Azure app registrations

Settings > Azure App Registrations is the surface behind everything MSPControl does in a customer’s Microsoft tenant. Four screens:

Screen	Purpose
Azure App Dashboard	State of the registered applications across customers
Azure App Registrations	The applications themselves
Azure Application Groups	Groups of applications, for applying configuration in sets
Azure Consent Approvals	Consent granted by customers to those applications

Why this matters more than its size suggests

A tenant application is what lets MSPControl read and change a customer’s Microsoft 365. Its permission scope decides what the panel can do — and that decision reaches all the way to what menus a technician sees.

A read-only application silently removes menus elsewhere

Where an organization’s tenant application is read-only, whole menu groups disappear rather than appearing disabled:

• Microsoft Teams vanishes entirely
• Exchange Online is reduced to signature management, or disappears completely without user-management permission

Neither is a fault, and neither is obvious from the affected screen. When a technician reports missing menus for one customer, this is the screen to check. See accounts, roles and what you can see.

Consent approvals

A customer must consent before an application can act in their tenant. This screen tracks those approvals.

Consent is the customer's decision to make

The approval grants an application standing access to their Microsoft 365 data. It should be granted by someone at the customer with the authority to do so, following a request they understand — not walked through by a technician who needs the permission to finish a task.

If a customer asks what they are approving, the honest answer is the permission scope on the application, which is visible here.

Application dashboard

The dashboard shows application state across customers, which is where credential expiry surfaces.

An expired application credential stops management for that customer

Tenant applications hold credentials that expire. When one does, MSPControl loses its ability to manage that customer’s Microsoft 365 — and the symptom is errors in unrelated places rather than a message saying the credential expired.

Treat approaching expiry as scheduled work. Discovering it through a failed provisioning run is the expensive path.

Why the group may be missing

The Azure App Registrations group renders only when at least one of its four screens is visible to you. All four are gated on peer-role permissions, so a technician without those permissions sees no group at all rather than an empty one.

That is true of every group under Settings: an absent group usually means peer-role permissions, not a missing feature.

Related

• Accounts, roles and what you can see
• Microsoft 365
• Peer roles