Azure Service Account — Setup Guide

Overview Use this guide to create and configure an Azure service account in MinuteView Console. This service account enables server-to-server integration with Microsoft Azure services including:
Azure Active Directory for user authentication and authorization
Azure Storage for file storage and blob operations
Microsoft Graph for SharePoint, OneDrive, and Office 365 integration
Azure Key Vault for secure credential management
Azure Cognitive Services for AI and machine learning capabilities
Azure SQL Database and other data services
This account uses application-only authentication with a client secret for automated, unattended operations — no user login is involved.

Which Azure account do I need?

Microsoft Azure — this page — application-only, authenticates with a client secret.
Microsoft Azure (Certificate) — application-only, authenticates with an X.509 certificate (no secret).
Microsoft Azure (OAuth) — delegated; a user signs in and authorises access.

Network Requirements

The Azure service account requires the MinuteView server to communicate directly with Microsoft's identity and API endpoints for token acquisition (both client credentials and OAuth authorization code flows) and for Microsoft Graph API calls. This means the MinuteView server must have outbound internet access to the following domains.

Required Firewall / Proxy Whitelist

The following domains must be accessible via HTTPS (port 443) from the server where MinuteView is installed:

Domain	Purpose
`login.microsoftonline.com`	OAuth token exchange, token refresh, and client credentials authentication
`graph.microsoft.com`	Microsoft Graph API calls (SharePoint, OneDrive, user profiles, etc.)

Server Access Required

These domains must be reachable from the server, not just from the user's PC. For OAuth-based accounts, the user's browser handles the initial login redirect, but the token exchange and all subsequent API calls are made server-side. For client credentials accounts, all communication happens server-side. If the server cannot reach these domains, authentication will fail with a connection error.

1) Create Azure App Registration

Register Application in Azure Portal

Sign in to Azure Portal → Microsoft Entra ID → App registrations
Click New registration
Configure application:
- Name: MinuteView Service Account
- Supported account types: Single tenant (recommended for service accounts)
- Redirect URI: Leave blank (not needed for service accounts)
Click Register

Collect Application Information

From the app's Overview page, note:

Application (client) ID: 12345678-1234-1234-1234-123456789012
Directory (tenant) ID: 87654321-4321-4321-4321-210987654321
Object ID: Used for role assignments

2) Create a Client Secret

Navigate to Certificates & secrets → Client secrets
Click New client secret
Description: MinuteView Service Secret
Expires: Choose an appropriate duration (24 months recommended)
Copy and securely store the secret value — it is only shown once

Prefer a certificate?

For production, a certificate credential is often preferred over a secret (longer-lived, harder to leak). To use one, create a Microsoft Azure (Certificate) account instead — it is documented on its own page.

3) Configure API Permissions

Microsoft Graph Permissions (Application)

Navigate to API permissions → Add a permission → Microsoft Graph → Application permissions

File and Content Access

Files.ReadWrite.All - Read/write all files
Sites.ReadWrite.All - SharePoint site access
Directory.Read.All - Read directory data

User and Group Management

User.Read.All - Read all user profiles
Group.Read.All - Read all groups
GroupMember.Read.All - Read group memberships

Mail and Calendar (if needed)

Mail.ReadWrite - Access all mailboxes
Calendars.ReadWrite - Access all calendars

Azure Management Permissions

For Azure resource management:

Azure Service Management → Application permissions → user_impersonation

Click Grant admin consent for [Organization]
Confirm the consent for all configured permissions

4) Assign Azure RBAC Roles

Resource-Level Permissions

Assign appropriate roles based on needs:

Storage Account Access

powershell

# Assign Storage Blob Data Contributor role
New-AzRoleAssignment -ObjectId "app-object-id" `
    -RoleDefinitionName "Storage Blob Data Contributor" `
    -Scope "/subscriptions/subscription-id/resourceGroups/rg-name/providers/Microsoft.Storage/storageAccounts/storage-name"

Key Vault Access

powershell

# Assign Key Vault Secrets Officer role
New-AzRoleAssignment -ObjectId "app-object-id" `
    -RoleDefinitionName "Key Vault Secrets Officer" `
    -Scope "/subscriptions/subscription-id/resourceGroups/rg-name/providers/Microsoft.KeyVault/vaults/vault-name"

Subscription-Level Access (if needed)

powershell

# Assign Reader role at subscription level
New-AzRoleAssignment -ObjectId "app-object-id" `
    -RoleDefinitionName "Reader" `
    -Scope "/subscriptions/subscription-id"

5) Create Service Account in MinuteView Console

Navigate to Console → Service Accounts
Click New to create a new service account
Configure the following settings:

Fill in the fields:

Field	Description	Example
Name	A descriptive name	`Azure-ServiceAccount-Prod`
Service Account Type	Select Microsoft Azure from the dropdown
Tenant Id	Directory (tenant) ID	`87654321-4321-4321-4321-210987654321`
Client Id	Application (client) ID	`12345678-1234-1234-1234-123456789012`
Client Secret	The secret value from step 2	(sensitive)
Scope	Microsoft API scope — leave the default unless targeting a specific API	`https://graph.microsoft.com/.default`

Click Test Connection to verify authentication
Click Save to create the service account

6) Integration Examples

Azure Storage Integration

json

{
  "storageAccount": "minuteviewstorage",
  "containerName": "documents",
  "connectionString": "DefaultEndpointsProtocol=https;AccountName=...",
  "useManagedIdentity": false,
  "serviceAccountId": "azure-serviceaccount-prod"
}

