← AZ Atlas · Quickstart

Use your own app registration

AZ Atlas signs in with its own multi-tenant app registration. It is not publisher-verified yet, so some tenants only allow it after an admin approved it ("Need admin approval"). You then have three options:

1. Azure CLI sign-in. Run az login --tenant <tenant> in a terminal, then choose "Use Azure CLI sign-in" in AZ Atlas. AZ Atlas asks the CLI for read tokens; nothing else is needed.
2. Azure PowerShell sign-in. With PowerShell 7 (on Windows also Windows PowerShell 5.1) and the Az module, run Connect-AzAccount -Tenant <tenant>, then choose "Use Azure PowerShell" in AZ Atlas. AZ Atlas asks Get-AzAccessToken for read tokens, for each tenant explicitly.
3. Your own app registration in that tenant (an admin of the tenant registers it once):
   1. Microsoft Entra admin center → App registrations → New registration.
      • Supported account types: Accounts in this organizational directory only.
      • Redirect URI: platform Public client/native (mobile & desktop), value http://localhost.
   2. No client secret or certificate.
   3. API permissions → Add a permission → Azure Service Management → Delegated → user_impersonation. Remove Microsoft Graph User.Read; AZ Atlas does not use it. Grant admin consent for the tenant.
   4. Copy the Application (client) ID.
   5. In AZ Atlas: sign-in screen → Advanced: use my own app registration → enter the tenant ID and the client ID → Save → Sign in with browser.

AZ Atlas uses that client ID only for that tenant. Removing it (an empty client ID) switches the tenant back to the AZ Atlas app.