Manual Microsoft Entra App Registration

Register an application in Microsoft Entra ID when you want to configure one or more of the following services in MyQ manually:

• Microsoft Entra ID (Microsoft Graph)

• OneDrive for Business

• SharePoint Online connection in MyQ manually.

Set only the redirect URIs and permissions required for the integrations that you plan to use.

Before you Begin

Decide which MyQ integrations the application will support:

• Microsoft Entra ID (Microsoft Graph)

• OneDrive for Business

• SharePoint Online

You also need the following information:

• the Microsoft tenant where the application will be registered

• the MyQ server hostname and HTTPS port, if the application will be used for Microsoft Entra ID authentication

• whether the deployment uses single-tenant or multitenant authentication

• whether MyQ Desktop Client Seamless SSO will be used

For the required redirect URIs, credentials, and permissions, see Microsoft Entra App Reference.

Register the Application in Microsoft Entra

1. Sign in to the Microsoft Entra admin center at https://entra.microsoft.com/

2. Go to Identity > Applications > App registrations.

3. Select New registration.
   

   

4. In Name, enter a name for the application.

   Examples: MyQ Connector, MyQ Universal Print, MyQ SharePoint, MyQ OneDrive, MyQ Exchange

5. In Supported account types, select the account type required for your deployment.

6. Leave Redirect URI empty.

   You add the required redirect URIs later in this procedure.

7. Select Register.

The application is created.

In the Overview page of the application registration, copy and save the values:

• Application (client) ID

• Directory (tenant) ID

You enter these values when configuring the connection in MyQ.

Add Redirect URIs

Add the platform configurations and redirect URIs required by the integrations that will use this application.

1. In the application registration, go to Manage > Authentication.

2. Select Add a platform.

3. Select the required platform type.

4. Enter the redirect URI.

5. Select Configure.

6. Repeat these steps for each additional platform or redirect URI required by the MyQ integrations that will use this application.

Use the following common redirect URI patterns:

Microsoft Entra ID, OneDrive for Business and SharePoint Online use the following redirect URIs:

Replace:

• {hostname:port} with the hostname and HTTPS port of the MyQ server.

• {Application-client-ID} with the Application client ID of the application registration.

Create a Client Secret

Create a client secret for the application. MyQ uses this secret to authenticate to Microsoft Entra ID, OneDrive for Business, and SharePoint Online.

1. Go to Manage > Certificates & secrets.

2. Select Client secrets.

3. Select New client secret.

   

4. Enter a description.

   Examples: MyQ X Connector, MyQ X OneDrive, MyQ X SharePoint

5. Select an expiration.

6. Select Add.

7. Copy and save the client secret Value.

   

   Important: Copy the secret Value, not the Secret ID. The secret value is shown only when the secret is created.

You enter the secret value in MyQ as the security key or client secret.

Add API Permissions

Add only the permissions required by the MyQ integrations that will use this application.

1. Go to Manage > API permissions.

2. Select Add a permission.

3. Select Microsoft Graph.

4. Select the correct permission type for each permission, according to the table below:

   • Delegated permissions

   • Application permissions

5. Repeat these steps until all required permissions are added.

6. If administrator consent is required, select Grant admin consent.

   

   Microsoft Entra ID requires the following runtime permissions:

   Permission	API	Type	Purpose
   Group.Read.All	Microsoft Graph	Application	Read groups and group membership.
   User.Read.All	Microsoft Graph	Application	Read users.
   User.Read	Microsoft Graph	Delegated	Sign in and read the signed-in user's profile.

   OneDrive for Business requires the following runtime permissions:

   Permission	API	Type	Purpose
   Files.ReadWrite	Microsoft Graph	Delegated	Read and write files available to the signed-in user.
   User.Read	Microsoft Graph	Delegated	Identify the signed-in user.
   Files.ReadWrite.All	Microsoft Graph	Application	Access users' files without individual user authorization.

   SharePoint Online requires the following runtime permissions:

   Permission	API	Type	Purpose
   User.Read	Microsoft Graph	Delegated	Identify the signed-in user.
   Sites.ReadWrite.All	Microsoft Graph	Delegated	Read and write SharePoint content available to the signed-in user.
   Sites.Read.All	Microsoft Graph	Delegated	Read sites in the tenant.
   Sites.ReadWrite.All	Microsoft Graph	Application	Read and write content without individual user authorization.

Next Steps

Continue with the MyQ configuration for the integration that you want to use. Keep the following values available:

• Directory (tenant) ID

• Application (client) ID

• Client secret value