{"registry_version":"2026.1025.387","generated_at":"2026-10-25T06:27:00Z","content_sha256":"089d16f627d9365e3d0663cc8069203706d7cb23a76c332226e29686968811a5","signed":true,"signature":{"key_id":"ed25519:74ca19268e364242","algorithm":"ed25519","expires_at":"2026-11-24T06:27:09Z","expired":false,"manifest":"/registry/manifest.json"},"entry_sha256":"152b72b41cafcae985a62a43cef84cfef85a01552a2b9c9e560062e4d8ec9227","entry":{"id":"microsoft/entra-app-registration","name":"Microsoft Entra ID app registration","vendor":"Microsoft","summary":"Register an application in a Microsoft Entra tenant so it can sign users in with Microsoft accounts and call Microsoft APIs. Produces a tenant ID, a client (application) ID and a credential (certificate, federated credential or client secret).","aliases":["Azure AD app registration","Azure Active Directory app","Microsoft identity platform app"],"category":"auth","group":"B","homepage":"https://entra.microsoft.com/","docs":["https://learn.microsoft.com/en-us/entra/identity-platform/quickstart-register-app","https://learn.microsoft.com/en-us/entra/identity-platform/how-to-add-credentials","https://learn.microsoft.com/en-us/entra/identity-platform/reply-url"],"status":"researched","last_verified":null,"last_researched":"2026-10-25","sources":[{"id":"register","url":"https://learn.microsoft.com/en-us/entra/identity-platform/quickstart-register-app","title":"How to register an app in Microsoft Entra ID","accessed":"2026-10-25","supports":"Prerequisites (Azure account, at least Application Developer role, workforce or external tenant), registration steps, supported account types, app object cannot move between tenants, apps hidden from My Apps by default, admin consent for external tenants.","kind":"official"},{"id":"tenant","url":"https://learn.microsoft.com/en-us/entra/identity-platform/quickstart-create-new-tenant","title":"Create a Microsoft Entra tenant (identity platform)","accessed":"2026-10-25","supports":"A tenant is needed to register apps; an account with no tenant shows a GUID under the account name and cannot register apps until a tenant exists; initial domain is <name>.onmicrosoft.com and cannot be changed.","kind":"official"},{"id":"new-tenant","url":"https://learn.microsoft.com/en-us/entra/fundamentals/create-new-tenant","title":"Quickstart - Access and create new tenant","accessed":"2026-10-25","supports":"Only paid customers can create additional Workforce tenants; free-tenant or trial users cannot create more tenants and are pointed to a free Azure account; Tenant Creator role; creator becomes Global Administrator; emergency access accounts recommendation.","kind":"official"},{"id":"azure-free","url":"https://azure.microsoft.com/en-us/pricing/purchase-options/azure-account","title":"Azure free account","accessed":"2026-10-25","supports":"Free account needs a phone number, a non-prepaid credit or debit card and a Microsoft or GitHub account; temporary verification hold; credit usable for 30 days; account must move to pay-as-you-go or services are disabled; one free account per new customer.","kind":"official"},{"id":"signup-trouble","url":"https://learn.microsoft.com/en-us/azure/cost-management-billing/troubleshoot-subscription/troubleshoot-azure-sign-up","title":"Troubleshoot issues when you sign up for a new account in the Azure portal","accessed":"2026-10-25","supports":"Common Azure sign-up blockers and fixes (profile and card details, existing account, retry in private window).","kind":"official"},{"id":"credentials","url":"https://learn.microsoft.com/en-us/entra/identity-platform/how-to-add-credentials","title":"Add and manage app credentials in Microsoft Entra ID","accessed":"2026-10-25","supports":"Certificate (.cer/.pem/.crt) recommended over client secrets; client secret lifetime limited to 24 months, recommended under 12 months; secret value shown only once; federated credentials for GitHub Actions/Kubernetes/other issuers.","kind":"official"},{"id":"reply-url","url":"https://learn.microsoft.com/en-us/entra/identity-platform/reply-url","title":"Redirect URI (reply URL) best practices and limitations","accessed":"2026-10-25","supports":"Redirect URIs must be https except localhost; case-sensitive; 256 max (work/school) or 100 max (with personal accounts); 256 characters each; no query parameters or wildcards when personal accounts are supported; AADSTS50011 on