Microsoft Graph Integration

Access SharePoint sites and OneDrive:

http

GET https://graph.microsoft.com/v1.0/sites
Authorization: Bearer {access_token}

Azure Key Vault Integration

Retrieve secrets securely:

http

GET https://vault-name.vault.azure.net/secrets/secret-name?api-version=7.0
Authorization: Bearer {access_token}

7) Monitoring and Management

Azure Portal Monitoring

Enterprise applications → MinuteView Service Account
View sign-in logs and audit logs
Monitor API usage and performance
Review assigned permissions and roles

Token Management

Access tokens expire after 60-90 minutes
MinuteView automatically handles token refresh
Monitor for authentication failures in logs

Cost Monitoring

Track API calls to Azure services
Monitor storage and compute usage
Set up billing alerts for cost control

8) Security Best Practices

Access Control

Follow principle of least privilege
Regularly review and audit permissions
Use resource-specific roles instead of broad permissions
Implement conditional access policies where applicable

Secret Management

Store client secrets in Azure Key Vault or secure credential store
Never expose secrets in code or configuration files
Set up secret expiration alerts
Rotate secrets regularly (every 6-12 months)

9) Troubleshooting

Authentication Issues

Connection error / "Failed to retrieve authentication token"

The most common cause is that the MinuteView server does not have outbound internet access. For OAuth accounts, the Microsoft login page loads in the user's browser (which has internet), but the token exchange happens on the server. If the server is behind a firewall without internet access, this step fails. See Network Requirements above for the domains that must be whitelisted.

AADSTS700016: Application not found

Verify Client ID is correct
Ensure app registration exists in the correct tenant
Check if app was accidentally deleted

AADSTS7000215: Invalid client secret

Verify client secret hasn't expired
Check for typos or encoding issues
Generate new secret if needed

Permission Issues

Insufficient privileges

Verify API permissions are granted
Ensure admin consent was provided
Check RBAC role assignments for Azure resources

Access denied to resource

Review resource-level permissions
Verify service account has required roles
Check resource firewall and network restrictions

10) Maintenance Tasks

Regular Maintenance

Monitor certificate and secret expiration dates
Review and audit assigned permissions quarterly
Update API permissions as features evolve
Monitor sign-in logs for security anomalies

Secret Renewal

Generate a new client secret in Azure before the current one expires
Update the service account configuration in MinuteView with the new secret
Test connectivity
Remove the old secret from the Azure app registration after verification

Permission Auditing

Regularly review granted API permissions
Remove unused or excessive permissions
Document permission requirements for compliance
Implement approval process for permission changes

Appendix — Configuration Examples

Production Configuration

Name: Azure-Production-ServiceAccount
Type: Microsoft Azure
Client Id: 12345678-1234-1234-1234-123456789012
Tenant Id: 87654321-4321-4321-4321-210987654321
Client Secret: [secret-value]
Scope: https://graph.microsoft.com/.default

Development Configuration

Name: Azure-Development-ServiceAccount
Type: Microsoft Azure
Client Id: 87654321-4321-4321-4321-210987654321
Tenant Id: 12345678-1234-1234-1234-123456789012
Client Secret: [secret-value]
Scope: https://graph.microsoft.com/.default

For certificate-based authentication instead of a client secret, see the Microsoft Azure (Certificate) service account.

Service Accounts

Third-Party Apps

Azure Service Account — Setup Guide ​

Network Requirements ​

Required Firewall / Proxy Whitelist ​

1) Create Azure App Registration ​

Register Application in Azure Portal ​

Collect Application Information ​

2) Create a Client Secret ​

3) Configure API Permissions ​

Microsoft Graph Permissions (Application) ​

File and Content Access ​

User and Group Management ​

Mail and Calendar (if needed) ​

Azure Management Permissions ​

Grant Admin Consent ​

4) Assign Azure RBAC Roles ​

Resource-Level Permissions ​

Storage Account Access ​

Key Vault Access ​

Subscription-Level Access (if needed) ​

5) Create Service Account in MinuteView Console ​

6) Integration Examples ​

Azure Storage Integration ​

Microsoft Graph Integration ​

Azure Key Vault Integration ​

7) Monitoring and Management ​

Azure Portal Monitoring ​

Token Management ​

Cost Monitoring ​

8) Security Best Practices ​

Access Control ​

Secret Management ​

9) Troubleshooting ​

Authentication Issues ​

Permission Issues ​

10) Maintenance Tasks ​

Regular Maintenance ​

Secret Renewal ​

Permission Auditing ​

Appendix — Configuration Examples ​

Production Configuration ​

Development Configuration ​

Azure Service Account — Setup Guide

Network Requirements

Required Firewall / Proxy Whitelist

1) Create Azure App Registration

Register Application in Azure Portal

Collect Application Information

2) Create a Client Secret

3) Configure API Permissions

Microsoft Graph Permissions (Application)

File and Content Access

User and Group Management

Mail and Calendar (if needed)

Azure Management Permissions

Grant Admin Consent

4) Assign Azure RBAC Roles

Resource-Level Permissions

Storage Account Access

Key Vault Access

Subscription-Level Access (if needed)

5) Create Service Account in MinuteView Console

6) Integration Examples

Azure Storage Integration

Microsoft Graph Integration

Azure Key Vault Integration

7) Monitoring and Management

Azure Portal Monitoring

Token Management

Cost Monitoring

8) Security Best Practices

Access Control

Secret Management

9) Troubleshooting

Authentication Issues

Permission Issues

10) Maintenance Tasks

Regular Maintenance

Secret Renewal

Permission Auditing

Appendix — Configuration Examples

Production Configuration

Development Configuration