entra-app-registration

Name: entra-app-registration
Author: microsoft

bymicrosoft· 555 skills

Installs

484k

Stars

1.3k

Forks

219

How to install entra-app-registration?

microsoft/azure-skills/entra-app-registration

$npx -y skills add microsoft/azure-skills --skill entra-app-registration

Installs into the current project.

›Prefer a prompt? Paste this to your agent

Use this skill

Run `npx skills use "https://github.com/microsoft/azure-skills" --skill "microsoft/azure-skills/entra-app-registration"` and follow the generated skill instructions now. Read its complete output, redirecting it to a temporary file first if necessary. Resolve relative paths from the supporting-files directory it provides.

Use the whole pack

Use the skills in "https://github.com/microsoft/azure-skills" that are relevant to the current task. Run `npx skills add "https://github.com/microsoft/azure-skills"` and select the relevant skills, then follow their instructions.

Files · 1

View on GitHub

SKILL.md

1	## Overview
2
3	Microsoft Entra ID (formerly Azure Active Directory) is Microsoft's cloud-based identity and access management service. App registrations allow applications to authenticate users and access Azure resources securely.
4
5	### Key Concepts
6
7	\| Concept \| Description \|
8	\|---------\|-------------\|
9	\| App Registration \| Configuration that allows an app to use Microsoft identity platform \|
10	\| Application (Client) ID \| Unique identifier for your application \|
11	\| Tenant ID \| Unique identifier for your Azure AD tenant/directory \|
12	\| Client Secret \| Password for the application (confidential clients only) \|
13	\| Redirect URI \| URL where authentication responses are sent \|
14	\| API Permissions \| Access scopes your app requests \|
15	\| Service Principal \| Identity created in your tenant when you register an app \|
16
17	### Application Types
18
19	\| Type \| Use Case \|
20	\|------\|----------\|
21	\| Web Application \| Server-side apps, APIs \|
22	\| Single Page App (SPA) \| JavaScript/React/Angular apps \|
23	\| Mobile/Native App \| Desktop, mobile apps \|
24	\| Daemon/Service \| Background services, APIs \|
25
26	## Core Workflow
27
28	### Step 1: Register the Application
29
30	Create an app registration in the Azure portal or using Azure CLI.
31
32	Portal Method:
33	1. Navigate to Azure Portal → Microsoft Entra ID → App registrations
34	2. Click "New registration"
35	3. Provide name, supported account types, and redirect URI
36	4. Click "Register"
37
38	CLI Method: See [references/cli-commands.md](references/cli-commands.md)
39	IaC Method: See [references/BICEP-EXAMPLE.bicep](references/BICEP-EXAMPLE.bicep)
40
41	It's highly recommended to use the IaC to manage Entra app registration if you already use IaC in your project, need a scalable solution for managing lots of app registrations or need fine-grained audit history of the configuration changes.
42
43	### Step 2: Configure Authentication
44
45	Set up authentication settings based on your application type.
46
47	- Web Apps: Add redirect URIs, enable ID tokens if needed
48	- SPAs: Add redirect URIs, enable implicit grant flow if necessary
49	- Mobile/Desktop: Use `http://localhost` or custom URI scheme
50	- Services: No redirect URI needed for client credentials flow
51
52	### Step 3: Configure API Permissions
53
54	Grant your application permission to access Microsoft APIs or your own APIs.
55
56	Common Microsoft Graph Permissions:
57	- `User.Read` - Read user profile
58	- `User.ReadWrite.All` - Read and write all users
59	- `Directory.Read.All` - Read directory data
60	- `Mail.Send` - Send mail as a user
61
62	Details: See [references/api-permissions.md](references/api-permissions.md)
63
64	### Step 4: Create Client Credentials (if needed)
65
66	For confidential client applications (web apps, services), create a client secret, certificate or federated identity credential.
67
68	Client Secret:
69	- Navigate to "Certificates & secrets"
70	- Create new client secret
71	- Copy the value immediately (only shown once)
72	- Store securely (Key Vault recommended)
73
74	Certificate: For production environments, use certificates instead of secrets for enhanced security. Upload certificate via "Certificates & secrets" section.
75
76	Federated Identity Credential: For dynamically authenticating the confidential client to Entra platform.
77
78	### Step 5: Implement OAuth Flow
79
80	Integrate the OAuth flow into your application code.
81
82	See:
83	- [references/oauth-flows.md](references/oauth-flows.md) - OAuth 2.0 flow details
84	- [references/console-app-example.md](references/console-app-example.md) - Console app implementation
85
86	## Common Patterns
87
88	### Pattern 1: First-Time App Registration
89
90	Walk user through their first app registration step-by-step.
91
92	Required Information:
93	- Application name
94	- Application type (web, SPA, mobile, service)
