{"registry_version":"2026.1025.387","generated_at":"2026-10-25T06:27:00Z","content_sha256":"089d16f627d9365e3d0663cc8069203706d7cb23a76c332226e29686968811a5","signed":true,"signature":{"key_id":"ed25519:74ca19268e364242","algorithm":"ed25519","expires_at":"2026-11-24T06:27:09Z","expired":false,"manifest":"/registry/manifest.json"},"id":"microsoft/entra-app-registration","name":"Microsoft Entra ID app registration","vendor":"Microsoft","status":"researched","last_verified":null,"last_researched":"2026-10-25","summary":"Register an application in a Microsoft Entra tenant so it can sign users in with Microsoft accounts and call Microsoft APIs. Produces a tenant ID, a client (application) ID and a credential (certificate, federated credential or client secret).","account_model":{"summary":"A Microsoft account (or GitHub account) signs up for Azure, which creates a Microsoft Entra tenant (\"Default Directory\"). The app registration (application object) lives in exactly one tenant and can never be moved. Each tenant that uses the app gets its own service principal (\"Enterprise app\") where consent is recorded. Who can sign in is set by \"Supported account types\".","accounts":[{"name":"Microsoft account or GitHub account","kind":"personal","owned_by":"the person","required":true,"note":"Used to sign up for Azure. A personal account with no tenant cannot register apps."},{"name":"Azure account and subscription","kind":"billing","owned_by":"the person or the company","parent":"Microsoft account or GitHub account","required":false,"note":"Microsoft's quickstart lists an Azure account with an active subscription as a prerequisite; a free account is enough. Only needed if you do not already have a tenant (for example through Microsoft 365)."},{"name":"Microsoft Entra tenant","kind":"organisation","owned_by":"the company (its Global Administrators)","parent":"Azure account and subscription","required":true,"note":"The creator becomes Global Administrator. Initial domain is <name>.onmicrosoft.com and cannot be changed."},{"name":"App registration (application object)","kind":"project","owned_by":"the tenant","parent":"Microsoft Entra tenant","required":true,"note":"Holds the client ID, redirect URIs, credentials and requested API permissions."},{"name":"Enterprise application (service principal)","kind":"other","parent":"Microsoft Entra tenant","note":"Created in each tenant where the app is used; consent and user assignment live here."}],"notes":["Apps registered with a personal Microsoft account cannot be publisher verified, and people report they cannot be moved into a tenant later. Register in a tenant from the start.","Use separate app registrations for development and production so localhost redirect URIs are not exposed in production."]},"prerequisites":[{"need":"A Microsoft account, GitHub account or existing work account"},{"need":"An Entra tenant, or an Azure account that creates one (free account accepted)","note":"Only paid customers can create additional workforce tenants from the admin center."}],"identity_requires":["app_name"],"have_ready":[{"kind":"payment_card","description":"A non-prepaid credit or debit card in your name","why":"Azure free-account sign-up uses it to confirm you are a real person; a temporary verification hold may appear.","needed_for":["azure-account"],"auto_check":"none","source_url":"https://azure.microsoft.com/en-us/pricing/purchase-options/azure-account"},{"kind":"phone_for_2fa","description":"A mobile phone that can receive a verification code","why":"Azure sign-up verifies a phone number, and admin roles should have multifactor authentication on.","needed_for":["azure-account"],"auto_check":"none","source_url":"https://azure.microsoft.com/en-us/pricing/purchase-options/azure-account"},{"kind":"other","description":"Your app's exact redirect URIs (production https URLs and any localhost URLs for development)","why":"Sign-in fails with AADSTS50011 unless the redirect URI in the request matches one registered on the app.","needed_for":["redirect-uris"],"auto_check":"none","source_url":"https://learn.microsoft.com/en-us/entra/identity-platform/reply-url"},{"kind":"other","description":"A certificate (.cer, .pem or .crt public key) if you will run a confidential client in production","why":"Microsoft recommends certificates or federated credentials over client secrets for production.","needed_for":["credential"],"auto_check":"none","source_url":"https://learn.microsoft.com/en-us/entra/identity-platform/how-to-add-credentials"}],"steps":[{"id":"azure-account","title":"Create an Azure account (only if you have no tenant)","summary":"If you do not already have a Microsoft Entra tenant (for example from Microsoft 365 or an existing Azure subscription), sign up for an Azure free account. You will verify a phone number and a non-prepaid card. Signing up does not charge you; you only pay if you move to pay-as-you-go.","route":"guided","gate":"human_payment","human_only":true,"gate_label":"You add payment