Entra Application Registration

Opsole Migrate requires an application registration in Microsoft Entra ID to enable Microsoft Graph API access for device, identity, Intune, recovery, and post-migration assignment operations.

Tenant Scope

Create the application registration in the tenant or tenants required for your migration scenario.

Sign in with an account that can register applications, create client secrets, assign Microsoft Graph application permissions, and grant admin consent. Common roles include Global Administrator, Privileged Role Administrator, and Cloud Application Administrator or Application Administrator.

Your organization may require separate approval for granting tenant-wide application permissions.

Step 1 - Register Application

1. Go to entra.microsoft.com.
2. Navigate to Home > Applications > App registrations.
3. Click + New registration.

4. Enter a name for the application, for example OpsoleMigrateApp.
5. Retain all other settings at their default values.
6. Click Register.

Step 2 - Save Identifiers

From the application's Overview page, copy and save the following values:

• Application (client) ID
• Directory (tenant) ID

These values are required later when configuring and validating the Opsole Migrate portal connection.

Step 3 - Add API Permissions

1. Go to API permissions.
2. Click + Add a permission.

3. On the Request API permissions page, select Microsoft Graph.

4. Select Application permissions.

5. Use the search bar to add the required Microsoft Graph permissions.

Feature-dependent permissions are required only when the corresponding capability is enabled, such as LAPS retrieval, group restoration, or configuration profile handling.

6. After adding the permissions, click Grant admin consent for [TENANT NAME].
7. Click Yes at the grant admin consent confirmation prompt.

8. Confirm that all permissions display Granted for [TENANT NAME].

Step 4 - Generate Client Secret

1. Go to Certificates & secrets > Client secrets.
2. Click + New client secret.

3. Fill in the following:
   • Description: for example OpsoleSecretKey
   • Expires: select a duration aligned with your organization's secret rotation policy, for example 180 days
4. Click Add.

Step 5 - Save the Secret Value

Copy the Value of the new client secret immediately and save it securely.

The client secret value is shown only once. Do not navigate away from the page until the value has been copied and stored.

Store the secret in an approved secrets vault or password management system. Do not email it, store it in scripts, save it in source control, or share it through chat.

Record the secret expiry date and assign an owner for rotation before expiry.

2.2 Validate the Entra App Registration

Validate the Microsoft Entra app registration before using it in the Opsole Migrate portal. This confirms that the app registration can authenticate successfully and that permissions, admin consent, or tenant policies are not blocking access.

Step 1 - Download the Validation Script

Download the PowerShell validation script here: Download link

Right-click the link and select Save link as... to download the file.

Step 2 - Save the Script Locally

Save the script in a dedicated folder on a secure admin workstation, for example D:\Temp.

Run the validation script from a trusted administrative workstation. If your organization requires script review, have the script reviewed and approved before execution.

Step 3 - Run the Script

Open Windows PowerShell or PowerShell 7.

Navigate to the folder where the script is saved, then run:

.\Opsole_Entra_AppAuth_Validation.ps1

Step 4 - Provide the Requested Details

When prompted, enter:

• Directory (tenant) ID
• Application (client) ID
• Client secret

The client secret input is hidden.

Step 5 - Confirm Success

If the script returns PASS, the app registration authentication is working and can be safely used in the Opsole Migrate portal.

If the script returns FAIL, re-check the entered values and review tenant configuration, permissions, admin consent, Conditional Access restrictions, and secret validity before proceeding with migration activity.

Next Steps

• Continue to Provisioning Package Configuration