95	- Redirect URIs (if applicable)
96	- Required permissions
97
98	Script: See [references/first-app-registration.md](references/first-app-registration.md)
99
100	### Pattern 2: Console Application with User Authentication
101
102	Create a .NET/Python/Node.js console app that authenticates users.
103
104	Required Information:
105	- Programming language (C#, Python, JavaScript, etc.)
106	- Authentication library (MSAL recommended)
107	- Required permissions
108
109	Example: See [references/console-app-example.md](references/console-app-example.md)
110
111	### Pattern 3: Service-to-Service Authentication
112
113	Set up daemon/service authentication without user interaction.
114
115	Required Information:
116	- Service/app name
117	- Target API/resource
118	- Whether to use secret or certificate
119
120	Implementation: Use Client Credentials flow (see [references/oauth-flows.md#client-credentials-flow](references/oauth-flows.md#client-credentials-flow))
121
122	## MCP Tools and CLI
123
124	### Azure CLI Commands
125
126	\| Command \| Purpose \|
127	\|---------\|---------\|
128	\| `az ad app create` \| Create new app registration \|
129	\| `az ad app list` \| List app registrations \|
130	\| `az ad app show` \| Show app details \|
131	\| `az ad app permission add` \| Add API permission \|
132	\| `az ad app credential reset` \| Generate new client secret \|
133	\| `az ad sp create` \| Create service principal \|
134
135	Complete reference: See [references/cli-commands.md](references/cli-commands.md)
136
137	### Microsoft Authentication Library (MSAL)
138
139	MSAL is the recommended library for integrating Microsoft identity platform.
140
141	Supported Languages:
142	- .NET/C# - `Microsoft.Identity.Client`
143	- JavaScript/TypeScript - `@azure/msal-browser`, `@azure/msal-node`
144	- Python - `msal`
145
146	Examples: See [references/console-app-example.md](references/console-app-example.md)
147
148	## Security Best Practices
149
150	\| Practice \| Recommendation \|
151	\|----------\|---------------\|
152	\| Never hardcode secrets \| Use environment variables, Azure Key Vault, or managed identity \|
153	\| Rotate secrets regularly \| Set expiration, automate rotation \|
154	\| Use certificates over secrets \| More secure for production \|
155	\| Least privilege permissions \| Request only required API permissions \|
156	\| Enable MFA \| Require multi-factor authentication for users \|
157	\| Use managed identity \| For Azure-hosted apps, avoid secrets entirely \|
158	\| Validate tokens \| Always validate issuer, audience, expiration \|
159	\| Use HTTPS only \| All redirect URIs must use HTTPS (except localhost) \|
160	\| Monitor sign-ins \| Use Entra ID sign-in logs for anomaly detection \|
161
162	## SDK Quick References
163
164	- Azure Identity: [Python](references/sdk/azure-identity-py.md) \| [.NET](references/sdk/azure-identity-dotnet.md) \| [TypeScript](references/sdk/azure-identity-ts.md) \| [Java](references/sdk/azure-identity-java.md) \| [Rust](references/sdk/azure-identity-rust.md)
165	- Key Vault (secrets): [Python](references/sdk/azure-keyvault-py.md) \| [TypeScript](references/sdk/azure-keyvault-secrets-ts.md)
166	- Auth Events: [.NET](references/sdk/microsoft-azure-webjobs-extensions-authentication-events-dotnet.md)
167
168	## References
169
170	- [OAuth Flows](references/oauth-flows.md) - Detailed OAuth 2.0 flow explanations
171	- [CLI Commands](references/cli-commands.md) - Azure CLI reference for app registrations
172	- [Console App Example](references/console-app-example.md) - Complete working examples
173	- [First App Registration](references/first-app-registration.md) - Step-by-step guide for beginners
174	- [API Permissions](references/api-permissions.md) - Understanding and configuring permissions
175	- [Troubleshooting](references/troubleshooting.md) - Common issues and solutions
176
177	## External Resources
178
179	- [Microsoft Identity Platform Documentation](https://learn.microsoft.com/entra/identity-platform/)
180	- [OAuth 2.0 and OpenID Connect protocols](https://learn.microsoft.com/entra/identity-platform/v2-protocols)
181	- [MSAL Documentation](https://learn.microsoft.com/entra/msal/)
182	- [Microsoft Graph API](https://learn.microsoft.com/graph/)

6 picks

Type

Run `npx skills use "https://github.com/microsoft/azure-skills" --skill "microsoft/azure-skills/entra-app-registration"` and follow the generated skill instructions now. Read its complete output, redirecting it to a temporary file first if necessary. Resolve relative paths from the supporting-files directory it provides.

Use the skills in "https://github.com/microsoft/azure-skills" that are relevant to the current task. Run `npx skills add "https://github.com/microsoft/azure-skills"` and select the relevant skills, then follow their instructions.

entra-app-registration

How to install entra-app-registration?

Related

entra-app-registration

How to install entra-app-registration?

Related