# Configure Secure Microsoft Entra App Registrations

Identity setup errors can expose data, break sign-in, or grant excessive access. This skill guides Entra registration, OAuth selection, permissions, credentials, and MSAL integration.

## Install

```bash
npx skillstore add microsoft/entra-app-registration
```

## Metadata

- Status: approved
- Slug: microsoft-entra-app-registration
- Version: 0.0.0-placeholder
- Author version: 0.0.0-placeholder
- Skillstore revision: r2
- Version status: valid
- Tree hash: 21494f4bfe98d5cc709a3470a99f192fe1cd0da9650dd402a7a23ea0b255b769
- Author: microsoft
- GitHub username: microsoft
- License: MIT
- Repository: https://github.com/microsoft/github-copilot-for-azure/tree/main/plugin/skills/entra-app-registration/
- Ref: ebdfe608f5de2b66ff37ab4af12af8ac4f5e8006
- Supported tools: Claude, Codex, Claude Code
- Audit status: complete
- Agent install advisory: confirmation\_required
- Manual install advisory: allowed
- Artifact signature: available
- Audit attestation: unavailable
- Human verification: not\_verified
- Risk factors: network, filesystem, external\_commands, env\_access
- Quality score: 38
- Quality tier: warning
- Public page: https://skillstore.pages.dev/skills/microsoft-entra-app-registration
- Manifest: https://skillstore.pages.dev/api/skills/microsoft-entra-app-registration/manifest

## Capabilities

- Explains Entra application types, identifiers, redirect URIs, service principals, and credentials.
- Guides portal and Azure CLI workflows for creating and updating app registrations.
- Compares authorization code, PKCE, client credentials, device code, and refresh token flows.
- Maps delegated and application permissions to consent requirements and Microsoft Graph identifiers.
- Provides MSAL examples for .NET, Python, and Node.js console applications.
- Troubleshoots common Entra errors involving redirects, consent, tenants, secrets, and service principals.

## Use Cases

- Register a first application: Choose account types, redirect URIs, delegated permissions, and a suitable interactive OAuth flow.
- Automate tenant configuration: Prepare reviewed Azure CLI or Bicep steps for repeatable app registration and service-principal setup.
- Review access and consent: Compare requested Graph permissions with business needs and identify permissions requiring administrator consent.

## Prompt Templates

### Create a first registration plan

```
Guide me through registering a [application type] named [name]. Ask for missing redirect URIs, account types, and required permissions.
```

### Select an OAuth flow

```
Recommend the safest OAuth flow for [application architecture]. Explain required Entra settings, token handling, and why other flows are less suitable.
```

### Prepare reviewed CLI steps

```
Prepare Azure CLI steps for [application name] using [redirect URIs] and [permissions]. Include verification, least privilege, and rollback checks.
```

### Audit an advanced Entra design

```
Review this Entra design: [details]. Identify excessive permissions, unsafe redirects, credential risks, consent requirements, and production-ready MSAL changes.
```

## Limitations

- Requires tenant access and appropriate Entra roles for registration, consent, and credential operations.
- Does not replace organizational identity architecture, threat modeling, or production security review.
- Example identifiers, domains, permissions, and secrets must be replaced and validated before use.
- Does not manage Azure RBAC assignments or audit Key Vault expiration.

## Best Practices

- Start with minimal delegated permissions and document every permission increase.
- Use managed identity or workload identity in production, with deterministic credential selection.
- Verify redirect ownership, tenant context, and affected objects before applying administrative commands.

## Anti Patterns

- Do not place client secrets, certificates, or access tokens in source files or chat prompts.
- Do not grant tenant-wide application permissions when delegated access meets the requirement.
- Do not run credential reset, consent, or deletion commands without impact review and rollback steps.

## Security Audit

- Audited at: 2026-07-23T20:03:19.48\+00:00
- Summary: Most static alerts are lexical false positives caused by Markdown, Microsoft endpoints, OAuth scopes, and explicit Azure administration examples. Confirmed risks include unsafe placeholder redirects, credential-reset commands, and an unguarded cleanup loop. Semantic review also found a source-embedded secret pattern, broad default Graph permissions, and overbroad public-client guidance.

## Stats

- Views: 167
- Downloads: 9
- Favorites: 0
- Popularity score: 0