---
title: "DaaS IQ Prerequisites"
slug: "controlup-daas-iq-prerequisites"
tags: ["ControlUp DaaS IQ"]
updated: 2026-07-15T08:18:18Z
published: 2026-07-15T08:18:18Z
canonical: "support.controlup.com/controlup-daas-iq-prerequisites"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://support.controlup.com/llms.txt
> Use this file to discover all available pages before exploring further.

# DaaS IQ Prerequisites

This article explains how to prepare your environment and configure the necessary Azure permissions for **ControlUp DaaS IQ**. You must complete these prerequisites to enable ControlUp to manage your Azure Virtual Desktop (AVD) resources, including power management, session handling, and host scaling.

## System Requirements

- **Microsoft Entra ID Role**: Global Administrator or Cloud Application Administrator. Role required only during initial app registration, not required for ongoing operation.
- **Microsoft Azure Subscription**: Must contain the AVD Host Pools and Session Hosts you need to manage.
- **Permissions**: You need permission to assign roles at the Subscription or Resource Group level.

## Step 1: Register App in Azure Portal

To register apps in Microsoft Azure Portal:

1. Open [Azure Portal](https://portal.azure.com/).
2. In the Search bar, enter “App registrations” and click **App registrations**.
3. Click **+ New registration**.

![app registrations page](https://cdn.document360.io/098100b7-b9da-4bea-b4b9-017140ab863e/Images/Documentation/Migrate365AppRegi.png)
4. On the **Register an application** page, provide a name for the app, for example: “DaaS IQ”.

![Azure register an application page](https://cdn.document360.io/098100b7-b9da-4bea-b4b9-017140ab863e/Images/Documentation/DaasRegApp.png)
5. To limit the app to your organization's directory only, under **Supported account types**, select **Single tenant only** - [your organization name].
6. Click **Register**.
7. **Important**: Store the following values to use later during the DaaS IQ setup:

![values for migration setup showing display name, application ID, object ID, directory ID, and supported account types](https://cdn.document360.io/098100b7-b9da-4bea-b4b9-017140ab863e/Images/Documentation/Migrate365Values.png)
  - **Application (client) ID**
  - **Directory (tenant) ID**
8. In the app menu under **Manage**, go to **Certificates & secrets** and click **New client secret**.

![Certificates & secrets page with New client secret button](https://cdn.document360.io/098100b7-b9da-4bea-b4b9-017140ab863e/Images/Documentation/Migrate365NewClient.png)
9. Provide a description (e.g., "DaaSIQKey") and set an expiration (e.g., 12 months)
10. Click **Add**.

> [!WARNING]
> Important!
> 
> Copy the secret value once it's created. You **can’t** retrieve it later.

You should now have the following values:

- **Application (client) ID**
- **Directory (tenant) ID**
- **Client Secret** **Value**

> [!WARNING]
> Important!
> 
> Keep the client secret secure by storing it in a password vault or Azure Key Vault. Never share or email it in plain text.

## Step 2: Grant Microsoft Graph API Permissions

1. In **App registrations**, click **API permissions** > **+ Add a permission**.

![App permissions page with configured permissions section showing add a permission button](https://cdn.document360.io/098100b7-b9da-4bea-b4b9-017140ab863e/Images/Documentation/Migrate365AppPerm.png)
2. Click **Microsoft Graph** > **Application permissions**.

![request api permissions page with Microsoft graph option](https://cdn.document360.io/098100b7-b9da-4bea-b4b9-017140ab863e/Images/Documentation/Migrate365RequestAPIPermission.png)
3. Add the **User.Read.All** and **Group.Read.All** permissions. This allows DaaS IQ to read user account details for active session display and autoscaling logic.
4. Click **Add permissions**.
5. Confirm that the permissions are listed under **Configured permissions** as **Application** type.

![configured permissions area showing permissions list](https://cdn.document360.io/098100b7-b9da-4bea-b4b9-017140ab863e/Images/Documentation/DaasConfiguredPerms.png)

## Step 3: Grant Admin Consent

1. In **Application permissions**, click **Grant admin consent for** [Your Organization].
2. Click **Yes**.

![Grant admin consent confirmation popup showing yes button](https://cdn.document360.io/098100b7-b9da-4bea-b4b9-017140ab863e/Images/Documentation/Migrate365APIPermission.png)
3. Status updates to ✅ **Granted for** [Tenant Name].

## Step 4: Add IAM Permissions

ControlUp DaaS IQ requires permission to manage the underlying Virtual Machines (start, stop, delete, re-image) and related Azure resources across your AVD environment.

1. In the Azure Portal, search for and open **Subscriptions**.
2. Select the Subscription hosting your AVD resources.
3. From the left menu, select **Access control (IAM)**.
4. Click **+ Add** > **Add role assignment**. Assign the appropriate role based on your security requirements:
  - **Contributor**. Select this role for a simple, comprehensive set of permissions.
  - **Desktop Virtualization Roles**. Select specific AVD roles to adhere to the principle of least privilege.
5. Under **Members**, click **Select members** and search for the App Registration name you created in [Step 1](/v1/docs/controlup-foundry-prerequisites#step-1-register-app-in-azure-portal).

![add role assignment screen](https://cdn.document360.io/098100b7-b9da-4bea-b4b9-017140ab863e/Images/Documentation/DaasIAM.png)
6. Click **Review + assign**.

## Step 5: Final Validation Checklist

| Step | Validation |
| --- | --- |
| Tenant ID | Azure Directory (Tenant) ID saved from the app registration Overview |
| Client ID | Application (Client) ID saved from the app registration Overview |
| Client Secret | Secret Value (not the Secret ID) saved immediately after creation |
| Graph API | **User.Read.All** and **Group.Read.All** permissions added and admin consent granted |
| IAM Role | App has **Contributor** role (or equivalent AVD roles) on the Target Subscription |

> [!TIP]
> 3rd party applications
> 
> The Microsoft AVD images are provided for your benefit, but we don't take responsibility for the screenshots, content, and functionality of these 3rd party applications.