--- title: "Copy of Registered app creating" canonical: "https://docs.cuesystem.com/space/M3SG/281837604/Copy%20of%20Registered%20app%20creating" format: markdown --- > ℹ️ **Repeat **the following procedure **for all registered applications that you want to create** with respect to the touchONE-solution functionality described in the [previous chapter](/wiki/spaces/M3SG/pages/255000577). > ℹ️ > ℹ️ For **complete functionality** incl. reservation panels and other hardware units, the touchONE needs to create **5 registered applications** - so it is necessary **to repeat the following procedure 5 times**. # Login In order to register an application, you need to have **administrator access **to Microsoft 365 settings. Examples here are for the fictitious Contoso company. - Go to [https://login.microsoftonline.com](https://login.microsoftonline.com+) and log in to your Microsoft 365 administrator account. # Register app Follow these steps: - Go to "Admin / Admin centers / Azure Active Directory". Then tap "Azure Active Directory / App registration". Then select "New registration". - Select a name for your application, e.g. "touchONE connection agent for units". Then confirm with the "Register" button. # Application credentials - After you have registered applications, **copy **the "Application (client) ID" and the "Directory (tenant) ID" and store them in a safe place. You will need it later in touchONE reservation system settings. # API permissions Each registered app must have API permissions set as described in chapter [Registered apps parameters](https://cue.atlassian.net/wiki/spaces/M3SG/pages/255000577). Follow these steps: - Select "API permissions" in the left column. - On the page, tap "Add a permission". - Select "Microsoft Graph". - Now tap “Delegated permissions”. - Set the required **delegated API permissions**. Scroll down to the specific API permission group, open it and check the appropriate permission(s) for the application you are creating. OpenId permissions (email, offline_access, openid, and profile) can be found at the top of the list. ---
Permissions for Device Code Flow > Macro (include)
Permissions for Resource Owner Password Credentials > Macro (include)
Permissions for implicit Grant Flow > Macro (include)
--- - When all delegated permissions are set, tap “Add permissions”. # Grant admin consent
If admin consent is required, follow these steps: - You need to check whether your app has consented to all required permissions. If not (status “Not granted for ...” or empty), click “Grant admin consent for ...” and then confirm it in the next dialog box. - Now you have application permissions set correctly (status “Granted for ...” is listed for all permissions).
If admin consent depends on Microsoft 365 security policy settings, follow these steps: - Check if admin consent is required for some permissions. - If no permissions require admin consent, no further actions are needed. Permissions are then approved the first time the user/service account interactively sign-in. - It may be that the security policy will require admin consent for some permissions. In this case (at least one value “Yes” in the “Admin consent requires” column), click “Grant admin consent for ...” and then confirm it in the next dialog box. Now you have application permissions set correctly (status “Granted for ...” is listed for all permissions). - You can also grant permission by consenting to the administrator even if it is not required. Then the first time you sign-in interactively, user consent will no longer be required.
# Client secret For some registered apps and authentication methods, it is necessary to create a secret string called “Client Secret” for secure access. > ℹ️ Client secret value for: > ℹ️ > ℹ️ - **[Device Code Flow](https://cue.atlassian.net/wiki/spaces/M3SG/pages/268828679)** > ℹ️ - **[Resource Owner Password Credentials](https://cue.atlassian.net/wiki/spaces/M3SG/pages/268730371)** > ℹ️ - **[Implicit Grant Flow](https://cue.atlassian.net/wiki/spaces/M3SG/pages/268369925)** If client secret is required, follow these steps: - Go to the section “Certificates & secrets” and tap the button “New client secret”. - Here you can fill in the description of the client secret and you can set the expiration time of this secret. Tap the “Add” button to create the new client secret. - When the new secret is created, it is displayed in the client secrets list. **Copy now the new client secret value and store it in a safe place. You won’t be able to retrieve it after you leave this page.** You will need this client secret later in the touchONE reservation system setup. If you choose a time limit for the client secret, be sure to create a new client secret before expiration. You will also need to update this new client secret in the reservation system configuration. - On the same page, you can later add new client secrets, delete obsolete or hacked secrets, etc. # Public client flows For some registered apps and authentication methods, it is necessary to allow public client flows. > ℹ️ “Allow public client flows” regarding authentication method: > ℹ️ > ℹ️ - **[Device Code Flow](https://cue.atlassian.net/wiki/spaces/M3SG/pages/268828679)** > ℹ️ - **[Resource Owner Password Credentials](https://cue.atlassian.net/wiki/spaces/M3SG/pages/268730371)** > ℹ️ - **[Implicit Grant Flow](https://cue.atlassian.net/wiki/spaces/M3SG/pages/268369925)** Then follow these steps: - Select the “Authentication” page and scroll down to this option. Set the “Allow public client flows” switch to the value required for the authentication method. # Redirect URIs For some registered apps, it is necessary to set Redirect URIs. > ℹ️ Redirect URIs regarding authentication method: > ℹ️ > ℹ️ - **[Device Code Flow](https://cue.atlassian.net/wiki/spaces/M3SG/pages/268828679)** > ℹ️ - **[Resource Owner Password Credentials](https://cue.atlassian.net/wiki/spaces/M3SG/pages/268730371)** > ℹ️ - **[Implicit Grant Flow](https://cue.atlassian.net/wiki/spaces/M3SG/pages/268369925)** If redirect URIs are required, follow these steps: - Select "Authentication" in the left column. Then tap “Add platform”. - Select “Web”. - Now configure Web platform. In the “Redirect URIs” field, enter the callback URL for API web pages. This has the following format: **https://*****API_URL*****/account/oauth-callback** where ***API_URL*** should be replaced by the API URL of the touchONE-solution. Example: **https://assist.contoso.com/account/oauth-callback** Then **check the “Access tokens” and “ID tokens” checkboxes** at the bottom and confirm the settings with the “Configure” button. # Service account You can continue by creating service accounts. [See required service accounts for all kinds of registered apps.](/wiki/spaces/M3SG/pages/255820078)