Configure Microsoft Entra ID App Registration

Configure one Microsoft Entra ID app registration for Siesta AI sign-in, enabled Microsoft 365 connectors, optional Entra group synchronization, and the Siesta AI client apps your organization deploys. Complete this work before broad onboarding so every approved surface uses redirect URIs and permissions owned by your organization.

Before You Start

You need a Microsoft Entra administrator who can create the registration, add Microsoft Graph permissions, and grant tenant-wide admin consent.

Review the tenant's Organization Security settings before enabling Microsoft sign-in. For Outlook-specific capabilities and scopes, also review the Microsoft Outlook connection guide.

For a customer-controlled Azure environment, establish the private-mode and identity contract before registering redirects or granting consent.

Collect these values before you begin:

• the Siesta AI web application base URL, written as <APP_BASE_URL> below and entered without a trailing slash;
• the Microsoft Entra Directory (tenant) ID;
• the Application (client) ID generated for this registration;
• the Siesta AI surfaces and Microsoft 365 connectors your organization will enable.

Use placeholders in runbooks and support messages. Do not publish client secrets, authorization codes, tokens, certificate private keys, or customer tenant identifiers. The Application (client) ID identifies a public OAuth client, but each private deployment must use the ID from its own registration rather than copying an ID from another Siesta AI environment.

For one organization, use Accounts in this organizational directory only. Use a multi-tenant registration only when named external tenants must sign in through the same application. Each allowed tenant remains a separate consent boundary and needs approval from an administrator in that tenant.

Create the Registration

1. Open Microsoft Entra admin center → App registrations → New registration.
2. Enter the application name and choose the approved account type.
3. Leave the initial redirect URI empty and select Register.
4. Record the Directory (tenant) ID and Application (client) ID for the Siesta AI deployment configuration.

For a restricted multi-tenant registration, open Authentication → Supported accounts, select multiple Entra ID tenants, enable the option that limits access to named tenants, and add the approved tenant IDs. An administrator in every allowed tenant must then grant consent. A tenant administrator can use the tenant-specific admin-consent URL:

https://login.microsoftonline.com/<ALLOWED_TENANT_ID>/adminconsent?client_id=<APPLICATION_CLIENT_ID>

Web App and Browser Extension

Under Authentication → Add a platform → Web, register these redirect URIs:

<APP_BASE_URL>/login
<APP_BASE_URL>/invitation
<APP_BASE_URL>/internal/connections
<APP_BASE_URL>/internal/profile

If the organization uses Microsoft Entra group synchronization, also register:

<APP_BASE_URL>/internal/organization/settings/entra-callback

The Chrome and Edge extensions open the configured Siesta AI web application's /login page and detect the resulting Siesta AI session. They do not require a separate browser-extension platform or extension-specific Entra redirect URI.

Mobile App for iOS and Android

The published Siesta AI mobile app uses the same store identifiers for every deployment:

Platform in Entra	Parameter	Value
iOS / macOS	Bundle ID	com.siestaai.app
Android	Package name	com.siestaai.app
Android	Signature hash	qKG35VND7CbMO+PQHjSeuOol8bY=

Add the iOS/macOS and Android platforms under Authentication → Add a platform. Entra generates the matching msauth:// redirect URIs from these identifiers. Do not substitute a private deployment hostname for the package or bundle ID.

Windows App

The Windows App uses a desktop authorization-code flow with PKCE and a temporary loopback listener. Under Authentication → Add a platform → Mobile and desktop applications, add this exact redirect URI:

http://localhost:23847/callback

Use these parameters for a private deployment:

Parameter	Required value
Siesta AI OAuth platform	Desktop
Redirect URI	http://localhost:23847/callback
Callback port	23847
Microsoft tenant	The deployment's Directory (tenant) ID, or an explicitly approved tenant alias such as common
Microsoft client	The Application (client) ID from this registration

The Windows App starts the listener before opening the Microsoft authorization page and sends the authorization code to the Siesta AI API for exchange. PKCE makes this a public-client flow; do not distribute a client secret with the app.

macOS App

The native macOS App uses ASWebAuthenticationSession and a custom callback scheme. It does not open the Windows localhost listener.

Under Authentication → Add a platform → iOS / macOS, register the macOS desktop bundle and confirm the generated redirect URI:

Parameter	Required value
Bundle ID	ai.siesta.desktop.macos
Redirect URI	msauth.ai.siesta.desktop.macos://auth
Siesta AI OAuth platform	Desktop
Microsoft tenant	The deployment's Directory (tenant) ID, or an explicitly approved tenant alias
Microsoft client	The Application (client) ID from this registration

The imported enterprise deployment configuration supplies the customer-specific tenant and client IDs. Siesta AI sends the OAuth code to the deployment API using the Desktop provider contract. Register the redirect URI exactly, including its scheme, host, and lack of a trailing slash.

API Permissions and Admin Consent

Open API permissions → Add a permission → Microsoft Graph. Add only the delegated permissions required by the approved Siesta AI capabilities.

Delegated permission	Capability
openid, profile, email, offline_access	Sign-in and token refresh
User.Read	Signed-in user profile and Microsoft 365 connectors
Sites.Read.All, Files.Read.All	SharePoint and OneDrive read access
Mail.ReadWrite, Mail.Send	Outlook mail
Calendars.ReadWrite	Outlook calendar
Files.ReadWrite	Word and Excel file operations

For Entra group synchronization, add Group.Read.All as an Application permission. Group synchronization runs as a background client-credentials operation and currently requires a client secret even when certificate authentication is used for interactive sign-in.

After reviewing the configured permissions, select Grant admin consent for the tenant. In a multi-tenant setup, repeat consent in every allowed tenant. Admin consent approves requested permissions; it does not expand a user's Siesta AI role, team membership, agent access, or connection access.

Credentials

Prefer certificate authentication when the deployment supports it:

1. Open Certificates & secrets → Certificates.
2. Upload the public .cer certificate.
3. Keep the private key outside the documentation repository and distribute it only through the approved secret-management process.

If the deployment uses Entra group synchronization, create a client secret under Certificates & secrets → Client secrets. Choose an organization-approved expiry, copy the value once into the deployment's secret store, record its owner and rotation date, and never place it in documentation or a client application.

Troubleshooting

Symptom	Check first
Need admin approval	Required Graph permissions have not received tenant-wide admin consent.
Request sent to your admin	The user's home tenant has not approved the multi-tenant application.
AADSTS50011 redirect mismatch	Compare the complete redirect URI, including scheme, port, path, capitalization, and trailing slash.
Windows sign-in does not return to the app	Confirm http://localhost:23847/callback and check whether local security software blocks the loopback listener.
macOS sign-in does not return to the app	Confirm bundle ID ai.siesta.desktop.macos and redirect URI msauth.ai.siesta.desktop.macos://auth. Do not use the Windows localhost callback.
Group synchronization returns no groups	Confirm application permission Group.Read.All, admin consent, tenant ID, and an active client secret.
Some users remain blocked after consent	Review Enterprise applications → Properties → Assignment required and Conditional Access policies.
A granted permission appears missing	Review Enterprise applications → Security → Permissions as well as the configured permissions on the app registration.

After configuration, test one administrator and one pilot user on every enabled surface. A successful web sign-in does not prove that mobile, Windows, macOS, and browser-extension authentication are all configured correctly.