entra-app-registration

Sets your app up with Microsoft so people can sign in with their work or school account, and so the app can only reach the data you said it could.

WHEN TO USE

SCOPE

USE FOR

Register a new application in Microsoft Entra ID for the first time.
Set up service-to-service authentication with the client credentials flow.
Build a console app that signs users in with Microsoft's authentication library.
Add Microsoft Graph permissions such as User.Read or Mail.Send to an app.
Create a client secret, certificate, or federated identity credential for an app.

NOT FOR

Manage or audit Key Vault secret expirations — use azure-keyvault-expiration-audit instead.
Get general Azure resource security guidance beyond app registrations.

This is a saved copy of the skill's SKILL.md instructions. It may differ from the upstream file or the version you install.

In this document (8)

Overview

Microsoft Entra ID (formerly Azure Active Directory) is Microsoft's cloud-based identity and access management service. App registrations allow applications to authenticate users and access Azure resources securely.

Key Concepts

Concept	Description
App Registration	Configuration that allows an app to use Microsoft identity platform
Application (Client) ID	Unique identifier for your application
Tenant ID	Unique identifier for your Azure AD tenant/directory
Client Secret	Password for the application (confidential clients only)
Redirect URI	URL where authentication responses are sent
API Permissions	Access scopes your app requests
Service Principal	Identity created in your tenant when you register an app

Application Types

Type	Use Case
Web Application	Server-side apps, APIs
Single Page App (SPA)	JavaScript/React/Angular apps
Mobile/Native App	Desktop, mobile apps
Daemon/Service	Background services, APIs

Core Workflow

Step 1: Register the Application

Create an app registration in the Azure portal or using Azure CLI.

Portal Method:

Navigate to Azure Portal → Microsoft Entra ID → App registrations
Click "New registration"
Provide name, supported account types, and redirect URI
Click "Register"

CLI Method: See references/cli-commands.md IaC Method: See references/BICEP-EXAMPLE.bicep

It's highly recommended to use the IaC to manage Entra app registration if you already use IaC in your project, need a scalable solution for managing lots of app registrations or need fine-grained audit history of the configuration changes.

Step 2: Configure Authentication

Set up authentication settings based on your application type.

Web Apps: Add redirect URIs, enable ID tokens if needed
SPAs: Add redirect URIs, enable implicit grant flow if necessary
Mobile/Desktop: Use http://localhost or custom URI scheme
Services: No redirect URI needed for client credentials flow

Step 3: Configure API Permissions

Grant your application permission to access Microsoft APIs or your own APIs.

Common Microsoft Graph Permissions:

User.Read - Read user profile
User.ReadWrite.All - Read and write all users
Directory.Read.All - Read directory data
Mail.Send - Send mail as a user

Details: See references/api-permissions.md

Step 4: Create Client Credentials (if needed)

For confidential client applications (web apps, services), create a client secret, certificate or federated identity credential.

Client Secret:

Navigate to "Certificates & secrets"
Create new client secret
Copy the value immediately (only shown once)
Store securely (Key Vault recommended)

Certificate: For production environments, use certificates instead of secrets for enhanced security. Upload certificate via "Certificates & secrets" section.

Federated Identity Credential: For dynamically authenticating the confidential client to Entra platform.

Step 5: Implement OAuth Flow

Integrate the OAuth flow into your application code.

See:

references/oauth-flows.md - OAuth 2.0 flow details
references/console-app-example.md - Console app implementation

Common Patterns

Pattern 1: First-Time App Registration

Walk user through their first app registration step-by-step.

Required Information:

Application name
Application type (web, SPA, mobile, service)
Redirect URIs (if applicable)
Required permissions

Script: See references/first-app-registration.md

Pattern 2: Console Application with User Authentication

Create a .NET/Python/Node.js console app that authenticates users.

Required Information:

Programming language (C#, Python, JavaScript, etc.)
Authentication library (MSAL recommended)
Required permissions

Example: See references/console-app-example.md

Pattern 3: Service-to-Service Authentication

Set up daemon/service authentication without user interaction.

Required Information:

Service/app name
Target API/resource
Whether to use secret or certificate

Implementation: Use Client Credentials flow (see references/oauth-flows.md#client-credentials-flow)

MCP Tools and CLI

Azure CLI Commands

Command	Purpose
`az ad app create`	Create new app registration
`az ad app list`	List app registrations
`az ad app show`	Show app details
`az ad app permission add`	Add API permission
`az ad app credential reset`	Generate new client secret
`az ad sp create`	Create service principal

Complete reference: See references/cli-commands.md

Microsoft Authentication Library (MSAL)

MSAL is the recommended library for integrating Microsoft identity platform.

Supported Languages:

.NET/C# - Microsoft.Identity.Client
JavaScript/TypeScript - @azure/msal-browser, @azure/msal-node
Python - msal

Examples: See references/console-app-example.md

Security Best Practices

Practice	Recommendation
Never hardcode secrets	Use environment variables, Azure Key Vault, or managed identity
Rotate secrets regularly	Set expiration, automate rotation
Use certificates over secrets	More secure for production
Least privilege permissions	Request only required API permissions
Enable MFA	Require multi-factor authentication for users
Use managed identity	For Azure-hosted apps, avoid secrets entirely
Validate tokens	Always validate issuer, audience, expiration
Use HTTPS only	All redirect URIs must use HTTPS (except localhost)
Monitor sign-ins	Use Entra ID sign-in logs for anomaly detection

SDK Quick References

Azure Identity: Python | .NET | TypeScript | Java | Rust
Key Vault (secrets): Python | TypeScript
Auth Events: .NET

References

OAuth Flows - Detailed OAuth 2.0 flow explanations
CLI Commands - Azure CLI reference for app registrations
Console App Example - Complete working examples
First App Registration - Step-by-step guide for beginners
API Permissions - Understanding and configuring permissions
Troubleshooting - Common issues and solutions

External Resources

This skill ships inside the Azure Skills Plugin. Listed package contents include hooks and an MCP server. Installed components and skill versions may vary by AI tool.

