APP-REGISTRATION-CHECKLIST.md

E8CR App Registration Checklist (Copy/Paste Runbook)

Create app

• Entra Admin Center → App registrations → New registration
• Name: e8cr-squad-bot
• Supported account types: Single tenant
• Create

Capture IDs

• Application (client) ID copied
• Directory (tenant) ID copied

Create secret

• Certificates & secrets → New client secret
• Expiry set (6 or 12 months)
• Secret value copied to password manager

Add API permissions (Application)

• Microsoft Graph → Application permissions:
  • Directory.Read.All
  • AuditLog.Read.All
  • DeviceManagementManagedDevices.Read.All
  • DeviceManagementConfiguration.Read.All
  • DeviceManagementConfiguration.ReadWrite.All (optional write mode)
  • Policy.Read.All
  • RoleManagement.Read.Directory
  • UserAuthenticationMethod.Read.All
  • User.Read.All
  • SecurityAlert.Read.All
  • SecurityIncident.Read.All (if using incidents endpoint)

Admin consent

• API permissions → Grant admin consent
• Verify status = Granted for all required permissions

Azure Backup RBAC (if used)

• Recovery Services Vault → Access Control (IAM)
• Assign role: Backup Reader (minimum)
• Assign role: Backup Contributor (if action APIs needed)
• Assign role to service principal e8cr-squad-bot

Env export check

• AZURE_TENANT_ID set
• AZURE_CLIENT_ID set
• AZURE_CLIENT_SECRET set
• Optional backup vars set (VEEAM_* / AZURE_SUBSCRIPTION_ID etc)

Validation

• python3 skills/e8cr-vmpm/scripts/graph_auth.py returns token success
• One script per bot executes without auth/permission errors