Container App and use that host instead — for the Application ID URI and in Power BI.

:::

App-only callers (scripts, ETL)

Any app in the tenant can request a client-credentials token for https://<backend host>/.default. Add its service principal to a role (pick it by name or paste its client ID on the Data access page). An app member admits only app-only tokens; a user member admits only users' tokens.

Extra precaution: Assignment required

Setting Assignment required? = Yes on the Cloud Connector Data Enterprise application adds a second gate: Entra then issues Data API tokens only to assigned users and groups. A caller needs both the assignment and a role.

• Assigning groups needs Entra ID P1 or P2, and only direct members of an assigned group count. Group members of Cloud Connector roles include nested members.
• App-only callers then need an app role. Add one (for example Data.Read.All, member type Applications) and grant it to each calling app with admin consent, or every app-only call is refused (AADSTS501051).

Power BI connection

Use Get Data > Blank query and the Power Query template from Setup → Access (Copy Power Query template). It pages through the dataset by following @odata.nextLink. The OData feed connector does not work — the Data API has no $metadata.

When asked for credentials, choose Organizational account at the level of the Cloud Connector Data base URL, https://<backend host>/api/data. In the Power BI service, set the same credential (OAuth2) on the semantic model; no gateway is needed.

:::note Enterprise advanced management

Its ingress allowlist also applies to Power BI's refresh servers. Add the Power BI service ranges for your region, or refresh through an on-premises data gateway.

:::

What the installer asks for

Value	From
Cloud Connector client ID and secret	Cloud Connector
Cloud Connector Service client ID and secret	Cloud Connector Service

On the advanced-management plan the two secrets go into your own Key Vault instead of the wizard. Cloud Connector Data is not part of the install; its client ID is entered under Setup → Access whenever you set it up.

Quick reference

Who calls whom

Caller	Target	Token	Asks for
Web UI (signed-in user)	Backend API	Delegated	api://<Cloud Connector id>/access
Backend API	Python service	Client credentials	api://<Service id>/.default
Python service	Backend API	Client credentials	api://<Cloud Connector id>/.default
Power BI (signed-in user)	Backend /api/data	Delegated	https://<backend host> (Cloud Connector Data)
Script / ETL	Backend /api/data	Client credentials	https://<backend host>/.default (Cloud Connector Data)

Exposed scopes and roles

Registration	Application ID URI	Scope	App role	Token version
Cloud Connector	api://<client id>	access	Service.ReadWrite	v1 (default)
Cloud Connector Service	api://<client id>	none	Service.Execute	v1 (default)
Cloud Connector Data	https://<backend host>	Data.Read	none (see Assignment required)	v2