You need a Master Azure App Registration for EagleEye deployment.

The Master app acts as an orchestrator. It creates and configures the app registrations used by EagleEye during installation. It is required only during installation and can be safely deleted once installation succeeds. See Delete the Master App.

Before creating the Master app, read App Registrations reference for a simple overview of what the Master app does and what permissions it holds.

Step 2.1 - Create the App Registration

1. Go to Azure Portal → App registrations → New registration
2. Enter the app name: e.g., Northwind.EagleEye.Master
3. Set Supported account types to: Accounts in this organizational directory only (Single tenant)
4. Click Register

Step 2.2 - Create a Client Secret

1. Go to Certificates & secrets
2. Click New client secret
3. Add a description (e.g., Master Secret)
4. Select an expiry period → Add
5. Copy the secret value immediately (you will need this later; it will never be shown again)

Warning: After deployment, remove the secret value from any temporary notes (clipboard, notepad, etc.).
Do not delete the secret from Azure

Step 2.3 - Configure API Permissions

For a detailed explanation of why each permission is required, see App Registrations reference.

1. Go to your Master app registration (for example, Northwind.EagleEye.Master)
2. Go to Manage → API permissions → Add a permission
3. Select Microsoft Graph → Application permissions (Important: select Application permissions - not Delegated).
4. Add:
   • Application.ReadWrite.OwnedBy - Create and update EagleEye app registrations (Engine, Api, Portal)
   • AppRoleAssignment.ReadWrite.All - Grant application permissions (for example, Engine -> Microsoft Graph)
   • DelegatedPermissionGrant.ReadWrite.All - Grant delegated API access (Portal -> Api)
   • Domain.Read.All - Read tenant domains for EagleEye internal email settings
   • Group.Read.All - Read groups and memberships so deployment can find and assign the configured Entra group
5. Click Add permissions
6. Click Grant admin consent for your organization.

References

• App Registrations & Permissions reference
• Delete the Master App
• Secret Management for App Registrations
• Register an app in Microsoft Entra ID
• Microsoft Graph permissions reference