Register the app and grant Microsoft Graph consent

Create the Entra app registration Certaria uses to read your tenant's compliance signals, and grant admin consent. About 15 minutes, once.

Who this is for: the person in your organisation who holds the Global Administrator role (or Privileged Role Administrator) in Microsoft Entra ID. Granting admin consent requires that role.

Where: the Microsoft Entra admin centre, then the Certaria app to record the result.

How long it takes: about 15 minutes, once.

Why this step exists: Certaria reads a small, fixed set of read-only signals from your Microsoft 365 tenant (for example your Secure Score, device compliance, and Conditional Access policy names) and maps them to ISO 27001 Annex A controls as evidence.

Certaria ships the connection to Microsoft Graph. The Certaria Graph connector arrives inside the managed solution, already built and already configured: which Graph endpoints are called, what is read, and what is done with the results are fixed by us and are not yours to assemble.

What Certaria cannot ship is an identity in your tenant. Reading your Secure Score means signing in as something, and that something has to exist in your Entra ID, created by an administrator who holds the rights to create it. No vendor can do that from the outside, and any that offered to would be asking you for far more than this.

So the fifteen minutes below is not product assembly. It is you issuing Certaria a read-only pass into your own directory, in your own name, which you can revoke at any time.

This is a deliberate design choice, and it is the one that makes the rest of our claims true. The alternative is a single Talastron-owned application with standing access to every customer tenant at once. That would remove this step, and it would also mean your compliance data was reachable by us. Instead each customer’s Certaria authenticates as an identity that customer created and controls. Talastron holds no credential to your tenant and never sees your client secret.

What you will end up with

A single app registration in your Entra ID, named for Certaria.
Eight read-only Microsoft Graph application permissions granted on that app, with your admin consent recorded.
One client secret, which you paste into Certaria once. The secret is stored in your own environment. Talastron never sees it.

Before you start, it helps to have the Certaria onboarding page open in one browser tab and the Microsoft Entra admin center open in another.

Step 1: Register the application

Sign in to the Microsoft Entra admin center at https://entra.microsoft.com with your Global Administrator account.
In the left navigation, select Microsoft Entra ID, expand Identity, expand Applications, then select App registrations.
Select New registration.
In Name, enter something clear, for example Certaria ISMS Evidence Reader.
Under Supported account types, select Accounts in this organizational directory only (single tenant). Certaria only ever reads your own tenant.
Leave Redirect URI empty for now.
Select Register.
On the app’s Overview page, copy the Application (client) ID and the Directory (tenant) ID. You will paste these into Certaria during onboarding.

Step 2: Add the eight read-only Graph permissions

On the app, under Manage, select API permissions.
If a default User.Read delegated permission is listed, you can leave it or remove it. It is not one of the eight Certaria uses.
Select Add a permission, then Microsoft Graph, then Application permissions. Application permissions let Certaria read the signals on a schedule without a person needing to be signed in, which is what the recurring readiness scan requires.
Search for and tick each of the following eight permissions, then select Add permissions:

Permission	What Certaria reads with it
`SecurityEvents.Read.All`	Your Secure Score and security alerts (read only)
`DeviceManagementManagedDevices.Read.All`	Intune device inventory and compliance state
`SensitivityLabels.Read.All`	The names and counts of your published sensitivity labels
`AuditLog.Read.All`	Confirmation that audit telemetry is flowing (a presence check)
`User.Read.All`	User and group directory reads for access-review evidence
`RoleManagement.Read.Directory`	Who holds privileged roles, to evidence privileged-access control
`Policy.Read.All`	Your Conditional Access policy definitions (names and conditions)
`Directory.Read.All`	The list of third-party apps granted access to your tenant

Every one of these is read only. None of them lets Certaria create, change, delete, or act on anything in your tenant. A plain-English explanation of each permission, including what Certaria does not do with it, is shown to you on the consent screen during onboarding and is also available in your ISMS Management Hub.

Still on the API permissions page, select Grant admin consent for [your organisation].
Select Yes to confirm.
Confirm that the Status column now shows a green tick reading Granted for [your organisation] against all eight permissions.

If the Grant admin consent button is greyed out, your account does not hold a role that can consent. Ask a Global Administrator or Privileged Role Administrator to complete this step.

Partial consent is a real failure mode. Certaria’s first readiness scan checks that all eight permissions are genuinely consented, and will tell you if any are missing, so it is worth confirming all eight show the green tick before you move on.

Step 4: Create a client secret

On the app, under Manage, select Certificates & secrets.
Select New client secret.
Enter a description, for example Certaria evidence reader, and choose an expiry period. Choose a period you are comfortable managing. See “Keeping the secret valid” below.
Select Add.
Copy the secret from the Value column immediately. Microsoft shows this value only once. If you navigate away without copying it, you will need to create a new secret.

Paste the secret into Certaria where the onboarding page asks for it, alongside the client ID and tenant ID from Step 1. The secret is stored inside your own environment. Talastron does not receive it, store it, or have any way to read it.

Keeping the secret valid

The client secret has an expiry date that you set in Step 4. When it expires, Certaria’s scheduled readiness scans will stop working until you create a new secret and paste it into Certaria again. This is the one piece of routine maintenance this setup requires.

We recommend two things:

Set a calendar reminder a couple of weeks before the expiry date you chose.
When the reminder fires, repeat Step 4 to create a fresh secret and update it in Certaria. Certaria also surfaces a warning in its health log as the expiry approaches, so you have notice from inside the product as well.

If something does not work

“Grant admin consent” is greyed out. Your account cannot consent. A Global Administrator or Privileged Role Administrator needs to complete Step 3.

A permission still shows “Not granted” after consent. Select Grant admin consent again and confirm. If one permission stubbornly refuses, remove it, add it again from Step 2, and re-consent.

The readiness scan reports missing consent. Return to API permissions and confirm all eight show the green Granted tick. The scan checks each one, so a single missing permission is enough to flag it.

A sign-in or redirect error mentioning the Certaria Graph connection (for example a redirect-URI mismatch). The Certaria document-generation feature uses a separate Microsoft-managed connection that has its own redirect address. If you see a redirect-URI error when setting up that connection, add the exact redirect address shown in the error to your app registration under Manage, Authentication, Add a platform, Web. Your onboarding contact can confirm the address for your environment.

What you can revoke, and when

You are always in control:

You can revoke admin consent, or delete the app registration entirely, from the Microsoft Entra admin center at any time, without contacting Talastron.
Revoking consent or deleting the app stops Certaria reading any signals immediately.
Certaria holds no credentials of its own and has no standing access. Everything runs inside your tenant, on your Microsoft 365 licences, using the identity you created here.