(Optional) Create an App registration

This task is only required when the FortiSandbox instance is using the Service Principle method to communicate with the Azure platform.

To create an App registration:

1. Log in to the Azure portal.
2. Go to Azure Active Directory > App registrations and click New registration.

   

3. Register a new application.

   Name	Enter the application display name.
   Supported account types	Select Accounts in this organizational directory only (Default Directory only –Single tenant).
   Redirect URI	This section is optional.

   

4. Go to Manage > App Roles.

   

5. Click Create app role and configure the following settings:

   Display name	Enter the display name for the app role.
   Allowed member types	Select Both (Users/Groups + Applications).

   

6. Go to Manage > Certificates & secrets and click create a New client secret.

   

7. Go to API permissions. As a minimum requirement, the following items should be granted API permissions.

   For items:

   Azure Service Management	This is for managing deployments, hosted services, and storage accounts.
   Azure Storage	This is for programmatic access to the Blob, Queue, Table, and File services in Azure or in the development environment via the storage emulator.

   1. Click Add a permission.
   2. Click the item name.
   3. Click the Delegated permission tab.
   4. Select user_impersonation.
   5. Click Add permissions.

   For Microsoft Graph:

   Files	ReadWrite This allows FortiSandbox to read, create, update, and delete the signed-in user's files.
   User	Read This allows FortiSandbox to read the signed-in user's information.

   1. Click Add a permission.
   2. Click the item name.
   3. Click the Delegated permission tab.
   4. Select the permissions.
   5. Click Add permissions.