Entra App Registration

Microsoft Entra ID (formerly Azure AD) is Microsoft's cloud identity and access-management service. This skill guides app registration, OAuth 2.0 flows, and MSAL integration.

For key concepts, application types, and the 3 common patterns (first-time registration, console app with user auth, service-to-service), read references/common-patterns.md.

Rules

• Prefer IaC for managing app registrations when the project uses IaC, scales to many apps, or needs audit history (see references/BICEP-EXAMPLE.bicep)
• Prefer certificates or federated identity credentials over client secrets in production
• Store client secrets in Key Vault — never commit them; rotate regularly; copy the value immediately on creation (only shown once)
• Grant least-privilege API permissions — only the scopes the app actually uses
• CLI for ad-hoc, IaC for production — see references/cli-commands.md
• Out of scope: Azure RBAC (azure-rbac), Key Vault audits (azure-compliance), resource security scanning (azure-compliance)

Core Workflow

Five-step procedure (full per-step detail in references/core-workflow.md):

1. Register the Application — portal, CLI (cli-commands.md), or IaC (BICEP-EXAMPLE.bicep)
2. Configure Authentication — redirect URIs / token settings per app type
3. Configure API Permissions — Graph and custom-API scopes (api-permissions.md)
4. Create Client Credentials — secret / certificate / federated identity (Key Vault)
5. Implement OAuth Flow — code integration (oauth-flows.md, console-app-example.md)

Microsoft Authentication Library (MSAL)

Recommended library for integrating with the Microsoft identity platform:

• .NET / C# — Microsoft.Identity.Client
• JavaScript / TypeScript — @azure/msal-browser, @azure/msal-node
• Python — msal

Examples: references/console-app-example.md. SDK quick references in references/sdk/ (azure-identity + key-vault, per language).

Security Best Practices

Never hardcode secrets · rotate regularly · prefer certificates over secrets in production · least-privilege API permissions · enable MFA · use managed identity for Azure-hosted apps · validate tokens (issuer / audience / expiration) · HTTPS-only redirect URIs (per the canonical security baseline) · monitor sign-ins via Entra ID logs.

Full details in references/auth-best-practices.md.

Reference Index