16 articles
Getting Started·5 min read

Bring Your Own Application (BYOA)

BYOA lets an entitled tenant use its own Microsoft Entra app registration instead of the shared M365Suite app. The portal shows the Custom App Registration section only when the current plan allows BYOA.

Before you begin

Create a single-tenant app registration in the same Microsoft Entra tenant as the SharePoint sites you will protect. You need its Application (Client) ID.

The app needs application permissions that support the current product behavior:

  • Microsoft Graph Sites.Read.All for site discovery
  • Microsoft Graph Group.Read.All for audience group resolution
  • SharePoint Online Sites.Manage.All for navigation access and restore writes

Grant admin consent for the app after adding permissions.

Generate and upload the certificate

  1. Open Settings & Access → Connection → Custom App Registration.
  2. Enter the Application (Client) ID.
  3. Choose a certificate validity period. The portal offers one year, ten years, or a custom value from 30 through 3650 days.
  4. Select Generate Certificate.
  5. Download the generated public certificate file.
  6. Use the portal link or Microsoft Entra to open the app registration's Certificates & secrets page.
  7. Upload the public certificate to that app registration.
  8. Return to M365Suite and select Test Connection.

The connection test verifies that M365Suite can obtain a certificate-based token, discover sites through Microsoft Graph, and read SharePoint REST data. The custom app is not treated as active until the SharePoint check succeeds. A successful verified setup can promote the operator to M365Suite admin when the tenant is being set up.

Important behavior

  • M365Suite does not provide a client-secret option for BYOA.
  • Removing custom credentials makes the service fall back to the shared app only if shared-app consent is already active.
  • Removing the custom certificate prevents the custom app from connecting until a new certificate is generated and uploaded.
  • Certificate status, expiry date, renewal controls, and the current verification state are shown in Settings & Access → Connection.

Troubleshooting

If the test cannot find sites, first verify the app is in the same tenant, the certificate is uploaded to that exact app registration, and Microsoft Entra admin consent has been granted for the required application permissions.

For the current portal message and required permission list, use Settings & Access → Connection → Required Permissions.