Tasks for your IT Admin

Updated July 2026

This whole section requires admin permissions

Every task in this section must be done by someone with Microsoft 365 tenant admin and/or ADO Organization Administrator permissions. If that's not you, send this page to the right person on your team. This section ends by delivering four things (the service-account credentials, the MFA second factor, the Entra Application Client ID, and the Directory Tenant ID) that the operator needs to finish setup.

Estimated total time: 15–25 minutes. One-time only.

Admin Task 1. Create the licensed Microsoft 365 service account

Requires Microsoft 365 tenant admin (create users + assign licenses)

In your Microsoft 365 admin center, create a new user named CXOsignal-alerts@yourcompany.com (or whatever local name you prefer — the suffix needs to match your tenant's verified domain). Assign it a Microsoft 365 license that includes Exchange Online — that's what gives it a mailbox to send notification emails from. A standard Business Basic or Business Standard license works fine.

Must be a member of your Microsoft tenant, NOT a guest user. See the Recommended deployment pattern page for why this matters — B2B guests get an isolated EDS namespace and CXOrelay won't see any of the OKRsignal widgets it's supposed to monitor.

Admin Task 2. Create a dedicated ADO project

Requires ADO Organization Administrator (create new projects)

In Azure DevOps, create a new project called CXOrelay Operations (or any name you prefer). This project will be the security boundary around your CXOrelay deployment — the dashboard the relay runs on lives here, configuration changes happen here, and you control who else can see/edit any of it by managing membership of this one project.

The vast majority of users in your organization should NOT have access to this project. Only people who need to maintain CXOrelay configuration belong here.

The dedicated project doesn't isolate the OKR data — CXOrelay can still see OKRsignal widgets configured in any project in your ADO organization. The dedicated project just isolates the relay's configuration surface, not its read scope.

Admin Task 3. Add the service account as Project Administrator

Requires ADO Organization Administrator (or the user who created the project in Admin Task 2)

In ADO → the new project → Project settings (bottom-left) → Permissions → Project Administrators group → Add → pick CXOsignal-alerts@yourcompany.com from your tenant directory → Save.

This grants the service account the ADO permissions it needs to: add widgets to dashboards in this project, configure those widgets, and (later) modify the relay's configuration via the gear icon.

Admin Task 4. Register a Microsoft Entra application

Requires Microsoft Entra tenant admin (App registrations → New registration)

This is the longest task, but it's a one-time setup. Microsoft needs to know that CXOrelay is allowed to ask for permission to send mail and read ADO data on the service account's behalf. The Entra app registration is how Microsoft tracks that.

  1. 4.1 Open the Microsoft Entra admin center. Go to https://entra.microsoft.com and sign in.
  2. 4.2 Navigate to App registrations. In the left sidebar, click Applications, then App registrations. Then click the + New registration button at the top.

  3. 4.3 Fill in the registration form:

    • Name: CXOrelay (this is just for your reference — doesn't have to match anything specific).
    • Supported account types: select "Accounts in this organizational directory only (single tenant)". This restricts the app to just your company — the right choice for a tool only your company uses.
    • Redirect URI: In the dropdown, select Single-page application (SPA). This is critical — choosing "Web" instead will break the sign-in popup later. In the text box, paste exactly: https://www.cxosignal.com/msal-redirect.html

    Click Register at the bottom.

  4. 4.4 Configure API permissions. You'll land on your new app's overview page. In the left sidebar, click API permissions. Then click + Add a permission.

    You need to add two permissions — one for Microsoft Graph (sending email) and one for Azure DevOps (reading OKR data).

    First permission — Microsoft Graph: Click Microsoft Graph → Delegated permissions → search Mail.Send → tick Mail.Send → Add permissions.

    Second permission — Azure DevOps: Click + Add a permission again → APIs my organization uses tab → search Azure DevOps → click the result → Delegated permissions → tick user_impersonation → Add permissions.

    You should now see both: Mail.Send (Microsoft Graph) and user_impersonation (Azure DevOps).

  5. 4.5 (Recommended) Grant admin consent. Above the permissions table you'll see a button "Grant admin consent for [your tenant]". Click it — it consents to the permissions on behalf of everyone in your tenant so the operator doesn't see a separate consent prompt the first time they sign in.

Admin Task 5. Hand off four deliverables to the operator

End of admin tasks — deliver these four things to the operator

The operator (whoever is going to run CXOrelay) needs all four of the following to finish setup. Most companies have an established mechanism for sharing service account credentials with people who are authorized to use them. The credentials and the MFA second factor in particular are secrets and should go through a vault rather than chat or email.

  1. Service account credentials — the username and password for CXOsignal-alerts@yourcompany.com. The operator signs in to ADO with these in Operator Step 1 and to Microsoft (the popup at the end of Operator Step 4) with the same credentials.
  2. The MFA second factor — if your tenant enforces MFA on the service account (recommended), the operator needs whatever second factor you've set up for it. Common patterns: Microsoft Authenticator app installed on the dedicated Mac; a phone number controlled by the ops team; a TOTP secret stored in the password vault; a FIDO2 security key kept with the Mac. If your tenant does NOT require MFA on the service account, tell the operator explicitly so they don't waste time looking for it.
  3. Application (client) ID — in the Entra admin center, open your new CXOrelay app registration → Overview. Copy Application (client) ID. UUID format, e.g. 827901ef-8cb3-4487-8e60-aecdba814c2f.
  4. Directory (tenant) ID — same Overview page. UUID format. Required because we registered the app as single-tenant in Admin Task 4.3. Without the tenant ID, the operator's sign-in will fail with AADSTS50194 ("/common endpoint not supported for single-tenant apps").

Also confirm to the operator that the service account from Admin Task 1 has access to the dedicated CXOrelay Operations project (Admin Tasks 2 + 3).

← Previous: Recommended deployment pattern Next: Tasks for the operator →