Sign in with your Microsoft work account, then have an administrator grant organization-wide consent to read-only Microsoft Graph permissions or approve your request. AppAlert then runs its first credential inventory sync and shows your Operations queue. It never receives secret values or private keys.
Before you start
Use a Microsoft work account from the organization you want to connect. You sign in first, then an administrator approves access for the whole organization.
Microsoft requires an account authorized to consent on behalf of the organization. Review Microsoft's administrator consent prerequisites before you begin.
1. Sign in to AppAlert
Choose Connect your organization on the AppAlert site, then complete Microsoft sign-in. AppAlert uses User.Read during sign-in to identify your account and link it to one customer organization.
After sign-in, AppAlert opens Operations. If administrator approval is still missing, the page shows which permissions you need to approve before you continue.
2. Obtain administrator approval
If your account can approve Microsoft Graph application permissions, choose Grant as administrator. Review Microsoft's consent screen before granting access.
If another person must approve access, choose Request admin approval. Microsoft sends your request through your organization's configured admin consent workflow. After an administrator approves your request, return to Operations and choose Check approval status.
Before granting access, read Permissions and what AppAlert reads to review the permissions and stored metadata.
3. Wait for the initial sync
After approval, Operations reports Connected. Sync in progress. AppAlert reads application registrations, enterprise applications, credential expiry metadata, and owners. It also reads Application Proxy certificate metadata and supported agent identity inventory.
You can leave the page while the sync runs. Return to Operations and choose Check status to refresh the result.
4. Confirm the Operations queue
When the first sync finishes, Operations shows your credential queue, urgency totals, alert-routing status, and recent notification history. Your signed-in account stays linked to one customer organization.
If your organization later revokes Microsoft access, AppAlert stops future directory reads and prompts an administrator to restore consent. Revoking consent does not delete inventory already stored in AppAlert. See Retention and revocation for the separate deletion process.
Common problems and next steps
If approval is missing or the connection check fails, follow Approval and connection. If approval succeeded but expected credentials are absent, use Missing or stale inventory.
Once inventory is available, work through the Operations queue and configure alert settings and recipients. Review your saved notification policy even after you sign in and grant permission.