Choosing Between Client Secret and Admin Consent
Microsoft Copilot can authenticate in two ways. Client secret uses credentials you create yourself in Microsoft Entra. Admin consent uses a Microsoft sign-in, where an administrator grants AI Security permission directly.
Both methods give AI Security the same access to Copilot activity. What differs is how much setup you do beforehand, who has to be involved, and what you have to maintain afterwards.
Table 1. Client secret compared with admin consent
| Client secret | Admin consent | |
|---|---|---|
| What you do first | Register an application in Microsoft Entra, then generate a client secret for it. | Nothing. You start from the connector panel. |
| What you enter | Client ID, client secret, and Microsoft tenant ID. | Nothing. You sign in to Microsoft and approve the permissions AI Security asks for. |
| Who has to be involved | Someone who can register applications in Microsoft Entra. That may be a different person from the one setting up AI Security. | An administrator who can grant consent on behalf of your organization, and who can complete an interactive sign-in including multi-factor authentication. |
| What you maintain | The client secret. It expires, and inspection stops when it does, so you have to replace it before that happens. | Nothing routine. The consent stands until it is withdrawn in Microsoft Entra. |
| What can go wrong | A permission added after consent has been granted stays unconsented, and a secret that expires unnoticed stops inspection. | The first consent screen has a Consent on behalf of your organization check box that is cleared by default. If you leave it cleared, consent applies only to your own account. |
Which to choose
Choose Admin consent if you can get an administrator to sign in. It is quicker, there is nothing to copy between systems, and no credential to rotate later.
Choose Client secret when an interactive sign-in is not practical — for example when your organization restricts who may grant consent, when the person configuring AI Security is not the person with administrator rights, or when your change process requires the application registration to be reviewed first.