How to configure Microsoft 365

Overview

This guide walks you through creating a Microsoft 365 app registration that Dex can use to manage a customer tenant. At the end you will have three values to paste into the Add tenant dialog:

1. Directory (tenant) ID
2. Application (client) ID
3. Client secret value

The process takes about 5–10 minutes and must be performed by someone with Global Administrator (or Privileged Role Administrator + Cloud Application Administrator) on the customer's Microsoft 365 tenant.

Before You Start

You will need:

• A user account with Global Administrator rights in the customer's Microsoft 365 tenant.
• Access to the Microsoft Entra admin center (or the Azure portal).
• About 10 minutes.

1. Sign in to https://entra.microsoft.com as a Global Administrator of the customer tenant.
2. In the left menu, go to Identity → Applications → App registrations.
3. Click + New registration.
4. Fill in:
   • Name: Dex (or any name — only shown to admins inside Entra).
   • Supported account types: Accounts in this organizational directory only (Single tenant).
   • Redirect URI: leave blank.
5. Click Register.

On the app's Overview page, copy these two values:

1. In the left menu of the app, click Certificates & secrets.
2. Under the Client secrets tab, click + New client secret.
3. Fill in:
   • Description: Dex integration
   • Expires: choose the longest option your security policy allows (24 months recommended). You will need to rotate the secret before it expires.
4. Click Add.
5. Immediately copy the Value column (not the Secret ID). This is shown only once — if you navigate away you will need to create a new secret.

Paste this value into the Client secret field (third field) in the Dex Add tenant dialog.

This is the most important step. Dex needs a specific set of Microsoft Graph application permissions. If any are missing, the Add tenant validation will fail and tell you exactly which roles still need consent.

4a. Add the permissions

1. In the left menu of the app, click API permissions.
2. Click + Add a permission.
3. Choose Microsoft Graph.
4. Choose Application permissions (not Delegated).
5. Search for and add each permission listed below. You can add them in batches — search, tick the checkboxes, and click Add permissions, then repeat.

4b. Grant admin consent

After all permissions are added:

1. Back on the API permissions page, click Grant admin consent for <tenant name>.
2. Confirm. The Status column should turn into a green check (Granted for <tenant>) for every row.

Required Microsoft Graph application permissions

All permissions below are Application type, on the Microsoft Graph API. Dex's validator checks for every one of these — if any are missing, you will get a MISSING_PERMISSIONS error listing exactly which roles still need consent.

1. Return to the Dex Add tenant dialog.
2. Enter an Organization name (this is the label that will show in your MSP dashboard — it does not need to match the M365 tenant name).
3. Select Microsoft 365.
4. Paste the three values you collected:
   • Tenant ID → from the app's Overview page
   • Client ID → from the app's Overview page
   • Client Secret → the Value you copied in Step 3
5. Click Add Tenant.

Dex will:

Troubleshooting

Rotating the secret later

Client secrets expire. To rotate without downtime:

1. In the app's Certificates & secrets page, create a new client secret.
2. In the Dex MSP dashboard, open the tenant and update its credentials with the new secret Value.
3. Once Dex confirms the new secret works, delete the old secret in Entra.