Skip to content
Andy Kemp Consulting

Before you start: permissions and set-up#

What you need#
Windows Windows 10 or 11, 64-bit. Nothing to install: AKC AUP is one EXE.
Licence Microsoft Entra ID P1, or a plan that includes it, such as Microsoft 365 Business Premium, E3 or E5. Terms of Use and Conditional Access both need it.
To deploy The Conditional Access Administrator role (or Security Administrator).
To look only Security Reader (or Global Reader): AKC AUP opens read-only.
For set-up, once A Cloud Application Administrator. Global Administrator isn't needed.
Your AUP A PDF for each audience. Microsoft suggests large text (24 pt on A4, or a smaller page) so it reads well on phones.
A break-glass group A group holding your emergency access accounts. AKC AUP won't deploy without one.

AKC AUP runs with your normal rights on your PC.

Set up your tenant (once)#

AKC AUP signs in with its own app registration in your tenant, with delegated Microsoft Graph permissions. Nothing is registered in, or sent to, Andy Kemp Consulting's tenant.

The automatic way: Tools, Set up this tenant#

A Cloud Application Administrator does this once:

  1. In AKC AUP, choose Tools, Set up this tenant. It explains what it will create; choose OK and sign in.

    This one sign-in goes through Microsoft Graph Command Line Tools, Microsoft's own app for Graph PowerShell, because something has to sign in before AKC AUP's registration exists. If Microsoft asks you to consent, leave Consent on behalf of your organisation unticked. Nothing is cached.

  2. AKC AUP checks your roles. Cloud Application Administrator or Application Administrator carries on. Global or Privileged Role Administrator gets a warning that it's more than needed. Anyone else is stopped before anything changes.

  3. It creates the AKC AUP app registration (single tenant, public client, no secret), its enterprise app, and admin consent for exactly the permissions below. Run it again and it corrects the registration rather than adding another.
  4. It saves the client ID and tenant in Tools, Settings, and forgets the administrator's sign-in.

Then sign in (top right) with your Conditional Access Administrator account.

Optional, afterwards

In Entra, set Assignment required on the AKC AUP enterprise app and assign your Conditional Access admins, so no one else can sign in to it.

The permissions#

Delegated permission Why
Agreement.ReadWrite.All Create and change Terms of Use
AgreementAcceptance.Read.All Acceptance reports (coming in a later version)
Policy.Read.All Read existing Conditional Access policies, and find the break-glass group
Policy.ReadWrite.ConditionalAccess Create and change the policies that require the terms
Group.Read.All Search for groups, including the break-glass group
Application.Read.All Show app names in policies
Organization.Read.All Check the tenant has Entra ID P1
User.Read Show who's signed in

They're delegated: AKC AUP can only ever do what the signed-in person's own role allows.

By hand#

If your tenant blocks Microsoft Graph Command Line Tools, or you'd rather do it yourself, in the Entra admin centre:

  1. App registrations, New registration: name AKC AUP, Accounts in this organizational directory only, redirect URI platform Public client/native: http://localhost.
  2. Authentication, Add a platform, Mobile and desktop applications: add ms-appx-web://microsoft.aad.brokerplugin/<Application (client) ID> (the Windows sign-in broker). Set Allow public client flows to Yes.
  3. API permissions, Microsoft Graph, Delegated: the permissions above, then Grant admin consent as a Cloud Application Administrator.
  4. In AKC AUP, Tools, Settings: the Application (client) ID and your tenant ID or domain.

There's no client secret or certificate: AKC AUP is a public client.

Signing in day to day#

Sign in at the top right with your Conditional Access Administrator account. AKC AUP uses the Windows sign-in broker, so Windows Hello, passkeys and device-based Conditional Access work. Where the broker isn't available (Windows Server, some LTSC builds, Windows Sandbox, some VMs) it signs in through your browser instead.

After sign-in, AKC AUP checks the permissions have consent, the tenant has Entra ID P1, and what your role lets you do. If your account also holds Global, Privileged Role, Cloud Application or Application Administrator, it warns you: AKC AUP doesn't need them. Keep those for when they're needed, through PIM.