Entra App Registration Setup

Use this guide when configuring a Dataverse connection that includes an App Registration Client ID in Power Platform ToolBox.

This applies to both scenarios shown in the connection add/edit dialog:

• Client ID is provided for Microsoft Login (OAuth)
• Enable for Power Platform API is checked

For official Microsoft guidance, see:

• Enable programmability and API support
• Programmability permission reference
• Power Platform REST API documentation

When to Use This Guide

Use this page when your connection uses Authentication Type = Microsoft Login (OAuth) and includes a Client ID.

If your connection also enables Enable for Power Platform API, your app registration needs additional delegated scopes for the Power Platform API resource.

Mode A: Client ID Only

If you provide only a Client ID (and do not enable Power Platform API), configure the app registration as a public client with these redirect URIs:

• msal<CLIENT_ID>://auth
• http://localhost

In Microsoft Entra, these URIs should be added under Authentication -> Add a platform -> Mobile and desktop applications.

These redirect URIs are required so ToolBox can complete Microsoft login and token acquisition.

Mode B: Enable for Power Platform API

If Enable for Power Platform API is checked, configure everything from Mode A, and add delegated permissions to the Power Platform API service principal.

Common delegated scopes to start with are:

• Connectivity.Connections.Read
• EnvironmentManagement.Environments.Read
• PowerApps.Apps.Read
• PowerAutomate.Flows.Read
• ResourceQuery.Resources.Read

Automatic Configuration in ToolBox

From the connection dialog you can use:

• Add Connection dialog buttons:
  • Configure & Add: attempts to update redirect URIs and baseline Power Platform API permissions automatically.
  • Copy Script & Add: adds the connection and gives you a PowerShell script you can run manually.
• Edit Connection dialog buttons:
  • Configure & Save: attempts to update redirect URIs and baseline Power Platform API permissions automatically.
  • Copy Script & Save: saves the connection and gives you a PowerShell script you can run manually.

Use the script path when automatic configuration is blocked by tenant restrictions or permission boundaries.

PowerShell Handoff Script

Use this script to configure an existing app registration. Replace $clientId with your own Application (client) ID.

$ErrorActionPreference = 'Stop'
$clientId = '12345678-c9e2-4091-917e-3c4c6dc0cbc9'
$requiredRedirectUris = @("msal${clientId}://auth", "http://localhost")

if (-not (Get-Module -ListAvailable -Name Microsoft.Graph.Authentication)) {
    Install-Module Microsoft.Graph.Authentication -Scope CurrentUser -Force -AllowClobber
}
if (-not (Get-Module -ListAvailable -Name Microsoft.Graph.Applications)) {
    Install-Module Microsoft.Graph.Applications -Scope CurrentUser -Force -AllowClobber
}
Import-Module Microsoft.Graph.Authentication
Import-Module Microsoft.Graph.Applications
Connect-MgGraph -Scopes 'Application.ReadWrite.All' -NoWelcome

$app = Get-MgApplication -Filter "appId eq '$clientId'"
if (-not $app) { throw "Application with Client ID '$clientId' was not found." }

$existingPublicRedirectUris = @()
if ($app.PublicClient -and $app.PublicClient.RedirectUris) { $existingPublicRedirectUris = @($app.PublicClient.RedirectUris) }
foreach ($requiredRedirectUri in $requiredRedirectUris) {
    if ($existingPublicRedirectUris -notcontains $requiredRedirectUri) {
        $existingPublicRedirectUris += $requiredRedirectUri
    }
}
$requiredPermissions = @(
    'Connectivity.Connections.Read'
    'EnvironmentManagement.Environments.Read'
    'PowerApps.Apps.Read'
    'PowerAutomate.Flows.Read'
    'ResourceQuery.Resources.Read'
)

$powerPlatformSp = Get-MgServicePrincipal -Filter "displayName eq 'Power Platform API'"
if (-not $powerPlatformSp) { throw "Power Platform API service principal was not found in this tenant." }

$resourceAccess = @()
foreach ($permissionName in $requiredPermissions) {
    $scope = $powerPlatformSp.Oauth2PermissionScopes | Where-Object { $_.Value -eq $permissionName } | Select-Object -First 1
    if (-not $scope) { throw "Permission '$permissionName' was not found on Power Platform API service principal." }
    $resourceAccess += @{ Id = $scope.Id; Type = 'Scope' }
}

$existingRequired = @()
if ($app.RequiredResourceAccess) {
    foreach ($item in $app.RequiredResourceAccess) {
        $existingRequired += @{ ResourceAppId = $item.ResourceAppId; ResourceAccess = @($item.ResourceAccess | ForEach-Object { @{ Id = $_.Id; Type = $_.Type } }) }
    }
}

$existingPowerPlatform = $existingRequired | Where-Object { $_.ResourceAppId -eq $powerPlatformSp.AppId } | Select-Object -First 1
if ($existingPowerPlatform) {
    $existingIds = @($existingPowerPlatform.ResourceAccess | ForEach-Object { $_.Id.ToString() })
    foreach ($entry in $resourceAccess) {
        if ($existingIds -notcontains $entry.Id.ToString()) {
            $existingPowerPlatform.ResourceAccess += $entry
        }
    }
} else {
    $existingRequired += @{ ResourceAppId = $powerPlatformSp.AppId; ResourceAccess = $resourceAccess }
}

Update-MgApplication -ApplicationId $app.Id -PublicClient @{ RedirectUris = $existingPublicRedirectUris } -RequiredResourceAccess $existingRequired
Disconnect-MgGraph | Out-Null
Write-Host 'App registration updated successfully.'

Manual Configuration in Entra

If you prefer manual setup in the Entra portal:

1. Open Microsoft Entra admin center -> App registrations -> your app.
2. In Authentication, select Add a platform -> Mobile and desktop applications.
3. Under Mobile and desktop applications, add these redirect URIs:
   • msal<CLIENT_ID>://auth
   • http://localhost
4. In API permissions, add delegated permissions under Power Platform API based on your tool scenario. Common starting scopes:
   • Connectivity.Connections.Read
   • EnvironmentManagement.Environments.Read
   • PowerApps.Apps.Read
   • PowerAutomate.Flows.Read
   • ResourceQuery.Resources.Read
5. Grant admin consent if your tenant requires it.

Verification Checklist

Before testing the connection in ToolBox:

• Client ID in ToolBox matches the app registration Application (client) ID.
• Redirect URIs include both values exactly.
• If Power Platform API is enabled, all required delegated scopes are present.
• Tenant consent requirements are satisfied.
• Environment URL is correct and reachable.

Troubleshooting

Login opens but callback fails

• Confirm redirect URI format is exact (msal<CLIENT_ID>://auth).
• Ensure no trailing slash differences for http://localhost.

Power Platform API calls return unauthorized

• Confirm Enable for Power Platform API is checked in the connection.
• Recheck delegated scopes on the app registration.
• Re-consent permissions if tenant policy requires refreshed consent.

Script fails to find app or service principal

• Verify $clientId is correct.
• Verify you are signed into the correct tenant.
• Confirm the service principal display name is available as Power Platform API.