Enterprise onboarding with Microsoft Entra ID

Enterprise Application in Microsoft Entra ID

MyDesk is onboarded as an Enterprise Application in the customer's Microsoft Entra ID tenant. This provides full control over what rights MyDesk has and enables SSO, MFA and conditional access via the customer's existing identity policies.

App Registration and Rights

During onboarding, an App Registration is created in the customer's Entra ID tenant with the specific Microsoft Graph rights needed to provide the service. MyDesk applies the principle of least privilege and only requests the rights that are strictly necessary.

Typical Graph rights include:

• User.Read – Reading user information
• Calendars.ReadWrite – Calendar integration for meeting room booking
• Place.Read.All – Reading room information
• Mail.Send – Sending notifications (optional)

Certificate-based integration

MyDesk supports certificate-based authentication for the Microsoft Graph API, which eliminates the need for client secrets and increases security. Certificates are rotated regularly and managed securely.

The onboarding process

The onboarding process is structured and documented:

• Technical kick-off with the customer's IT department
• Creation of Enterprise Application in Entra ID
• Configuration of SSO and MFA
• Testing of integration and access control
• Approval and go-live
• Documentation and transfer