Azure application IDs in CDM
An Azure application ID uniquely identifies an Azure application registered in Microsoft Entra ID and used by CDM to authenticate users and access Microsoft 365 resources.
Every CDM license is associated with an Azure application ID. CDM supports default, custom, and scale-out Azure application IDs for larger tenancies.
Why Azure application IDs matter in CDM
CDM uses an Azure application registered in Microsoft Entra ID to authenticate users and access Microsoft 365 resources. Every CDM license is associated with an Azure application ID that identifies the Azure application used for authentication and authorization.
Formerly, CDM licenses would share the default Azure application ID, unless customers configured a custom Azure application for their specific license. As usage has increased, Microsoft now recommends distributing authentication traffic across multiple Azure applications with identical configurations and permissions, rather than processing requests through a single shared application. This approach not only reduces the risk of throttling but also improves reliability.
Rather than relying on a single default Azure application, IAM Cloud assigns new CDM licenses an Azure application ID from a managed pool of Azure applications, distributing the assignment across the pool over time to balance usage.
Existing customers retain their current Azure application ID assignment and are not automatically reassigned.
Azure application ID types
Every CDM license is associated with a primary Azure application ID. By default, CDM uses an Azure application ID assigned by IAM Cloud. However, admins can override the default application ID with a custom application ID provided by their organization. For larger tenancies, admins can also configure additional scale-out application IDs to distribute the load across multiple Azure applications.
Default Azure application ID
A default Azure application ID is assigned automatically when a new CDM license is created.
IAM Cloud assigns the default application ID from a pool of Azure applications that it owns and maintains. Permissions required by CDM are preconfigured in these applications, removing the need for admins to configure and maintain their own Azure application.
Custom Azure application ID
A custom Azure application ID allows your organization to use its own Azure application for CDM authentication and authorization, giving it full control over the Azure application associated with its CDM license.
When using a custom Azure application ID, your organization is responsible for ensuring the application is correctly configured with all permissions required by CDM.
Scale-out Azure application IDs
A scale-out Azure application ID is an additional Azure application ID that can be used alongside the default or custom application ID associated with a tenancy.
Scale-out application IDs are intended for larger tenancies where distributing the load across multiple Azure applications can help reduce throttling and improve reliability. When using the default application ID, scale-out application IDs are selected from IAM Cloud’s managed pool of Azure applications. However, when a custom application ID is specified, organizations can provide their own scale-out application IDs.
A tenancy can have up to five scale-out application IDs. Previously, these could only be configured through IAM Cloud support. They can now be configured and managed in Iris.
Admin consent and Azure application IDs
Before CDM can access Microsoft 365 resources on behalf of users, the Azure application associated with the tenancy must be approved. This process is known as admin consent.
During onboarding, Iris prompts admins to grant consent for the default Azure application ID when the first drive is mapped. If they have the required Entra admin permissions, they can complete consent at this point. Alternatively, they can also do this later from the Providers page in Iris.
If a tenancy uses scale-out application IDs in addition to the default application ID, admin consent is required for those IDs as well. At any given time, a tenancy can have up to five scale-out application IDs, and each application ID must be approved before it can be used with the Microsoft 365 tenant.
Admin consent is also required again if the Azure data center associated with the tenancy is changed from the Providers page in Iris. In this scenario, consent must be granted again for the default application ID and any configured scale-out application IDs.
Related tasks
