> For the complete documentation index, see [llms.txt](https://docs.inogic.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.inogic.com/next-best-action/configuration/configure-application-user.md).

# Configure Application User

To configure Application user follow the below steps:

#### **Create an App Registration in Microsoft Entra ID (to obtain the three keys)** <a href="#create-an-app-registration-in-microsoft-entra-id-to-obtain-the-three-keys" id="create-an-app-registration-in-microsoft-entra-id-to-obtain-the-three-keys"></a>

* Open the Azure portal for the **Microsoft Entra ID (Azure AD)** tenant that hosts the Dataverse environment (this may be a different tenant than where the container app is deployed).

<figure><img src="/files/iI70Xqtp4BALuhSRZAKK" alt=""><figcaption></figcaption></figure>

* Navigate to **Manage → App registrations** and click **New registration.**

<figure><img src="/files/7wMMecjb9h4WmZVnsinD" alt=""><figcaption></figcaption></figure>

* Enter the **application name** and select the first (default) option for supported account types, then click **Register.**

<figure><img src="/files/iAVNu95WuAIoPxCQWFod" alt=""><figcaption></figcaption></figure>

* Copy the Directory (tenant) ID → this becomes d365-tenant-id.
* After the app registration is created:
* Open the application registration and copy the Application (client) ID → this becomes d365-client-id and Copy the Directory (tenant) ID → this becomes d365-tenant-id.

<figure><img src="/files/wZhMqnAewdPJzvdEnavw" alt=""><figcaption></figcaption></figure>

#### **Grant API Permissions for Dynamics CRM** <a href="#grant-api-permissions-for-dynamics-crm" id="grant-api-permissions-for-dynamics-crm"></a>

In the app registration, go to Manage → API permissions → Add a permission. Select Dynamics CRM from the API list.

<figure><img src="/files/a9LtTSGCKObHhic2wocZ" alt=""><figcaption></figcaption></figure>

Choose Delegated permissions and then check **user\_impersonation**, then **click Add permissions**.

<figure><img src="/files/eBgubNktARr3HLVJUmn0" alt=""><figcaption></figcaption></figure>

Click **Grant admin consent** to apply the permission for the tenant. This ensures the app can call Dynamics CRM APIs as the signed-in user.

<figure><img src="/files/Q0m03bnrOIxnRpfDSwKr" alt=""><figcaption></figcaption></figure>

#### **Create a Client Secret (d365-client-secret)** <a href="#create-a-client-secret-d365-client-secret" id="create-a-client-secret-d365-client-secret"></a>

In the app registration, go to **Manage → Certificates & secrets → New client secret**. Create a new secret and optionally set its expiry. Click **Add**.

<figure><img src="/files/jwVqRtWxfjy8XiWPu2b2" alt=""><figcaption></figcaption></figure>

**Immediately copy the secret value** — this value is shown only once. This copied value is the d365-client-secret you will add to the Container App secrets. **If you leave the page, you cannot retrieve this value later.**

<figure><img src="/files/SWAz2ke4V0I0LQUNrfAM" alt=""><figcaption></figcaption></figure>