Page Comparison

As part of the process for deploying the SharePoint Online microservice, two service principal applications need to be registered in Azure. The first service principal is used to provide Azure AD authentication to the app service that hosts the microservice. The second service principal is grants Graph and SharePoint API permissions for the microservice to manage SharePoint. Required permissions for the second service principal include those listed in the below table.

API / Permissions Name	Description
Microsoft Graph
Sites.FullControl.All	Have full control of all site collections
User.Read	Sign and read user profile
User.ReadWrite.All	Read and write all users' full profiles
SharePoint
Sites.FullControl.All	Have full control of all site collections
User.Read.All	Read user profiles
User.ReadWrite.All	Read and write user profiles

Register a service principal for app service auth

In Azure, navigate to your Azure Active Directory.
On the Azure Active Directory navbar, click App registrations.
On the App registrations page, click New registration.
Name the application, select the scope (single or multitenant) and click Register.
Once the application is registered, copy the Application (client) ID and Directory (tenant) ID from the Overview page. These values are used later.
Navigate to the Certificates & secrets blade for the application and upload the base-64 encoded certificate you are using to secure HTTP traffic between EmpowerID and the microservice. The public key certificate that you upload to Azure must have a corresponding private key in the EmpowerID certificate store; otherwise, an error will occur when calling Azure’s API.
Add a client secret.
Save the secret. You add this to the key vault you create later.

Register a service principal for SharePoint API calls

Register a second service principal in Azure AD.
After the service principal is registered, navigate to API permissions for the application, click Add a permission and then add the application permissions specified in the above table.
When completed, your application permissions should look like those show in the below image.
Grant admin consent for the application.