# Microsoft Entra ID Configuration

## Prerequisites
- Access to Azure portal with Microsoft Entra ID subscription and administrator permissions (Global Administrator or Application Administrator role)

## Step 1: Create Required Resources
Create the following three resources as app registrations in Azure Entra ID.

### 1. **API Resource** (Create First)
Represents the API that your applications will communicate with.
- Navigate to Microsoft Entra Admin Center > App registrations > New registration
- Name: "Wallet API"
- Supported account types: Accounts in this organizational directory only (Single tenant)
- Redirect URI: Leave blank
- Click Register

**Expose an API:**
- Under Manage > Expose an API
- Add Application ID URI: `api://YOUR_CLIENT_ID`
- Add a scope:
  - Scope name: "access"
  - Who can consent: Admins and users
  - Admin consent display name: "Access Wallet API"
  - Admin consent description: "Allows access to the Wallet API"
  - User consent display name: "Access Wallet API"
  - User consent description: "Allows access to the Wallet API"
  - State: Enabled

**Token Configuration:**
- Under Manage > Token configuration > Add optional claim
- Token type: Access
- Select claim: "email"
- Save
- Check "Turn on the Microsoft Graph email permission"
- Add

**Manifest:**
- Under Manage > Manifest
- Set `"api.requestedAccessTokenVersion": 2`
- Save

### 2. **Single Page Application (SPA) Resource**
Represents your wallet application running in a web browser.
- Navigate to Microsoft Entra > App registrations > New registration
- Name: "Wallet App"
- Supported account types: Accounts in this organizational directory only (Single tenant)
- Redirect URI: Single-page application (SPA) - `https://wallet.yourcompany.com/login/callback`
- Click Register

**API Permissions:**
- Under Manage > API permissions > Add a permission > My APIs
- Select your API resource (e.g., "Wallet API")
- Select Delegated permissions
- Check the scope(s) you created (e.g., "access")
- Add permissions

**Authentication:**
- Under Manage > Authentication
- Verify platform: Single-page application (SPA)
- Verify Sign-in redirect URIs: `https://wallet.yourcompany.com/login/callback`
- Implicit grant and hybrid flows:
  - Ensure Access tokens and ID tokens are NOT checked (SPAs use Authorization Code flow with PKCE by default)
- Set `Allow public client flows` to Yes
- Save

**Manifest:**
- Under Manage > Manifest
- Set `"api.requestedAccessTokenVersion": 2`
- Save

### 3. **Native Application Resource**
Represents your approver application running natively on a device (mobile or desktop).
- Navigate to Microsoft Entra Admin Center > App registrations > New registration
- Name: "ApproverApp App"
- Supported account types: Accounts in this organizational directory only (Single tenant)
- Redirect URI: Public client/native (mobile & desktop) - add entries for both approver apps:
  - `com.blockdaemon.reactnativeapproverapp://callback` (Mobile ApproverApp)
  - `app://./callback` (Desktop ApproverApp)
- Click Register

**Authentication:**
- Under Manage > Authentication
- Verify redirect URIs include entries for both approver apps:
  - `com.blockdaemon.reactnativeapproverapp://callback` (Mobile ApproverApp)
  - `app://./callback` (Desktop ApproverApp)
- Advanced settings > Set `Allow public client flows` to Yes
- Save

**Manifest:**
- Under Manage > Manifest
- Set `"api.requestedAccessTokenVersion": 2`
- Save

## Step 2: Configuration Values
Collect these values from your Azure Entra ID configuration:
- **Entra ID Tenant ID:** [Your Tenant ID]
  - Entra ID > Overview > Tenant ID
- **Wallet App Client ID:** [Your Wallet App Client ID]
  - App registrations > Wallet App > Overview > Application (client) ID
- **ApproverApp App Client ID:** [Your ApproverApp App Client ID]
  - App registrations > ApproverApp App > Overview > Application (client) ID
- **API Audience:** [Your API Audience URI]
  - App registrations > Wallet API > Overview > Application ID URI
- **API Issuer URI:** [Your API Issuer URI]
  - Format: `https://login.microsoftonline.com/{tenant_id}/v2.0` (replace `{tenant_id}` with your tenant ID)

#### **🗣️ We Are Here to Help!**
Please contact us via email or support chat if you encounter an issue, bug, or need assistance. Don't forget to include any relevant details about the problem. To request a wallet form and Institutional Vault Approver form, please click here or contact our sales team.

Updated 3 months ago

* * *