M365 (Entra ID / Azure AD) integrations and permission grants should going forward be implemented using the admin consent mechanism, rather than manually creating a separate app registration in Entra ID for every integration. Manual app registration is an outdated and labour-intensive approach: it requires managing a clientId and secret (or certificate) separately for each application, secrets expire and must be rotated by hand, the scope of permissions is often unclear or overly broad, and the process doesn't scale as the number of integrations grows. On top of that, manually created app registrations tend to become scattered across different people and teams without centralised ownership or documentation, which is a risk both from a security and a maintainability standpoint.

The admin consent model instead allows an application (whether a ready-made multi-tenant app or an internal one) to request the required permissions through a standardised consent flow, which an admin then approves at the organisational level in one go. This brings several benefits: permission grants become transparent and auditable via Entra ID's admin consent logs, manual upkeep of secrets and certificates is largely eliminated, onboarding is faster since there's no need for a separate IT ticket for every new integration, and the scope of permissions is easier to review and constrain up front in the application manifest.

I'd ask that going forward, all new M365 integrations and automations be designed and built around admin consent as the standard approach, and that existing manually created app registrations be reviewed and migrated to this model wherever it makes sense. This would unify permission management, improve security, and reduce manual work for both IT and application developers over the long run.