mismatch.","kind":"official"},{"id":"errors","url":"https://learn.microsoft.com/en-us/entra/identity-platform/reference-error-codes","title":"Microsoft Entra authentication and authorization error codes","accessed":"2026-10-25","supports":"Meaning of AADSTS50011, AADSTS50194, AADSTS65001, AADSTS90094, AADSTS700016, AADSTS7000215, AADSTS7000222.","kind":"official"},{"id":"admin-consent","url":"https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/grant-admin-consent","title":"Grant tenant-wide admin consent to an application","accessed":"2026-10-25","supports":"Roles that can grant admin consent (Privileged Role Administrator for any permission; Cloud Application/Application/AI Administrator for all except Microsoft Graph application permissions); admin consent URL format.","kind":"official"},{"id":"publisher-domain","url":"https://learn.microsoft.com/en-us/entra/identity-platform/howto-configure-publisher-domain","title":"Configure an app's publisher domain","accessed":"2026-10-25","supports":"Multitenant apps registered after 30 November 2020 show \"unverified\" on the consent prompt unless publisher verified; single-root-domain redirect URI restriction when publisher domain is null.","kind":"official"},{"id":"env-credential","url":"https://learn.microsoft.com/en-us/dotnet/api/azure.identity.environmentcredential","title":"EnvironmentCredential Class (Azure.Identity)","accessed":"2026-10-25","supports":"Standard environment variable names AZURE_TENANT_ID, AZURE_CLIENT_ID, AZURE_CLIENT_SECRET, AZURE_CLIENT_CERTIFICATE_PATH.","kind":"official"},{"id":"add-password","url":"https://learn.microsoft.com/en-us/graph/api/application-addpassword","title":"application: addPassword - Microsoft Graph v1.0","accessed":"2026-10-25","supports":"Secrets can be created through Microsoft Graph (also at application creation); default lifetime two years; secretText is 16-64 characters and cannot be retrieved later.","kind":"official"},{"id":"api-terms","url":"https://learn.microsoft.com/en-us/legal/microsoft-apis/terms-of-use","title":"Terms of Use - Microsoft APIs","accessed":"2026-10-25","supports":"Registration must be accurate and kept up to date; credentials are non-transferable; least-data and least-permission rule; privacy statement must link to consent-revocation pages; Microsoft may suspend or terminate at any time.","kind":"official"},{"id":"msa-apps-qa","url":"https://learn.microsoft.com/en-us/answers/questions/2127352/how-to-move-an-azure-application-created-under-a-p","title":"How to move an Azure application created under a personal account to a directory? (Microsoft Q&A)","accessed":"2026-10-25","supports":"People report the portal labels apps created under a personal account as \"not contained within any directory\", says creating apps outside a directory is deprecated, and that such apps cannot be moved into a tenant (must be recreated).","kind":"community"}],"allowed_domains":["entra.microsoft.com","portal.azure.com","azure.microsoft.com","login.microsoftonline.com"],"account_model":{"summary":"A Microsoft account (or GitHub account) signs up for Azure, which creates a Microsoft Entra tenant (\"Default Directory\"). The app registration (application object) lives in exactly one tenant and can never be moved. Each tenant that uses the app gets its own service principal (\"Enterprise app\") where consent is recorded. Who can sign in is set by \"Supported account types\".","accounts":[{"name":"Microsoft account or GitHub account","kind":"personal","owned_by":"the person","required":true,"note":"Used to sign up for Azure. A personal account with no tenant cannot register apps."},{"name":"Azure account and subscription","kind":"billing","owned_by":"the person or the company","parent":"Microsoft account or GitHub account","required":false,"note":"Microsoft's quickstart lists an Azure account with an active subscription as a prerequisite; a free account is enough. Only needed if you do not already have a tenant (for example through Microsoft 365)."},{"name":"Microsoft Entra tenant","kind":"organisation","owned_by":"the company (its Global Administrators)","parent":"Azure account and subscription","required":true,"note":"The creator becomes Global Administrator. Initial domain is <name>.onmicrosoft.com and cannot be changed."},{"name":"App registration (application object)","kind":"project","owned_by":"the tenant","parent":"Microsoft Entra tenant","required":true,"note":"Holds the client ID, redirect URIs, credentials and requested API permissions."