Entra prerequisites

Last updated: 20 September 2026

Goal: Prepare Microsoft Entra ID and Graph permissions before running the setup wizard.

Complete these in Microsoft Entra admin center and the Azure Portal. The wizard asks for Azure IDs and admin authorization — not a sign-in client secret. Hostname and trusted TLS are configured in Sandman Settings after your first admin sign-in.

  1. App registration — Create or reuse an app for Sandman sign-in. Add redirect URI https://<your-hostname>/auth/callback (or https://<public-ip>/auth/callback if DNS is not ready). Copy the Application (client) ID and Directory (tenant) ID.
  2. Federated credential — On that app, add a federated identity credential that trusts the Sandman VM’s system-assigned managed identity (object ID from the VM Identity blade or output managedIdentityPrincipalId). Issuer: https://login.microsoftonline.com/<tenant-id>/v2.0.
  3. Admin authorization — Configure app roles and/or a security group. See Admin authorization.
  4. VM managed identity — On the VM managed identity enterprise application, grant Microsoft Graph User.ReadBasic.All (application) with admin consent.
  5. Role assignment — Enterprise applications → your app → Users and groups → assign admins to the Sandman admin app role.

Verify: Federated credential is saved, Graph permission is consented, and at least one admin is assigned.

For IT admins: exact permissions
  • Azure RBAC: Virtual Machine Contributor at subscription scope on the VM managed identity (assigned by the Marketplace template).
  • Microsoft Graph (application): User.ReadBasic.All with admin consent on the VM managed identity enterprise app.
  • Sign-in (delegated): openid, profile, email, User.Read; redirect URI https://<your-host>/auth/callback.
  • Federated credential: links the sign-in app to the VM system-assigned identity — no sign-in client secret stored on the appliance.
  • Teams notifications: optional Logic App HTTP trigger; configure in Settings after setup.

© 2026 Sandman