How to register CodeTwo applications in Entra ID (Azure AD)

Problem:

You want to manually register a CodeTwo application in your Microsoft Entra ID tenant.

Solution:

To enable a CodeTwo program to connect to Microsoft 365 (Office 365) by using the secure OAuth 2.0 authorization protocol, first you need to register a CodeTwo application in Entra ID for all Microsoft 365 tenants that will be used in the program. Next, to allow the CodeTwo application to access your data and perform the necessary tasks, you also need to grant the necessary permissions to that application.

These guidelines apply to the following CodeTwo programs:

• CodeTwo Backup, starting with version 2.6.x
• CodeTwo Office 365 Migration / CodeTwo Exchange Migration, starting with version 3.3.x

Use the links below for guidelines on how to register the CodeTwo application in Entra ID (Azure AD):

1. Before you start
2. Register a new application in Entra ID
3. Configure application permissions
4. Assign certificates / secrets to an app in Entra ID

Before you start

Keep in mind that CodeTwo software can perform the registration automatically. You simply need to provide the credentials of a user with the Global Administrator or Privileged Role Administrator role in the server connection wizard. To learn more, see the user's manual:

CodeTwo Backup

• connecting to Exchange Online
• connecting to SharePoint Online

CodeTwo Office 365 Migration

• connecting to source Office 365
• connecting to target Office 365

If you want to continue with manual registration, proceed to the next section.

Registering a new application in Entra ID

1. Sign in to the Microsoft Entra admin center.
2. Navigate to Entra ID > App registrations. 
3. Click New registration (Fig. 1.). This opens the Register an application page.

Fig. 1. The App registrations page in the Microsoft Entra admin center.

4. Enter a name for the application (e.g., CodeTwo Migration app, if you are using one of CodeTwo’s migration tools) and click Register (Fig. 2.). You can leave the other options to their defaults.

Fig. 2. Registering the CodeTwo application with Entra ID.

Configuring application permissions

1. On the application Overview page, click View API permissions (Fig. 3.). The API permissions page will open.

Fig. 3. Accessing the API permissions page.

2. Click Add a permission and select Microsoft Graph under Microsoft APIs.
3. Click Application permissions and select the permissions required by a specific CodeTwo application and server connection type:

CodeTwo Backup

If you are configuring a connection to Exchange Online, select:

• User.Read.All
• Directory.Read.All
• Group.Read.All
• MailboxSettings.ReadWrite
• MailboxItem.ImportExport.All
• MailboxItem.Read.All
• MailboxFolder.ReadWrite.All
• Mail.Send*

  and skip to this step.

  * This permission is required for the program to send email reports (learn more). If you don’t intent to use this feature, you don’t need to assign this permission to the CodeTwo app.

If you are configuring a connection to SharePoint Online, select:

• Directory.Read.All
• Group.Read.All
• User.Read.All

  and skip to the this step.

CodeTwo migration software

If you are configuring a connection to your source Microsoft 365 (Office 365) tenant, select:

• User.Read.All
• Directory.Read.All
• MailboxSettings.ReadWrite
• MailboxFolder.Read.All
• Mail.ReadBasic.All
• MailboxItem.Export.All
• MailboxItem.Read.All

  and skip to this step.

If you are configuring a connection to your target Microsoft 365 (Office 365) tenant, select:

• User.ReadWrite.All
• Directory.ReadWrite.All
• Device.ReadWrite.All
• MailboxSettings.ReadWrite
• MailboxItem.ImportExport.All
• Mail.ReadWrite
• MailboxFolder.ReadWrite.All
• Mail.Send*

  and skip to this step.

  * This permission is required for the program to send email reports (learn more). If you don’t intent to use this feature, you don’t need to assign this permission to the CodeTwo app.

4. (SharePoint Online connections only) Click Add a permission once again and click APIs my organization uses (see Fig. 4.). Type Office 365 in the search box, click Office 365 SharePoint Online on the list and choose Application permissions. Select the following permissions:
   • Sites.FullControl.All
   • User.Read.All

     and click Add permissions.

Fig. 4. Listing all APIs available for your organization.

5. Back on the API permissions page, click the Grant admin consent for <your organization name> button (once it becomes available) and then click Yes to confirm (Fig. 5.).

Fig. 5. Granting the necessary consents.

Assigning certificates / secrets in Entra ID

You need to assign a certificate or client secret (app password) to the newly added application. This will allow the OAuth protocol to prove the application’s identity. Follow the steps below to assign a certificate or add a client secret to the CodeTwo application registered in Entra ID (Azure AD).

1. Navigate to Entra ID > App registrations > All applications and select the newly added application (in this example: CodeTwo Migration app).
2. In the navigation menu, click Certificates & secrets (see Fig. 6.). Now, you need to assign either a certificate or client secret to the CodeTwo application.
3. 3a To assign a certificate, click Certificates > Upload certificate, select your certificate file and click Add (Fig. 6.). The certificate needs to be signed with a key size of 2048 bits.

Fig. 6. Assigning a certificate in Entra ID.

1. 3b To add a client secret, click Client secrets > New client secret, enter a short description (e.g., CodeTwo Migration app), select the expiration time (whichever suits your needs) from the drop-down menu, and click Add (Fig. 7.).

Fig. 7. Creating a new client secret for an application registered in Entra ID.

Fig. 8. How to copy the client secret value to the clipboard.

Once done, the application registration process is completed. You can now configure a connection to Microsoft 365 (Office 365) in your CodeTwo software. All the information that you need to provide in the Application details step of the server connection wizard (Fig. 9.) is provided in Entra ID either on the application overview page (Application (client) ID and Directory (tenant) ID) or on the Certificates & secrets page (the Certificates or Client secrets tab).

Fig. 9. Providing the registration details in the target server connection wizard in CodeTwo Office 365 Migration.

For more information on how to configure server connections, refer to the user’s manual:

• CodeTwo Backup
• CodeTwo Office 365 Migration
• CodeTwo Exchange Migration