Set up the Entra app registration (Realsmart Entra Sync)

4 steps 4 min Updated 4 November 2026

Connecting a school to Microsoft Entra needs an app registration in your Microsoft tenant. It's where the Tenant ID, Client ID and Client secret you enter in Microsoft Entra settings come from, and where the Microsoft Graph permissions the sync needs are granted. Set it up before entering the connection details.

Before you start

Whoever administers your Microsoft 365 does this once, in the Microsoft Entra / Azure admin center.
In a trust that runs one Microsoft 365 tenant for all its schools, the same connection details can be pushed to every school — see Rolling out across a trust.

Steps

Step 1: Register the app

In the admin center's top search bar, search for App registrations and open it, then select New registration.
Under Name, enter Realsmart Entra Sync. For the supported account types, choose either single tenant or multitenant (the first two options) — single tenant is the usual choice for one school's own directory.
Register the app. On its Overview page you'll find the Application (client) ID and the Directory (tenant) ID — these are the Client ID and Tenant ID you enter in Microsoft Entra settings.

Step 2: Create a client secret

Go to Manage → Certificates & secrets, select New client secret, and create one. Copy the secret's Value immediately — Microsoft shows it only once — and treat it like a password. That value is the Client secret. When it expires, create a new one here and type it into the masked Client secret field in Entra settings.

Step 3: Grant the Microsoft Graph permissions

Still in the app registration, open API permissions → Add a permission → Microsoft Graph → Application permissions. These are application permissions — the sync signs in as the app itself, not as a person, so the Delegated permissions tab is not used. Grant the following:

Permission	What it lets the sync do	Needed when
User.ReadWrite.All	Create, update, enable/disable and delete user accounts	Always
Group.ReadWrite.All	Create and delete groups and manage their membership	When Sync groups is on
AdministrativeUnit.ReadWrite.All	Create and delete administrative units and manage who belongs to them	When Sync administrative units is on, or when you choose A unit Realsmart keeps up to date for the Microsoft 365 launchpad widgets. Grant this one by name — Directory.ReadWrite.All doesn't cover it
Organization.Read.All (or LicenseAssignment.Read.All)	Read which Microsoft 365 licences your tenant has and how many are free	When Assign Microsoft 365 licences is on — see Microsoft 365 licences. Giving the licences out is already covered by User.ReadWrite.All. Class Teams with Assignments also use it, to check for an Education licence
EduRoster.ReadWrite.All	Create Education classes and keep their teachers and pupils up to date	When Class Teams with Assignments is on — see Class Teams with Assignments. Grant it by name: Directory.ReadWrite.All doesn't cover it
Team.Create	Turn each class into a class Team	When Class Teams with Assignments is on. Grant it by name too

Grant the ones that match what you've switched on in Step 3 of Entra settings and the Licences section — granting them all is fine and future-proofs the setup.

Prefer one permission instead of several? Granting Directory.ReadWrite.All on its own covers users, groups and reading your licences together — but not administrative units: Microsoft won't let the sync create them without AdministrativeUnit.ReadWrite.All, so grant that as well if you use Sync administrative units or A unit Realsmart keeps up to date for the launchpad widgets. Nor does it cover class Teams: grant EduRoster.ReadWrite.All and Team.Create by name if you use Class Teams with Assignments. It's broader than the least-privilege set above, so use it only if your Microsoft 365 administrator is comfortable with a single wide-scoped permission.

Step 4: Grant admin consent

Select Grant admin consent for Default Directory so these permissions apply across the whole tenant, not just to the admin who added them. Do it again whenever you add a permission later.

Then enter the IDs and secret in Microsoft Entra settings, save, and use Test permissions on the Test connection page to confirm the sync can do everything you've switched on.

Password sync needs a role as well

To send password changes to accounts that already exist (Sync passwords to Entra), the app also needs the User Administrator role in your tenant — a role assignment, not a Graph permission. See Passwords.

Did this work for you?

If a step looked different on your site, tell us and we'll update the screenshots.