Skills entra-app-registration

📦

entra-app-registration

Name: entra-app-registration
Author: microsoft

v0.0.0-placeholder Content revision r2 High Risk 🌐 Network access📁 Filesystem access⚙️ External commands🔑 Env variables

Configure Secure Microsoft Entra App Registrations

Identity setup errors can expose data, break sign-in, or grant excessive access. This skill guides Entra registration, OAuth selection, permissions, credentials, and MSAL integration.

Supports: Claude Codex Code(CC)

⚠️ 38 Poor

Stop for confirmation before installing.

Review the plan and obtain explicit user consent before changing files.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "entra-app-registration" from https://skillstore.io/skills/microsoft-entra-app-registration.md and its manifest at https://skillstore.io/api/skills/microsoft-entra-app-registration/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/microsoft-entra-app-registration.md Signed manifest GET /api/skills/microsoft-entra-app-registration/manifest Signed lockfile GET /api/skills/microsoft-entra-app-registration/lockfile

Test it

Using "entra-app-registration". Register a single-tenant web application with one callback and basic profile access.

Expected outcome:

Account audience: one organizational tenant.
Redirect review: verify ownership and require HTTPS.
Permission baseline: delegated User.Read only.
Credential choice: managed identity or certificate for production.

Using "entra-app-registration". Choose authentication for a desktop application that cannot keep a secret.

Expected outcome:

Use authorization code with PKCE and a verified loopback redirect. Register it as a public client and do not create a client secret.

Using "entra-app-registration". Investigate an AADSTS50011 sign-in failure.

Expected outcome:

Compare the requested and registered redirect URIs exactly, including scheme, host, path, case, trailing slash, and platform type.

Security Audit

High Risk

v6 • 7/23/2026 Open versioned report

Most static alerts are lexical false positives caused by Markdown, Microsoft endpoints, OAuth scopes, and explicit Azure administration examples. Confirmed risks include unsafe placeholder redirects, credential-reset commands, and an unguarded cleanup loop. Semantic review also found a source-embedded secret pattern, broad default Graph permissions, and overbroad public-client guidance.

Files scanned

2,802

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (9)

High

references/console-app-example.md:311

Client Secret Embedded in Source Example

The Node.js example places the client secret directly in source configuration. Users who replace the placeholder may commit a live credential to version control.

The clientSecret field is explicitly populated from an app-registration placeholder inside source code. The surrounding example provides no secure retrieval pattern.

High

references/BICEP-EXAMPLE.bicep:121-146

Overprivileged Default API Permissions

The deployable Bicep example requests Mail.Read and application-level User.Read.All by default. An approved deployment can expose mailbox and directory data beyond basic sign-in needs.

The permission IDs and comments directly configure delegated mail access and tenant-wide application user access. These permissions are unrelated to a minimal registration baseline.

Medium

references/cli-commands.md:138

System reconnaissance

az ad app credential reset --id $APP_ID

The command resets credentials without --append, and the guide states that this deletes existing credentials. Running it can immediately break every client using those credentials.

Medium

references/cli-commands.md:141

System reconnaissance

az ad app credential reset --id $APP_ID --years 1

The one-year secret command resets credentials without --append. It can invalidate all existing application credentials and cause an authentication outage.

Medium

references/cli-commands.md:144

System reconnaissance

az ad app credential reset --id $APP_ID --end-date "2025-12-31"

The dated secret command resets credentials without --append. It can invalidate existing clients before they migrate to the new credential.

Medium

references/cli-commands.md:180

System reconnaissance

az ad app credential reset --id $APP_ID --cert "@path/to/cert.pem"

The certificate upload uses credential reset without --append. It can remove existing passwords and certificates, causing service disruption.

Medium

references/cli-commands.md:407

System reconnaissance

az ad app delete --id $APP_ID

This line deletes every application returned by a pattern-based cleanup loop without confirmation. A broad match can remove valid identity applications and interrupt authentication.

Medium

references/troubleshooting.md:70

System reconnaissance

az ad app credential reset --id $APP_ID --years 1

The troubleshooting fix resets all application credentials without warning or --append. Applying it can invalidate active clients while resolving one expired secret.

Show all 9 confirmed findings

Medium

references/first-app-registration.md:97-100

Overbroad Public Client Flow Enablement

The beginner guide tells every console app to enable public client flows, including resource owner password flow. This expands the authentication surface without confirming the required flow.

The text explicitly identifies resource owner password flow and directs console-app users to enable the setting. It does not limit the advice to device-code requirements.

Capability review items (9)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium

references/BICEP-EXAMPLE.bicep:21

Hardcoded URL

'https://myapp.azurewebsites.net/signin-oidc'

This deployable template registers a non-reserved external hostname as a default web redirect URI. An unchanged deployment could direct authorization responses to a domain outside the user's control.

Medium

references/BICEP-EXAMPLE.bicep:27

Hardcoded URL

'https://myapp.azurewebsites.net'

This deployable template registers a non-reserved external hostname as a default SPA redirect URI. An unchanged deployment could expose authorization responses to another domain.

Medium

references/BICEP-EXAMPLE.bicep:56

Hardcoded URL

logoutUrl: 'https://myapp.azurewebsites.net/signout-oidc'

The executable template sets an unverified external logout URL by default. An unchanged deployment can redirect signed-out users to a domain outside their control.

Medium

references/cli-commands.md:31

Hardcoded URL

--web-redirect-uris "https://myapp.com/callback" \

This executable example registers myapp.com as an OAuth callback without requiring replacement. Copying it unchanged could authorize redirects to a domain the user does not control.