details","depends_on":[],"optional":true,"url":"https://azure.microsoft.com/en-us/pricing/purchase-options/azure-account","lead_time":null,"preflight":[],"captures":null},{"id":"tenant","title":"Check you are in the right tenant","summary":"Sign in to the Microsoft Entra admin center. Your tenant name appears under your account name. If you only see a GUID, you have no tenant yet and cannot register apps. If you belong to several tenants, switch to the one that should own the app; an app can never be moved between tenants later.","route":"guided","gate":"human_login","human_only":true,"gate_label":"You sign in","depends_on":["azure-account"],"optional":false,"url":"https://entra.microsoft.com/","lead_time":null,"preflight":[],"captures":null},{"id":"register","title":"Register the application","summary":"In Entra ID > App registrations > New registration, give the app a name users will recognise and choose who can sign in: single tenant (recommended for most internal apps), any Entra tenant (multitenant SaaS), any tenant plus personal Microsoft accounts, or personal accounts only. Select Register, then note the Application (client) ID and Directory (tenant) ID on the Overview page.","route":"copilot","gate":"human_submit","human_only":true,"gate_label":"You press submit","depends_on":["tenant"],"optional":false,"url":"https://entra.microsoft.com/#view/Microsoft_AAD_RegisteredApps/ApplicationsListBlade","lead_time":null,"preflight":[],"captures":"AZURE_CLIENT_ID"},{"id":"redirect-uris","title":"Add a platform and redirect URIs","summary":"Under Authentication, add the right platform (Web, Single-page application, iOS/macOS, Android, or Mobile and desktop) and its redirect URIs. Use https everywhere except localhost. URIs are case-sensitive. Device-code and on-behalf-of flows do not need a redirect URI.","route":"copilot","gate":"human_submit","human_only":true,"gate_label":"You press submit","depends_on":["register"],"optional":false,"url":"https://entra.microsoft.com/#view/Microsoft_AAD_RegisteredApps/ApplicationsListBlade","lead_time":null,"preflight":[],"captures":null},{"id":"credential","title":"Add a credential (certificate, federated credential or secret)","summary":"Apps that run on a server need a credential. Under Certificates & secrets, prefer a certificate (upload the public key) or a federated credential (GitHub Actions, Kubernetes, other OIDC issuers). A client secret is acceptable for local development only: its lifetime is capped at 24 months (Microsoft recommends under 12) and the value is shown once, so copy it before leaving the page.","route":"guided","gate":"human_submit","human_only":true,"gate_label":"You press submit","depends_on":["register"],"optional":false,"url":"https://entra.microsoft.com/#view/Microsoft_AAD_RegisteredApps/ApplicationsListBlade","lead_time":null,"preflight":[],"captures":"AZURE_CLIENT_SECRET"},{"id":"api-permissions","title":"Request API permissions and grant consent","summary":"Under API permissions, add only the permissions the app needs (for example Microsoft Graph User.Read). Users can consent to some delegated permissions themselves, depending on tenant policy; application permissions always need an admin. A Privileged Role Administrator can consent to anything; Cloud Application, Application or AI Administrators can consent to everything except Microsoft Graph application permissions.","route":"guided","gate":"human_submit","human_only":true,"gate_label":"You press submit","depends_on":["register"],"optional":false,"url":"https://entra.microsoft.com/#view/Microsoft_AAD_RegisteredApps/ApplicationsListBlade","lead_time":null,"preflight":[],"captures":null}],"gates":[{"step":"azure-account","gate":"human_payment","label":"You add payment details"},{"step":"tenant","gate":"human_login","label":"You sign in"},{"step":"register","gate":"human_submit","label":"You press submit"},{"step":"redirect-uris","gate":"human_submit","label":"You press submit"},{"step":"credential","gate":"human_submit","label":"You press submit"},{"step":"api-permissions","gate":"human_submit","label":"You press submit"}],"lead_times":[],"outputs":[{"name":"AZURE_TENANT_ID","description":"Directory (tenant) ID of the tenant that owns the app.","secret":false,"example_format":"xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx","environments":null},{"name":"AZURE_CLIENT_ID","description":"Application (client) ID of the app registration.","secret":false,"example_format":"xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx","environments":null},{"name":"AZURE_CLIENT_SECRET","description":"Client secret value (only if you use a secret rather than a certificate or federated credential).","secret":true,"example_format":"opaque string, 16-64 characters","environments":["development"]}],"renewals":[{"what":"Client secret expires (maximum lifetime 24 months; Microsoft recommends less than 12)","every":"up to 24 months","every_days":730,"source_url":"https://learn.microsoft.com/en-us/entra/identity-platform/how-to-add-credentials"}],"estimated_minutes":null,"guide_url":"https://verapli.com/guides/microsoft/entra-app-registration"}