Preparing your Microsoft Entra ID tenant for the new Lucen Track Sign-In

Who is this guide for: IT administrators of organizations whose users sign in to Lucen Track with their Microsoft work accounts
Estimated effort: 5–10 minutes

What is changing

Starting from August 3rd, 2026 Track is upgrading its authentication platform to a new federated identity system built on Microsoft Entra External ID (Azure AD B2C). As part of this change, the "Sign in with Microsoft" option will be served by a new application registration.

This means that when your users sign in with their Microsoft account after the upgrade, the consent request will come from a new application identity, different from the one your tenant may have already approved.

	Current	New
Application name	Lucen Track	Office Timeline
Application (client) ID	`56412014-bafe-474e-95b4-ebfea106a167`	`33eba5e0-0f8c-4027-a73b-a629d1c3fb48`
Publisher	DM Digital Software SRL	Office Timeline

By pre-authorizing the new application in your tenant before the release, your users will experience a seamless transition with no consent prompts, no "Approval required" messages, and no support tickets.

Permissions requested

The new application requests delegated permissions only (it acts on behalf of the signed-in user; it has no standing application-level access to your tenant):

Permission (Microsoft Graph)	Type	Purpose
`openid`	Delegated	Sign the user in
`profile`	Delegated	Read the user's basic profile (name)
`email`	Delegated	Read the user's email address to identify their Track account
`offline_access`	Delegated	Keep the user signed in (refresh tokens)

No application permissions, no directory write access, and no access to other users' data are requested.

What happens if you do nothing

It depends on your tenant's user consent settings (Entra admin center → Enterprise applications → Consent and permissions):

User consent allowed: each user will see a one-time Microsoft consent prompt on their first sign-in after the upgrade. They can accept it themselves, but the experience is noisier.
User consent restricted or disabled (common in enterprise tenants): users will be blocked with a "Need admin approval" message and will not be able to sign in to Track until an administrator approves the application.

Pre-authorizing the application avoids both scenarios.

Option A — Admin consent URL (recommended, ~2 minutes)

This is the fastest method. It creates the enterprise application (service principal) in your tenant and grants tenant-wide admin consent in a single step.

Sign in to your browser with an account that holds one of these Entra roles: Global Administrator, Privileged Role Administrator, or Cloud Application Administrator (sufficient for the permissions listed above).
Open the following URL, replacing {your-tenant} with your tenant's primary domain (e.g. contoso.onmicrosoft.com) or tenant ID:

https://login.microsoftonline.com/{your-tenant}/adminconsent?client_id=33eba5e0-0f8c-4027-a73b-a629d1c3fb48
Review the requested permissions on the Microsoft consent screen and select Accept.
After accepting, your browser will be redirected to the application's sign-in endpoint. Because you arrived through the consent flow rather than a normal sign-in, you may land on an error or blank page — this is expected and harmless. The consent has already been recorded in your tenant.

Option B — Microsoft Graph PowerShell + portal

If you prefer to create the enterprise application first and grant consent from the Entra admin center:

Create the service principal in your tenant:

Connect-MgGraph -Scopes "Application.ReadWrite.All" New-MgServicePrincipal -AppId "33eba5e0-0f8c-4027-a73b-a629d1c3fb48"
In the Microsoft Entra admin center, go to Identity → Applications → Enterprise applications, clear any filters, and search for the application ID 33eba5e0-0f8c-4027-a73b-a629d1c3fb48.
Open the application, go to Security → Permissions, and select Grant admin consent for [your organization].

Option C — Fully scripted (Graph PowerShell only)

For automated or scripted environments:

Connect-MgGraph -Scopes "Application.ReadWrite.All","DelegatedPermissionGrant.ReadWrite.All" # 1. Create the service principal (enterprise application) $sp = New-MgServicePrincipal -AppId "33eba5e0-0f8c-4027-a73b-a629d1c3fb48" # 2. Locate the Microsoft Graph service principal in your tenant $graph = Get-MgServicePrincipal -Filter "appId eq '00000003-0000-0000-c000-000000000000'" # 3. Grant tenant-wide admin consent for the delegated scopes New-MgOauth2PermissionGrant -ClientId $sp.Id ` -ConsentType "AllPrincipals" ` -ResourceId $graph.Id ` -Scope "openid profile email offline_access"

Verifying the configuration

In the Microsoft Entra admin center, go to Identity → Applications → Enterprise applications.
Search for application ID 33eba5e0-0f8c-4027-a73b-a629d1c3fb48 and confirm the application appears.
Open Security → Permissions and confirm the delegated permissions are listed under Admin consent.

Your tenant is now ready. When the new sign-in system goes live, your users will sign in with Microsoft as usual — no prompts, no interruptions.

After the migration

⚠️ Do not remove the existing Lucen Track application (client ID 56412014-bafe-474e-95b4-ebfea106a167) from your tenant. The new application only takes over user sign-in.

The existing Lucen Track application continues to power the Microsoft 365 integrations your users have already connected — such as Microsoft Planner, Microsoft To Do, and Outlook Calendar. Removing it would revoke those authorizations and break your users' linked integrations.

In short: after the migration, both enterprise applications will coexist in your tenant — Office Timeline handling sign-in, and Lucen Track handling Microsoft 365 integrations. No further action is required on the existing application.

Questions?

If you have questions or your organization requires additional documentation (security review forms, permission, contact us at track-support@lucensoftware.com and we'll be happy to assist.