Medium

references/cli-commands.md:55

Hardcoded URL

--web-redirect-uris "https://myapp.com/callback" \

This multi-tenant example registers myapp.com as an OAuth callback without a replacement guard. The external placeholder can become an unauthorized redirect destination.

Medium

references/cli-commands.md:117

Hardcoded URL

--web-redirect-uris "https://myapp.com/callback" "https://myapp.com/auth"

This update command adds external myapp.com callback URLs to an existing registration. Running the example unchanged creates redirect destinations outside the user's verified domains.

Medium

references/cli-commands.md:129

Hardcoded URL

--public-client-redirect-uris "http://localhost" "myapp://auth"

The command registers a generic custom URI scheme that another local application could claim. Native clients should use protected app links or carefully validated loopback redirects.

Medium

references/troubleshooting.md:41

Hardcoded URL

--web-redirect-uris "http://localhost:3000" "https://myapp.com/callback"

This remediation command registers myapp.com as a live callback without a replacement check. Copying it unchanged can introduce an unauthorized redirect destination.

Low

references/BICEP-EXAMPLE.bicep:55

Hardcoded URL

homePageUrl: 'https://myapp.azurewebsites.net'

The executable template assigns an unverified external hostname as application metadata by default. Users may publish a link they do not control if they deploy it unchanged.

Risk Factors

🌐 Network access (50)

📁 Filesystem access (18)

references/api-permissions.md:60 references/api-permissions.md:61 references/console-app-example.md:318 references/first-app-registration.md:184 references/oauth-flows.md:181 references/oauth-flows.md:187 references/oauth-flows.md:188 references/oauth-flows.md:189 references/sdk/azure-identity-dotnet.md:11 references/sdk/azure-identity-dotnet.md:19 references/sdk/azure-identity-java.md:17 references/sdk/azure-identity-java.md:25 references/sdk/azure-identity-py.md:13 references/sdk/azure-identity-py.md:21 references/sdk/azure-identity-ts.md:11 references/sdk/azure-identity-ts.md:19 references/sdk/azure-keyvault-py.md:18 references/sdk/azure-keyvault-secrets-ts.md:18

⚙️ External commands (30)

🔑 Env variables (14)

Detected Patterns

System reconnaissance×6

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/microsoft-entra-app-registration/audits/6?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/microsoft-entra-app-registration/security.svg)](https://skillstore.io/skills/microsoft-entra-app-registration?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/microsoft-entra-app-registration?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/microsoft-entra-app-registration/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/microsoft-entra-app-registration.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

microsoft. (2026). entra-app-registration security audit report (audit version 6) [Author version 0.0.0-placeholder]. Skillstore. https://skillstore.io/skills/microsoft-entra-app-registration/audits/6

BibTeX citation

@techreport{microsoft-microsoft-entra-app-registration-2026,
  author = {microsoft},
  title = {entra-app-registration security audit report (audit version 6)},
  institution = {Skillstore},
  year = {2026},
  number = {6},
  url = {https://skillstore.io/skills/microsoft-entra-app-registration/audits/6},
  note = {Author version 0.0.0-placeholder}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "entra-app-registration security audit report (audit version 6)"
version: "0.0.0-placeholder"
type: report
authors:
  - name: "microsoft"
date-released: "2026-07-23"
url: "https://skillstore.io/skills/microsoft-entra-app-registration/audits/6"
identifiers:
  - type: other
    value: "skillstore:microsoft-entra-app-registration:audit:6"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

Register a first application

Choose account types, redirect URIs, delegated permissions, and a suitable interactive OAuth flow.

Automate tenant configuration

Prepare reviewed Azure CLI or Bicep steps for repeatable app registration and service-principal setup.

Review access and consent

Compare requested Graph permissions with business needs and identify permissions requiring administrator consent.

Try These Prompts

Create a first registration plan

Guide me through registering a [application type] named [name]. Ask for missing redirect URIs, account types, and required permissions.

Select an OAuth flow

Recommend the safest OAuth flow for [application architecture]. Explain required Entra settings, token handling, and why other flows are less suitable.

Prepare reviewed CLI steps

Prepare Azure CLI steps for [application name] using [redirect URIs] and [permissions]. Include verification, least privilege, and rollback checks.

Audit an advanced Entra design

Review this Entra design: [details]. Identify excessive permissions, unsafe redirects, credential risks, consent requirements, and production-ready MSAL changes.

Best Practices

Start with minimal delegated permissions and document every permission increase.
Use managed identity or workload identity in production, with deterministic credential selection.
Verify redirect ownership, tenant context, and affected objects before applying administrative commands.

Avoid

Do not place client secrets, certificates, or access tokens in source files or chat prompts.
Do not grant tenant-wide application permissions when delegated access meets the requirement.
Do not run credential reset, consent, or deletion commands without impact review and rollback steps.

Frequently Asked Questions

Can this skill create an Entra app automatically?

It can prepare portal, Azure CLI, or Bicep guidance. Execution still requires authenticated tenant access and appropriate roles.

Which OAuth flow should a public client use?

Prefer authorization code with PKCE. Device code is suitable when the device cannot open a browser.

When is administrator consent required?

All application permissions and some privileged delegated permissions require administrator consent. Tenant policy may require consent for additional scopes.

Should production applications use client secrets?

Prefer managed identity, workload identity, or certificates. When secrets are unavoidable, store and rotate them through a protected secret service.

Does this skill cover Azure RBAC?

No. It covers Entra app registration and API permissions, not Azure resource role assignments.

Can examples be used without changes?

No. Replace placeholders, minimize permissions, verify domains, review tenant impact, and test in a non-production environment first.