},{"name":"Enterprise application (service principal)","kind":"other","parent":"Microsoft Entra tenant","note":"Created in each tenant where the app is used; consent and user assignment live here."}],"notes":["Apps registered with a personal Microsoft account cannot be publisher verified, and people report they cannot be moved into a tenant later. Register in a tenant from the start.","Use separate app registrations for development and production so localhost redirect URIs are not exposed in production."]},"prerequisites":[{"need":"A Microsoft account, GitHub account or existing work account"},{"need":"An Entra tenant, or an Azure account that creates one (free account accepted)","note":"Only paid customers can create additional workforce tenants from the admin center."}],"identity_requires":["app_name"],"have_ready":[{"kind":"payment_card","description":"A non-prepaid credit or debit card in your name","why":"Azure free-account sign-up uses it to confirm you are a real person; a temporary verification hold may appear.","needed_for":["azure-account"],"auto_check":"none","source":"azure-free"},{"kind":"phone_for_2fa","description":"A mobile phone that can receive a verification code","why":"Azure sign-up verifies a phone number, and admin roles should have multifactor authentication on.","needed_for":["azure-account"],"auto_check":"none","source":"azure-free"},{"kind":"other","description":"Your app's exact redirect URIs (production https URLs and any localhost URLs for development)","why":"Sign-in fails with AADSTS50011 unless the redirect URI in the request matches one registered on the app.","needed_for":["redirect-uris"],"auto_check":"none","source":"reply-url"},{"kind":"other","description":"A certificate (.cer, .pem or .crt public key) if you will run a confidential client in production","why":"Microsoft recommends certificates or federated credentials over client secrets for production.","needed_for":["credential"],"auto_check":"none","source":"credentials"}],"steps":[{"id":"azure-account","title":"Create an Azure account (only if you have no tenant)","summary":"If you do not already have a Microsoft Entra tenant (for example from Microsoft 365 or an existing Azure subscription), sign up for an Azure free account. You will verify a phone number and a non-prepaid card. Signing up does not charge you; you only pay if you move to pay-as-you-go.","route":"guided","depends_on":[],"gate":"human_payment","url":"https://azure.microsoft.com/en-us/pricing/purchase-options/azure-account","recovery":[{"hiccup":"Sign-up says it cannot proceed and to contact billing support.","fix":"Check the name and address on your Microsoft account match your bank's records for the card, retry in a private browser window, and if it persists open a free billing support request.","source":"signup-trouble"},{"hiccup":"The free offer is not available.","fix":"The free account is for new customers only, one per customer. Sign up for pay-as-you-go instead, or use the tenant you already have.","source":"azure-free"}],"optional":true,"sources":["azure-free","signup-trouble"]},{"id":"tenant","title":"Check you are in the right tenant","summary":"Sign in to the Microsoft Entra admin center. Your tenant name appears under your account name. If you only see a GUID, you have no tenant yet and cannot register apps. If you belong to several tenants, switch to the one that should own the app; an app can never be moved between tenants later.","route":"guided","depends_on":["azure-account"],"gate":"human_login","url":"https://entra.microsoft.com/","recovery":[{"hiccup":"Only a GUID shows under your account name and \"New registration\" is unavailable.","fix":"Create a tenant first (sign up for an Azure account, or create a tenant under Entra ID > Overview > Manage tenants).","source":"tenant"},{"hiccup":"\"Create tenant\" is greyed out or \"Microsoft Entra ID\" is not offered as a tenant type.","fix":"Only paid customers can create additional workforce tenants. Use your existing tenant, ask an admin for the Tenant Creator role, or start from a free Azure account.","source":"new-tenant"}],"sources":["tenant","new-tenant"]},{"id":"register","title":"Register the application","summary":"In Entra ID > App registrations > New registration, give the app a name users will recognise and choose who can sign in: single tenant (recommended for most internal apps), any Entra tenant (multitenant SaaS), any tenant plus personal Microsoft accounts, or personal accounts only. Select Register, then note the Application (client) ID and Directory (tenant) ID on the Overview page.","route":"copilot","depends_on":["tenant"],"gate":"human_submit","url":"https://entra.microsoft.com/#view/Microsoft_AAD_RegisteredApps/ApplicationsListBlade","fields":[{"label":"Name","from_profile":"app_name","note":"Users can see this name; it can be changed later."