Request to register an Entra ID app (public client, delegated Graph) for a personal Teams automation

A tenant administrator should either create this registration on your behalf or assign you the Application Developer role—the least-privileged built-in role that can create app registrations when ordinary user registration is disabled.^1^

Administrator actions

Option 1: Grant limited registration rights

Assign Application Developer to your account. This role permits you to:

• Create app registrations independently of the tenant’s Users can register applications setting.
• Become owner of registrations you create.
• Update applications that you own.^1^

This is narrower than Application Administrator, Cloud Application Administrator, or Global Administrator.

After assignment, create the app:

1. Open Microsoft Entra admin center → Entra ID → App registrations → New registration.
2. Enter J-Bot Personal.
3. Select Accounts in this organizational directory only.
4. Select Register.^2^
5. Copy Application (client) ID and Directory (tenant) ID from Overview.

Option 2: Have an administrator create it

The administrator should:

1. Go to Entra ID → App registrations → New registration.
2. Set:
   • Name: J-Bot Personal
   • Supported account types: Accounts in this organizational directory only
   • Redirect URI: leave empty
3. Select Register.
4. If you need to manage it later, add your account under Manage → Owners.
5. Return the Application (client) ID and Directory (tenant) ID. These identifiers are not credentials or secrets.

An application object cannot later be moved to another tenant, so it must be created in the tenant containing the Teams account that will use it.^3^

Configure device-code authentication

In the new registration:

1. Open Manage → Authentication.
2. Under Advanced settings, set Allow public client flows to Yes.
3. Select Save.

Microsoft’s desktop-app configuration specifically includes device-code flow under public-client configuration.^4^

No redirect URI is required for OAuth 2.0 device-code flow.^5^ Do not create a client secret or certificate for this public-client scenario.

Add Microsoft Graph delegated permissions

Go to Manage → API permissions:

1. Select Add a permission.
2. Select Microsoft Graph.
3. Select Delegated permissions, not Application permissions.
4. Add:
   • User.Read
   • Chat.ReadWrite
5. Confirm that no application permissions were added.

The permission definitions are:

• User.Read: signs in the user and reads the signed-in user’s profile.
• Chat.ReadWrite: reads and writes one-to-one or group chat threads on behalf of the signed-in user.

Both are listed as delegated permissions that do not inherently require admin consent.^6^ However, tenant consent policy can still prevent users from granting consent. In that case, an administrator must grant consent or process the request through the tenant’s admin-consent workflow.^7^

The application’s self-chat and per-message checks are useful application controls, but they do not technically narrow the OAuth grant: delegated Chat.ReadWrite authorizes access to one-to-one and group chat threads on behalf of the signed-in user.^6^

If access remains denied

Have the administrator check:

Microsoft Entra admin center → Identity → Users → User settings → App registrations

If Users can register applications is disabled, access denial is expected unless the account has an appropriate Entra role.^8^ If assigning a role is not permitted by organizational policy, administrator-created registration is the appropriate path.

References

1. Microsoft Entra built-in roles
2. Register an application in Microsoft Entra ID
3. Register an application with the Microsoft identity platform
4. Desktop app that calls web APIs: Code configuration
5. Redirect URI (reply URL) outline and restrictions
6. Microsoft Graph permissions reference
7. Configure how users consent to applications (portal)
8. App registration permission denied - Microsoft Q&A