This guide walks you through creating an App Registration in Entra ID (formerly Azure Active Directory) for Chipmunk, and assigning the necessary Microsoft Graph and Exchange permissions.

Chipmunk uses Microsoft Graph and Exchange APIs to back up OneDrive, Exchange, and Teams data for disabled users. You'll need to register an app in your Azure tenant and grant it the correct permissions.

Before you register the app, decide what DNS name your Chipmunk appliance will use (e.g., chipmunk.yourcompany.local). This will be used in the redirect URI.

Also ensure you have:

• A TLS certificate matching that DNS name.
• A DNS A-record pointing to your Chipmunk appliance’s internal IP.

1. Go to Azure Portal 2. Search for App registrations and click + New registration 3. Enter:

• Name: ChipmunkApp
• Supported account types: *Accounts in this organizational directory only*
• Redirect URI (Web):
  1. `https://chipmunk.YOURDOMAIN/api/auth/callback/azure-ad`
  2. `https://chipmunk.YOURDOMAIN:3000/api/auth/callback/azure-ad` *(optional, see below)*

4. Click Register

Note: During initial setup, Chipmunk may temporarily use port 3000 for configuration access. You should include both redirect URIs above during deployment. Once Chipmunk is fully configured and using port 443, you may safely remove the port 3000 URI from the App Registration for security tightening.

After registration, copy these values from the Overview page:

• Application (client) ID
• Directory (tenant) ID

You'll use these during Chipmunk's first-time configuration.

1. Go to Certificates & secrets 2. Click + New client secret 3. Name it something like ChipmunkSecret 4. Set expiry to 12 or 24 months 5. Click Add

→ Important: Copy the Value immediately — you won't be able to see it again.

Navigate to API permissions > + Add a permission > Microsoft Graph > Application permissions

Add the following:

Then click:

• + Add a permission
• Choose Office 365 Exchange Online
• Select `full_access_as_app` (Application)

Click Grant admin consent for [Your Tenant Name] and confirm. All permissions should show as “Granted”.

Under Authentication, verify:

• Redirect URIs include both `https://chipmunk.YOURDOMAIN` and `https://chipmunk.YOURDOMAIN:3000`
• ✅ ID tokens checked under “Implicit grant and hybrid flows”

When the Chipmunk appliance launches, you’ll enter:

• ✅ Tenant ID
• ✅ Client ID
• ✅ Client Secret
• ✅ Redirect URI domain (must match your DNS/cert setup)

Need help with DNS or TLS? → View DNS & Certificate Setup

chipmunk azure appregistration graphapi permissions setup