Run this outside your AI tool, using Node.js 22.20.0 or newer. Skills CLI 1.7.2 skips skill selection; prompts cancel installation without an interactive terminal. If choosing Project when asked about installation scope, open your project's folder before running this.

Install checklist

Check selected tools if a picker appears; Claude Code may be unchecked under Additional agents. ↑/↓ moves, Space toggles selections, Enter confirms.
Without a tool picker, check Installing to: for your intended tool. Stop if it names a different tool.
If asked, choose Symlink (Recommended) for shared files or Copy to all agents for separate copies; review the summary before confirming installation.
Install the find-skills skill? defaults to Yes, adding another skill for all projects. Choose No if you don't want that extra installation.

Skills CLI 1.7.2 sends install data to skills.sh by default, including the source, skill names, target tools and file details; GitHub sources are reported only when GitHub confirms the repository is public, while other remote sources can also be reported. Confirmed-public GitHub sources also trigger a security-audit request. Before installing, set the environment variable DO_NOT_TRACK=1 or DISABLE_TELEMETRY=1 to disable both.

npx skills add microsoft/azure-skills --skill "entra-app-registration" --full-depth

After installing for Claude Code, open it in the installation project if you chose Project; Global makes the skill available across projects on this computer. Once Claude Code loads the skill, its description helps Claude decide when to use it.

If installation created a top-level skills folder that did not exist when your Claude Code session started, run /reload-skills in that session. Run it again after later changes in that folder.

What's inside

Files included with this skill.

View on GitHub

Same repository

airunway-aks-setup
Set up AI Runway on AKS — from bare cluster to running model. Covers cluster verification, controller install, GPU assessment, provider setup, and first deployment. WHEN: "setup AI Runway", "onboard AKS cluster", "install AI Runway", "airunway setup", "deploy model to AKS", "GPU inference on AKS", "KAITO setup on AKS", "run LLM on AKS", "vLLM on AKS", "set up model serving on AKS", "AI Runway controller".Read full description
appinsights-instrumentation
Guidance for instrumenting webapps with Azure Application Insights. Provides telemetry patterns, SDK setup, and configuration references. WHEN: how to instrument app, App Insights SDK, telemetry patterns, what is App Insights, Application Insights guidance, instrumentation examples, APM best practices.Read full description
azure-ai
Use for Azure AI: Search, Speech, OpenAI, Document Intelligence. Helps with search, vector/hybrid search, speech-to-text, text-to-speech, transcription, OCR. WHEN: AI Search, query search, vector search, hybrid search, semantic search, speech-to-text, text-to-speech, transcribe, OCR, convert text to speech.Read full description
azure-aigateway
Configure Azure API Management as an AI Gateway for AI models, MCP tools, and agents. WHEN: semantic caching, token limit, content safety, load balancing, AI model governance, MCP rate limiting, jailbreak detection, add Azure OpenAI backend, add AI Foundry model, test AI gateway, LLM policies, configure AI backend, token metrics, AI cost control, convert API to MCP, import OpenAPI to gateway.Read full description
azure-app-onboard
End-to-end orchestrator: from a business idea, app idea, or existing app to running Azure deployment with cost estimates and pre-deploy approval. Analyzes your app, auto-detects the right Azure services, scaffolds infrastructure code, and deploys — tailored to your app, not a template. Handles moving existing apps to Azure without rewriting or with minimal changes. WHEN: bring your app to Azure, plan my app, cost to run, is my code ready to deploy, deploy my app to the cloud, deploy all my services, what Azure services do I need, plan my Azure deployment, deploy my new app to Azure, one-click deploy, I have an app and want it on Azure, migrate my app to Azure, help me get started, build an app, no code yet, starter project. DO NOT USE FOR: use azd for deployment(use azure-deploy), optimizing existing costs (use cost-optimization), code readiness checks only (use azure-app-onboard-prereq).Read full description
azure-app-onboard-prereq
Assess whether source code is ready to deploy to Azure — the check BEFORE infrastructure work. Evaluates build health, app completeness, dependencies and local services, stack compatibility, and deployment feasibility. Answers questions about what your app needs before it can be deployed — frameworks, dependencies, and configuration. Checks whether dependencies are compatible and identifies deployment blockers and unsupported frameworks. WHEN: \"evaluate my repo\", \"is my app ready to deploy\", \"what does my app need to deploy\", \"what do I need before deploying\", \"does my app need\", \"can I ship this to Azure\", \"scan my repo for issues\", \"is this app deployable\", \"check if my app is ready for Azure\", \"do I need a Dockerfile\", \"what's blocking my deployment\", \"are there any blockers\", \"are my dependencies compatible\", \"does Azure support my framework\", \"what needs to change before deploying\", \"check my app configuration\".Read full description

Overview

Key Concepts

Application Types

Core Workflow

Step 1: Register the Application

Step 2: Configure Authentication

Step 3: Configure API Permissions

Step 4: Create Client Credentials (if needed)

Step 5: Implement OAuth Flow

Common Patterns

Pattern 1: First-Time App Registration

Pattern 2: Console Application with User Authentication

Pattern 3: Service-to-Service Authentication

MCP Tools and CLI

Azure CLI Commands

Microsoft Authentication Library (MSAL)

Security Best Practices

SDK Quick References

References

External Resources

Account or credentials required

What's inside

More skills

MCP keyword matches