}],"recovery":[{"hiccup":"You lack permission to register applications.","fix":"Ask a tenant admin to assign you at least the Application Developer role.","source":"register"},{"hiccup":"AADSTS50194 when signing in through the /common endpoint.","code":"AADSTS50194","fix":"The app is single-tenant. Use the tenant-specific endpoint, or change Supported account types to multitenant.","source":"errors"},{"hiccup":"Users of other organisations see \"unverified\" on the consent screen.","fix":"Multitenant apps registered after 30 November 2020 need publisher verification to show a verified badge.","source":"publisher-domain"}],"capture":{"env":"AZURE_CLIENT_ID","kind":"client_id","mask_pattern":"^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$"},"sources":["register"]},{"id":"redirect-uris","title":"Add a platform and redirect URIs","summary":"Under Authentication, add the right platform (Web, Single-page application, iOS/macOS, Android, or Mobile and desktop) and its redirect URIs. Use https everywhere except localhost. URIs are case-sensitive. Device-code and on-behalf-of flows do not need a redirect URI.","route":"copilot","depends_on":["register"],"gate":"human_submit","url":"https://entra.microsoft.com/#view/Microsoft_AAD_RegisteredApps/ApplicationsListBlade","recovery":[{"hiccup":"\"The reply URL specified in the request does not match the reply URLs configured for the application.\"","code":"AADSTS50011","fix":"Add the exact redirect URI (scheme, host, path and case) to the app registration, on the platform type your app uses.","source":"reply-url"},{"hiccup":"The portal refuses an http://127.0.0.1 redirect URI.","fix":"http loopback IP URIs must be added through the application manifest (replyUrlsWithType); or use http://localhost.","source":"reply-url"},{"hiccup":"Two redirect URIs on different root domains are rejected for a multitenant app.","fix":"Set a publisher domain, or keep all redirect URIs under one registered root domain.","source":"publisher-domain"}],"sources":["reply-url"]},{"id":"credential","title":"Add a credential (certificate, federated credential or secret)","summary":"Apps that run on a server need a credential. Under Certificates & secrets, prefer a certificate (upload the public key) or a federated credential (GitHub Actions, Kubernetes, other OIDC issuers). A client secret is acceptable for local development only: its lifetime is capped at 24 months (Microsoft recommends under 12) and the value is shown once, so copy it before leaving the page.","route":"guided","depends_on":["register"],"gate":"human_submit","url":"https://entra.microsoft.com/#view/Microsoft_AAD_RegisteredApps/ApplicationsListBlade","recovery":[{"hiccup":"You left the page and cannot see the secret value any more.","fix":"Secret values are never shown again. Create a new secret and delete the old one once nothing uses it.","source":"credentials"},{"hiccup":"Token requests fail with \"Invalid client secret is provided.\"","code":"AADSTS7000215","fix":"You are probably sending the secret ID instead of the secret value, or a mistyped value. Create a new secret and copy its Value column.","source":"errors"},{"hiccup":"Token requests fail because \"the provided client secret keys are expired\".","code":"AADSTS7000222","fix":"Create a new credential (ideally a certificate), deploy it, then remove the expired one.","source":"errors"}],"capture":{"env":"AZURE_CLIENT_SECRET","kind":"secret"},"sources":["credentials"]},{"id":"api-permissions","title":"Request API permissions and grant consent","summary":"Under API permissions, add only the permissions the app needs (for example Microsoft Graph User.Read). Users can consent to some delegated permissions themselves, depending on tenant policy; application permissions always need an admin. A Privileged Role Administrator can consent to anything; Cloud