> ## Documentation Index
> Fetch the complete documentation index at: https://docs.curator.interworks.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Azure Registered App Setup

> Step-by-step guide to set up Azure application registration for non-admin Power BI integration with Curator.

## Steps

<ol />

## Creating a Registered App within the Azure Portal

This registered app will be used for authentication to the Power BI non-admin APIs on behalf of users accessing
Power BI content within Curator.

1. Log in to the [Azure Portal](https://portal.azure.com);

2. Search for “App Registrations” to start the process.  You may also find them inside the
   *Microsoft Entra ID* > *Manage* > *App Registrations*.

3. Click the button to register a new application.

4. Give the app a distinct and descriptive name and provide a redirect URI during this process under the "Web"
   platform.  The redirect URI should follow
   this format:

   `https://curatorexample.com/powerbi`

   > [!WARNING]
   >
   > If the redirect URI is not configured correctly, users will see an error like:
   >
   > `AADSTS50011: The redirect URI specified in the request does not match the redirect URIs configured for the application.`
   >
   > **To fix this:**
   >
   > 1. Go to [Azure Portal](https://portal.azure.com)
   > 2. Find your app registration
   > 3. Click **Manage** > **Authentication (Preview)** in the left navigation
   > 4. Add a **Web** redirect URI using your Curator portal's domain with the `/powerbi` suffix (e.g., `https://curatorexample.com/powerbi`)

5. Once the app is registered, make note of the following details from the “Overview” page as you will need them when
   setting up the configuration on Curator:
   * Application (client) ID
   * Directory (tenant) ID
   * Application ID URI

## API Permissions

Your InterWorks Curator Azure Registered App will need several delegated API permissions.  While still viewing the
registered app, click on *Manage* > *API permissions* in the left navigation.  Add the following permissions as delegated
permissions:

> [!NOTE]
>
> Curator uses the OAuth delegated permission flow, which requires each user to sign in with their own Microsoft account.
> Application-level (service principal) permissions are not compatible with this registered app. If you need to configure a
> service principal for the Admin API, see the
> [Azure Admin Registered App Setup](https://docs.curator.interworks.com/creating_integrations/power_bi_connection/azure_admin_app_setup.md) page.

* Microsoft Graph
  * User.Read
* Power BI Service
  * Dashboard.Read.All
  * Dataset.Read.All
  * Report.Read.All
  * Workspace.Read.All

If you intend to use **persistent filters** or other functionality that tracks user state, you'll also need to add:

* Power BI Service
  * UserState.ReadWrite.All

> [!NOTE]
>
> Depending on your level of access, you may need to ask Azure administrators to grant admin consent for these permissions.

## Create a Client Secret

> [!NOTE]
>
> Curator's Power BI integration supports client secret authentication only.  Do not use the *Certificates* tab to configure
> certificate-based authentication, as it is not supported.

1. While still viewing the registered app, click on *Manage* > *Certificates & secrets* in the left navigation.
2. Click the button to add a new client secret.
3. Fill in the description and adjust the expiration date as desired, and click the save button.
4. Copy the client secret **value** and document it in a secure place.
   \[!NOTE] You will not be able to retrieve the value again once you leave this screen.
   \[!WARNING] Do not confuse this with the *Secret ID*.  Curator must have the secret *value* to authenticate.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.