The Configure link lets your Microsoft 365 Global Administrator create the app registration Data & More uses — in your own Entra ID, owned by you, with permissions you choose product by product.
What this is
Your Data & More contact sends you a Configure link by mail. Opening it takes you to a guided page where you sign in with Microsoft, pick what the integration may access, and create a new app registration in your own Entra tenant. Data & More never receives administrator credentials; the app is created by you, in your tenant, owned by your signed-in administrator account.
The page does exactly one thing: it creates the application, its service principal, the API permissions you selected, admin consent, and a credential, and stores the resulting connection details with Data & More. It does not create any data sources and nothing is scanned from this page. Scanning only begins later, when your Data & More administrator creates sources that use this registration — limited to the permissions you granted here.
Who should open the link. Only a Microsoft 365 Global Administrator can complete the flow. If that isn't you, simply forward the link to one — Microsoft will refuse the sign-in for anyone else, and nothing is created or changed in your tenant. The link is valid for 14 days.
Applies to links of the form https://dgm.dataandmore.com/app-registration/configure?token=….
The four steps
1. Sign in — read only
You sign in at Microsoft as Global Administrator. This first consent grants the Data & More App Registration Helper only read rights: User.Read, RoleManagement.Read.Directory (to confirm the Global Administrator role) and GroupMember.Read.All (to search for a scope group). These are delegated permissions — they work only while you are on the page, and you can revoke them under Entra ID → Enterprise applications afterwards. Nothing is created at this step.
Step 1 — the sign-in page. The read-only permissions are listed before you click anything.
2. Configure — choose what the app may access
Name the registration and pick a preset, or open the custom view to toggle each product individually. The panel on the right always shows exactly the Microsoft permissions that will be created and consented — nothing more.
Preset | What it covers | Default credential |
|---|---|---|
Demo | Exchange and OneDrive, read only. For proofs of concept. | Client secret (24 months) |
Production | Outlook, SharePoint, OneDrive and Teams, with deletion enabled, plus Purview labels. | Data & More certificate |
Production + DLP | Production, plus mail, Teams and Copilot data-loss-prevention. | Data & More certificate |
You also choose the scope: the entire tenant, or one Entra security group so only its members are included. With the certificate credential no secret is stored anywhere; with a client secret, it is valid 24 months and expiry reminders are handled by Data & More.
Step 2 — the product picker with custom configuration open. The right-hand panel shows exactly the permissions that will be created.
3. Create — second consent, then the app is made
Only when you click Create does Microsoft ask for the rights to actually create the registration (Application.ReadWrite.All, AppRoleAssignment.ReadWrite.All, delegated, same account). The page then registers the application, creates its service principal, assigns the permissions you selected, grants admin consent, adds the credential, and verifies the result by fetching a test token. If any step fails, everything already created is rolled back automatically — a failed run leaves nothing behind in Entra.
4. Done — review and hand over
The final page shows the name, app (client) id, tenant, owner and credential, with a full list of granted permissions and a Download documentation button for your records. Your Data & More administrator is notified and can now create sources that use this registration. Until then, nothing is scanning.
Step 4 — the Done page with the registration details, the "nothing is scanning" confirmation, and any follow-up steps.
After completion — possible follow-ups
Exchange DLP needs one extra step: Data & More completes it with you under DLP Policies → Grant Exchange access, which requires an Exchange administrator sign-in. Until then, outgoing mail is not held in transit.
Outlook pre-send add-in: if selected, the add-in is ready in Entra; your Data & More administrator downloads the manifest and you upload it in the Microsoft 365 admin center (Integrated apps).
Sign-in for your users: if sign-in was enabled, people in your tenant can sign in to Data & More with their Microsoft account; the Done page offers a one-click consent link if it was not granted during the run.
Security, in plain terms
The link is signed, bound to one company, and expires after 14 days.
Your administrator token is held server-side for the duration of the run only (at most one hour) and never reaches the browser or Data & More staff.
The browser session is bound with a cookie, so a Microsoft sign-in URL forwarded to someone else cannot hand over your session.
The helper application holds no standing permissions in your tenant — it can do nothing unless a Global Administrator is actively signed in on the page.
A client secret, if used, goes directly from Microsoft into Data & More's encrypted storage and is never displayed.
You stay in control: delete the app registration in Entra ID — or remove individual API permissions — and Data & More loses access immediately.
Troubleshooting
"This account cannot grant admin consent"
You signed in with an account that doesn't have the Global Administrator role. Nothing was created. Use Sign in with a different account, or forward the link to a Global Administrator.
The link has expired
Configure links are valid 14 days. Ask your Data & More contact to send a fresh one — it takes them one click.
"Consent still propagating"
Microsoft can take a moment to propagate admin consent. The verification retries automatically for up to a minute and again on first use; no action needed.
A step failed mid-run
The run rolls back automatically and shows "Rolled back". If the page tells you to check Entra ID for a leftover application, delete it under App registrations before retrying.
The certificate option is greyed out
The Data & More certificate isn't available in this environment; the page falls back to a 24-month client secret. SharePoint site-owner lookups stay off until the registration is switched to a certificate.
For Data & More workspace administrators
You generate the link under Settings → App registrations → Configure, inside the customer's workspace, and mail it with the prepared text. The customer's Global Administrator decides the products — you cannot pre-limit them on the link. When the run completes, the registration appears in Settings → App registrations with a Tenant-created chip and zero sources; granted permissions are visible read-only in the edit dialog, and secret-expiry reminders work as for any other registration.
See also Application registration and permissions for the permission lists of Demo, Production and Production + DLP.