Azure AD App Creation

Authentication for Azure in Rencore Governance operates differently from other services. Instead of an automated setup, the Entra ID application must be manually created within the specific tenant designated for scanning. This manual process ensures proper integration and allows Rencore Governance to access the necessary resources securely.

Create an Entra ID App

1. Go to the Microsoft Entra Admin Center.

2. In the left-hand navigation menu, under “Entra ID”.

3. Click on “Applications” and “App registrations”.

4. At the top of this page, click ”+ New registration”.
   

   
   1. In “Name”, enter “Azure Governance for Rencore”.
   2. For “Supported account types”, select “Accounts in this organizational directory only”.
   3. Click “Register”.

Create a Client Secret

Once the app is created under “Manage”.

1. Click on “Certificates & secrets”.

2. Select “Client secrets” and then click ”+ New client secret”.

   

   1. In the Description, enter something like “RencoreGovernance_Azure2025”.
   2. Set “Expires” to “Recommended: 180 days (6 months)”.
   3. Click “Add”.
   Tip: Copy the Value key immediately, as it will only be displayed once; you will need this later.

Set API Permissions

Again, under “Manage” in the “Azure Governance for Rencore” app.

1. Click on “API permission”.

2. Click ”+ Add a permission”.

   1. Select “Azure Service Management”.
   2. Select “Delegated permissions”.
   3. Select user_impersonation
   4. Click “Add permissions”.

Set Authentication

Once more, under “Manage” in the “Azure Governance for Rencore” app.

1. Click on “Authentication”.

2. Click “Add Redirect URI”.

3. Click “Web”.

   

4. In “Redirect URI” enter “https://app.rencore.com”.

5. Click “Configure”.

6. Click on “Web” again.

7. Under “Redirect URI” enter the relevant URI below as per the Datacenter your workspace resides in.
   

   
   • https://australiaeast.app.rencore.com
   • https://centralus.app.rencore.com
   • https://gwc.app.rencore.com
   • https://sn.app.rencore.com
   • https://westeurope.app.rencore.com

8. Once the additional URI is entered, click “Configure”.

Assign App Reader Role

Subscription Level

Giving permissions per Subscription is the recommended approach to give better control over permissions for Rencore Governance.

To scan Subscription data, add your newly created app to the relevant subscriptions—either all or selected ones—and assign it the “Reader” role.

1. Open the Azure subscription that you wish to allow scanning in the Azure Portal

2. Click “Access Control ” in the left-hand menu.

3. Click “+Add”.

4. Then select “Role Assignment”.

5. Select “Reader” from the list of Roles,

   1. Click “Next”.

6. Click “Select members” and add the “**Azure Governance for Rencore” ** app created earlier as a member.

7. Click “Next” and “Review & Assign”.

   
   
   Note : Granting the Reader role at the subscription level is required to retrieve Daily Costs data for Copilot Studio. Daily Costs is the only Copilot Studio inventory item scanned via Azure - all other Copilot Studio inventory is retrieved via Copilot Studio scan. Without his step, Daily Costs will show no data.

Management Group Level

Assigning permissions at the Group level widens the scope of restrictions in Rencore Governance. These permissions must be applied individually to each Group, or at the Tenant Group level if you want them to apply across the entire tenant.

To scan Management Group data, add your newly created app to the relevant Groups, and assign it the “Reader” role.

1. Copy the name of the newly created app.

2. In the Azure Admin Portal, search for “Management groups”.

3. Click on the Required Group.

   Tip: App permissions can be applied at the individual Group level or at the Tenant Group level. Setting them per Group limits governance to that group, while setting them at the Tenant Group level applies governance across the entire tenant.

4. Click “Access control (IAM)”.

   

5. Click “+Add”.

6. Select “Reader” from the list of Roles,

   1. Click “Next”.

7. Click ”+ Select members” and paste the name of the app into the Search bar. Click on the App, then click “Select”.

   

8. Click “Next”,

9. Review the details and click “Next” and “Review & Assign”.

Repeat this to any additional Groups you want the app to access.