**Requirements:** admin permission in your Entra ID and in your Power Platform environment (section 2). 1. Go to **portal.azure.com** → **Microsoft Entra ID** → **App registrations** → **New registration**. This confidential registration is much simpler than a public one: it only needs a name, with no permissions to request or consent to grant. 2. Copy the **Application (client) ID** shown on the app's overview page. 3. Also write down your directory's **Tenant ID** — Microsoft Entra ID → Overview. 4. Go to **Certificates & secrets** → **New client secret** → copy it NOW (Microsoft won't show it again). 1. Go to **admin.powerplatform.microsoft.com** → your environment → **Application users** → **+ New app user**. 2. Search for the app by name (it appears directly, it's your own app) and add it. 3. Assign it a **business unit** and a **security role** with create/edit permissions on contacts and opportunities — the whole step takes about 10-15 minutes. 4. Copy that same environment's **Environment URL** (Power Platform admin center → your environment → Details → "Environment URL") — use the **PRODUCTION** environment. > **Notice — "Test connection" can pass even if the security role is insufficient** > > This is already warned by the Client secret field's own help text in Platform: "Test connection" only confirms the credential is valid, not that the application user has permission to create or edit records. If an action later fails with an "insufficient security role" error, go back to step 7 above and review the assigned role. Verified against Microsoft's official documentation (`learn.microsoft.com/en-us/power-apps/developer/data-platform/walkthrough-register-app-azure-active-directory`, checked on September 5, 2026 — it describes exactly this "Path B" of a confidential application registered by the tenant itself, "Confidential client app registration" section).