This article explains how Microsoft 365 enterprise apps work with Microsoft Entra ID and what permissions they need. It walks through a generic app authorization as a Global Administrator and covers common security misconceptions. It then explains in more technical depth how a service account gets authorized and connected to Robin.
Read it if you want to know: "How do we let people sign in to Robin with Microsoft 365 without letting everyone authenticate with any app on the internet?"
Service Principal and Application objects
When you authorize the Robin app for the first time, it registers a Service Principal object in your Microsoft Entra directory. This is your "install" of the Robin app, and you manage it directly. Robin maintains the Application object itself, so Robin can develop and maintain the app for all customers in one place.
Think of the Service Principal as an installed version of software, and the Application as the most recent version. If the Application changes (for example, it adds or removes a permission for features), you can authorize the most recent version again to update the Service Principal. This is very rare, and Robin does not need it to run.
This diagram from Microsoft shows the workflow:
Add new applications in Microsoft 365
Microsoft sets this requirement for Global Administrators and applications in Microsoft Entra ID:
Only global administrators can:
- Add apps from the Azure AD app gallery (pre-integrated 3rd Party Apps)
- Publish an app using the Azure AD Application Proxy
The first time you sign in to Robin's app, you must be a Global administrator, unless your tenant lets all users register new applications. Robin does not recommend this.
During sign up/in users are asked to give permission to the app to access their profile and other permissions. The first person to give consent causes a service principal representing the app to be added to the directory.
After you add the app to your directory, you no longer need the Global Administrator role to manage its settings.
User consent settings
In the Microsoft Entra admin center, go to Enterprise apps > Consent and permissions > User consent settings. Under User consent for applications, choose one of these options:
- Do not allow user consent. Users cannot consent to new apps. They can still sign in to apps that an admin consented to for them.
- Allow user consent for apps from verified publishers, for selected permissions. Users can consent only to apps from verified publishers or apps registered in your tenant, and only for the low-impact permissions you select.
- Allow user consent for apps. Users can consent to any app, for any permission that does not need admin consent.
In other words, when an admin consents to Robin for your organization, your users can sign in to Robin even with user consent turned off. They cannot authorize other apps you have not approved. The last option lets them authorize any app they choose.
References
- Who has permission to add applications to my Microsoft Entra instance? Global Admins + App Registration (Microsoft)
- Manage users and groups assignment to an application
- Convert single-tenant app to multitenant on Microsoft Entra ID
- Overview of permissions and consent in the Microsoft identity platform
- Manage your enterprise apps (Microsoft Entra admin center)
- Application and service principal objects in Microsoft Entra ID