# Microsoft credentials

Microsoft credentials let Avallone sign in to Microsoft services on behalf of your organization. You set them up once per tenant, in **Settings → Integrations → Microsoft Credentials**. Every Microsoft connector you enable then uses them.

## Choose who manages the app registration

Avallone signs in to Microsoft as an Azure app registration. You can use Avallone's app registration, or bring your own.

| Option | Who owns the app registration | What you give Avallone |
|---|---|---|
| **Avallone-managed** | Avallone. One app registration is shared across tenants. | Your Entra tenant ID |
| **Custom** | You. | Your Entra tenant ID, client ID, and a client secret or certificate |

Avallone-managed credentials are not self-service. Contact Avallone support to set them up.

Choose **Custom** if you want full control over the app registration and the Microsoft services it can reach. You also need Custom if your organization's Azure policies don't allow an app registration managed by another company.

The rest of this page sets up **Custom** credentials.

## Step 1: Create an Azure app registration

1. Sign in to the [Azure portal](https://portal.azure.com) and go to **Microsoft Entra ID → App registrations → New registration**.
2. Give it a name you will recognize, such as "Avallone Integration".
3. Keep the default supported account type (single tenant), unless your organization requires another one.
4. Click **Register**.
5. On the app's **Overview** page, note down the **Application (client) ID** and the **Directory (tenant) ID**.

You enter both IDs in Avallone in Step 3.

A new app registration has no access to any Microsoft service. Each service needs its own access, which its page describes. You can grant it now or after Step 4. The credentials work whatever access they have been granted.

## Step 2: Choose how the app registration proves its identity

The app registration proves its identity to Microsoft with a client secret or a certificate:

- **Client secret**: you create the secret in Azure, then enter it in Avallone.
- **Certificate**: Avallone creates a certificate when you save the credentials. You upload it to Azure in Step 4.

For a client secret, create it now:

1. In the app registration, go to **Certificates & secrets → Client secrets → New client secret**.
2. Set an expiry and click **Add**.
3. Copy the secret's **Value** straight away. Azure only shows it once.

For a certificate, there is nothing to do in Azure yet.

## Step 3: Enter the credentials in Avallone

1. Go to **Settings → Integrations → Microsoft Credentials**.
2. Choose **Custom credentials**.
3. Enter the **Entra tenant ID** and the **client ID** from Step 1.
4. Choose how the app registration proves its identity:
   - **Client secret**: enter the secret value from Step 2.
   - **Certificate**: leave the secret empty. Avallone creates the certificate when you save.
5. Save, then click **Test** to check that Microsoft accepts the credentials.

## Step 4: Upload the certificate to Azure

Skip this step if you use a client secret.

1. In Avallone, download the public certificate (a `.pem` file) from the Microsoft credentials page.
2. In the Azure app registration, go to **Certificates & secrets → Certificates → Upload certificate**, and upload the `.pem` file.

The certificate is valid for 2 years. You can download it again at any time, until it is replaced.

Avallone keeps the certificate's private key in secure storage. Nobody can download it. Only the public certificate can be downloaded, to upload to Azure.

## Next steps

Grant the app registration access to each Microsoft service you want Avallone to use. The [Microsoft overview](/connectors/microsoft) lists the services and their setup pages.