Application, Application or AI Administrators can consent to everything except Microsoft Graph application permissions.","route":"guided","depends_on":["register"],"gate":"human_submit","url":"https://entra.microsoft.com/#view/Microsoft_AAD_RegisteredApps/ApplicationsListBlade","recovery":[{"hiccup":"Users see \"Need admin approval\" or the error says administrator consent is required.","code":"AADSTS90094","fix":"A suitable admin grants tenant-wide consent from API permissions, or opens https://login.microsoftonline.com/{tenant}/adminconsent?client_id={client-id}.","source":"admin-consent"},{"hiccup":"\"The user or administrator hasn't consented to use the application.\"","code":"AADSTS65001","fix":"Send an interactive sign-in so the user can consent, or have an admin grant consent for the tenant.","source":"errors"},{"hiccup":"\"Application was not found in the directory/tenant.\"","code":"AADSTS700016","fix":"Check the client ID, and that the request goes to the right tenant; a multitenant app must be consented to in the customer's tenant first.","source":"errors"}],"sources":["admin-consent"]}],"outputs":[{"name":"AZURE_TENANT_ID","description":"Directory (tenant) ID of the tenant that owns the app.","secret":false,"example_format":"xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx","from_step":"register"},{"name":"AZURE_CLIENT_ID","description":"Application (client) ID of the app registration.","secret":false,"example_format":"xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx","from_step":"register"},{"name":"AZURE_CLIENT_SECRET","description":"Client secret value (only if you use a secret rather than a certificate or federated credential).","secret":true,"example_format":"opaque string, 16-64 characters","environments":["development"],"from_step":"credential"}],"terms_notes":[{"kind":"rules_say","severity":"red","title":"Microsoft can suspend API access at any time","text":"The Microsoft APIs Terms of Use let Microsoft suspend or terminate your access \"in our sole discretion at any time, for any reason\". Breaking the API guidelines (for example scraping, asking for more permissions than you need, or getting around limits) can lead to suspension.","source":"api-terms"},{"kind":"rules_say","severity":"amber","title":"Keep your registration accurate","text":"Your app registration must be accurate and kept up to date. Access credentials cannot be transferred, and everything done with them is your responsibility.","source":"api-terms"},{"kind":"rules_say","severity":"amber","title":"Privacy statement must explain how to revoke consent","text":"If users sign in with a Microsoft account and Microsoft does not provide the sign-in screen, your privacy statement must link to https://account.live.com/consent/Manage and/or https://myapps.microsoft.com so users can revoke consent.","source":"api-terms"},{"kind":"rules_say","severity":"yellow","title":"An app cannot change tenant","text":"Once created, the application object cannot be moved to another tenant. Pick the owning tenant carefully.","source":"register"},{"kind":"people_report","severity":"yellow","title":"Personal-account apps are a dead end","text":"People report that apps created under a personal Microsoft account outside any directory cannot be moved into a tenant and must be recreated (Microsoft Q&A).","source":"msa-apps-qa"}],"renewals":[{"what":"Client secret expires (maximum lifetime 24 months; Microsoft recommends less than 12)","every":"up to 24 months","every_days":730,"source":"credentials"}],"pricing_notes":{"free_tier":"Registering apps costs nothing beyond having a tenant; an Azure free account is enough to get one.","notes":"Azure free account sign-up does not charge you; charges start only if you move to pay-as-you-go and use paid services.","source":"azure-free"},"api_provisioning":{"available":"partial","notes":"Once a human has a tenant and an admin sign-in, apps and secrets can be created through Microsoft Graph (POST /applications, addPassword) or the Azure CLI. Creating the Azure account and tenant, and the first admin sign-in, are human steps.","docs":["https://learn.microsoft.com/en-us/graph/api/application-addpassword"],"source":"add-password"},"detect":{"env_names":["AZURE_TENANT_ID","AZURE_CLIENT_ID","AZURE_CLIENT_SECRET","AZURE_CLIENT_CERTIFICATE_PATH"],"packages":["@azure/msal-node","@azure/msal-browser","@azure/identity","msal","azure-identity"]}}}