Create your app registration
Create the single-tenant Entra app registration Kairavo signs in with, add the delegated Microsoft Graph permissions and grant admin consent.
Kairavo has no vendor app in your tenant. You create an app registration in your own Entra tenant, and Kairavo signs in through it. You control which permissions it has, and you can remove it at any time.
The app registration is a public client. Kairavo signs in with the authorization code flow and PKCE in your default browser. It never uses a client secret or a certificate.
Create the app registration
In the Microsoft Entra admin center, open App registrations and select New registration.
Enter a name, for example Kairavo. Under supported account types, choose Accounts in this organizational directory only (single tenant). Select Register.
Open Authentication. Add the platform Mobile and desktop applications with the redirect URI http://localhost.
Set Allow public client flows to Yes and save.
Do not create a client secret or a certificate. Kairavo does not use them.
On the Overview page, copy the Application (client) ID and the Directory (tenant) ID. You enter both in Kairavo when you connect your tenant.
Add the permissions
Kairavo signs in with the scope https://graph.microsoft.com/.default. The token carries exactly the permissions you consent to on the app registration, and nothing else.
Every permission below is a delegated, read-only Microsoft Graph permission. Monitoring never changes your tenant.
Open API permissions and select Add a permission.
Choose Microsoft Graph, then Delegated permissions.
Add every permission in the table below.
| Permission | Why Kairavo needs it |
|---|---|
DeviceManagementManagedDevices.Read.All | Managed devices, detected apps, Autopilot deployment events, remediation and script run states, and Endpoint analytics |
DeviceManagementConfiguration.Read.All | Configuration profiles, Settings Catalog policies, administrative templates, endpoint security policies, compliance policies, assignment filters, Windows update profiles and compliance setting reports |
DeviceManagementApps.Read.All | Apps, app protection and app configuration policies, Apple Apps and Books tokens, and Intune audit events |
DeviceManagementScripts.Read.All | PowerShell scripts, macOS shell scripts and remediation scripts |
DeviceManagementServiceConfig.Read.All | Enrollment configurations, Autopilot profiles and registered identities, Apple automated enrollment tokens and mobile threat defense connectors |
DeviceManagementRBAC.Read.All | Intune roles, scope tags and multiple administrative approval requests |
Group.Read.All | Groups that policies and apps are assigned to, and their members |
Device.Read.All | Entra device objects, so device members of assigned groups can be matched to managed devices |
Organization.Read.All | Your subscribed Microsoft licenses |
Policy.Read.All | Conditional Access policies and named locations |
Policy.Read.AuthenticationMethod | Authentication strengths and the authentication methods policy |
AuditLog.Read.All | Entra directory audit events |
CloudPC.Read.All | Windows 365 Cloud PCs |
ServiceHealth.Read.All | Microsoft 365 service health overview and issues |
ServiceMessage.Read.All | Microsoft 365 message center posts |
You can leave a permission out. Kairavo still works. The data source that needs it shows "consent required" in collection coverage, and every other source keeps collecting.
Some sources also need a directory role for the admin who signs in. Entra directory audit events need a role such as Reports Reader. Windows 365 and service health need a role that may read them, for example Cloud PC Reader or Service Support Administrator. Without that role, those sources show "insufficient role".
Grant admin consent
On API permissions, select Grant admin consent for your tenant.
Confirm. The status of every permission changes to granted.
An administrator who can grant tenant-wide admin consent, such as a Privileged Role Administrator, must do this before other admins sign in. Without it, their sign-in asks for consent they cannot give.
Optional: permissions for automations
Kairavo monitors with read permissions only. Automations you run yourself can change your tenant or send email, but only when you allow it.
- Automations that only read use the same sign-in as collection. They can use only the permissions consented on your app registration.
- Automations that change your tenant or send email stay off until you turn on Allow automations that change your tenant on the Automation page. Every such run asks for your confirmation in a system dialog first.
- A run that changes the tenant signs in with the exact permissions the script declares. If they are not consented yet, Microsoft asks for consent in the browser.
Write permissions used by the bundled automation library include:
| Permission | Used for |
|---|---|
DeviceManagementManagedDevices.ReadWrite.All | Changing managed devices, for example fixing the primary user or removing duplicate device records |
DeviceManagementManagedDevices.PrivilegedOperations.All | Remote actions such as sync, restart, rename and wipe |
DeviceManagementApps.ReadWrite.All | Removing orphaned apps |
DeviceManagementConfiguration.ReadWrite.All | Restoring Intune configuration |
DeviceManagementServiceConfig.ReadWrite.All | Removing orphaned Autopilot devices |
Group.ReadWrite.All | Creating groups and adding devices to groups |
Mail.Send | Sending email from an automation |
Add only the write permissions you need. If your admins cannot consent themselves, add the permissions to the app registration and grant admin consent before the first run.
Once a write permission is consented on the app registration, every sign-in through it can carry that permission. Collection still only reads: it refuses every request that is not a read. If you want the app registration to stay read-only, grant no write permissions and leave Allow automations that change your tenant off.
Next, connect your tenant.