verapli
Sign inJoin free
Menu

Guides · auth · Verification-gated

Microsoft Entra ID app registration

Register an application in a Microsoft Entra tenant so it can sign users in with Microsoft accounts and call Microsoft APIs. Produces a tenant ID, a client (application) ID and a credential (certificate, federated credential or client secret).

Researched · not yet run liveLast researched 25 October 2026 · Microsoft · provider site

Researched, not yet run live. Built from the provider’s official pages (linked below). A person hasn’t walked this flow end to end yet, so check each step against the source.
Do this with verapliJSON for agents

Who owns what

A Microsoft account (or GitHub account) signs up for Azure, which creates a Microsoft Entra tenant ("Default Directory"). The app registration (application object) lives in exactly one tenant and can never be moved. Each tenant that uses the app gets its own service principal ("Enterprise app") where consent is recorded. Who can sign in is set by "Supported account types".

  • Microsoft account or GitHub account personal owned by the personUsed to sign up for Azure. A personal account with no tenant cannot register apps.
  • Azure account and subscription billingoptional owned by the person or the company · under Microsoft account or GitHub accountMicrosoft's quickstart lists an Azure account with an active subscription as a prerequisite; a free account is enough. Only needed if you do not already have a tenant (for example through Microsoft 365).
  • Microsoft Entra tenant organisation owned by the company (its Global Administrators) · under Azure account and subscriptionThe creator becomes Global Administrator. Initial domain is <name>.onmicrosoft.com and cannot be changed.
  • App registration (application object) project owned by the tenant · under Microsoft Entra tenantHolds the client ID, redirect URIs, credentials and requested API permissions.
  • Enterprise application (service principal) other · under Microsoft Entra tenantCreated in each tenant where the app is used; consent and user assignment live here.

Apps registered with a personal Microsoft account cannot be publisher verified, and people report they cannot be moved into a tenant later. Register in a tenant from the start.

Use separate app registrations for development and production so localhost redirect URIs are not exposed in production.

Have ready

  • A Microsoft account, GitHub account or existing work account
  • An Entra tenant, or an Azure account that creates one (free account accepted): Only paid customers can create additional workforce tenants from the admin center.
  • A non-prepaid credit or debit card in your name · Azure free-account sign-up uses it to confirm you are a real person; a temporary verification hold may appear. [4]Needed for: Create an Azure account (only if you have no tenant)
  • A mobile phone that can receive a verification code · Azure sign-up verifies a phone number, and admin roles should have multifactor authentication on. [4]Needed for: Create an Azure account (only if you have no tenant)
  • Your app's exact redirect URIs (production https URLs and any localhost URLs for development) · Sign-in fails with AADSTS50011 unless the redirect URI in the request matches one registered on the app. [7]Needed for: Add a platform and redirect URIs
  • A certificate (.cer, .pem or .crt public key) if you will run a confidential client in production · Microsoft recommends certificates or federated credentials over client secrets for production. [6]Needed for: Add a credential (certificate, federated credential or secret)

Steps

Steps marked “human step” are ones only you can do: verapli never signs in, submits, pays or accepts terms for you.

  1. Create an Azure account (only if you have no tenant)optional

    If you do not already have a Microsoft Entra tenant (for example from Microsoft 365 or an existing Azure subscription), sign up for an Azure free account. You will verify a phone number and a non-prepaid card. Signing up does not charge you; you only pay if you move to pay-as-you-go.

    • Guided by hand
    • Human step: You add payment details
    If something goes wrong (2)
    • Sign-up says it cannot proceed and to contact billing support.: Check the name and address on your Microsoft account match your bank's records for the card, retry in a private browser window, and if it persists open a free billing support request. [5]
    • The free offer is not available.: The free account is for new customers only, one per customer. Sign up for pay-as-you-go instead, or use the tenant you already have. [4]

    Where: https://azure.microsoft.com/en-us/pricing/purchase-options/azure-account

  2. Check you are in the right tenant

    Sign in to the Microsoft Entra admin center. Your tenant name appears under your account name. If you only see a GUID, you have no tenant yet and cannot register apps. If you belong to several tenants, switch to the one that should own the app; an app can never be moved between tenants later.

    • Guided by hand
    • Human step: You sign in
    • After: Create an Azure account (only if you have no tenant)
    If something goes wrong (2)
    • Only a GUID shows under your account name and "New registration" is unavailable.: Create a tenant first (sign up for an Azure account, or create a tenant under Entra ID > Overview > Manage tenants). [2]
    • "Create tenant" is greyed out or "Microsoft Entra ID" is not offered as a tenant type.: Only paid customers can create additional workforce tenants. Use your existing tenant, ask an admin for the Tenant Creator role, or start from a free Azure account. [3]

    Where: https://entra.microsoft.com/

  3. Register the application

    In Entra ID > App registrations > New registration, give the app a name users will recognise and choose who can sign in: single tenant (recommended for most internal apps), any Entra tenant (multitenant SaaS), any tenant plus personal Microsoft accounts, or personal accounts only. Select Register, then note the Application (client) ID and Directory (tenant) ID on the Overview page.

    • verapli co-pilot
    • Human step: You press submit
    • After: Check you are in the right tenant

    verapli captures AZURE_CLIENT_ID here by plain code: encrypted in your browser, never shown to AI.

    If something goes wrong (3)
    • You lack permission to register applications.: Ask a tenant admin to assign you at least the Application Developer role. [1]
    • AADSTS50194 when signing in through the /common endpoint. (AADSTS50194): The app is single-tenant. Use the tenant-specific endpoint, or change Supported account types to multitenant. [8]
    • Users of other organisations see "unverified" on the consent screen.: Multitenant apps registered after 30 November 2020 need publisher verification to show a verified badge. [10]

    Where: https://entra.microsoft.com/#view/Microsoft_AAD_RegisteredApps/ApplicationsListBlade

  4. Add a platform and redirect URIs

    Under Authentication, add the right platform (Web, Single-page application, iOS/macOS, Android, or Mobile and desktop) and its redirect URIs. Use https everywhere except localhost. URIs are case-sensitive. Device-code and on-behalf-of flows do not need a redirect URI.

    • verapli co-pilot
    • Human step: You press submit
    • After: Register the application
    If something goes wrong (3)
    • "The reply URL specified in the request does not match the reply URLs configured for the application." (AADSTS50011): Add the exact redirect URI (scheme, host, path and case) to the app registration, on the platform type your app uses. [7]
    • The portal refuses an http://127.0.0.1 redirect URI.: http loopback IP URIs must be added through the application manifest (replyUrlsWithType); or use http://localhost. [7]
    • Two redirect URIs on different root domains are rejected for a multitenant app.: Set a publisher domain, or keep all redirect URIs under one registered root domain. [10]

    Where: https://entra.microsoft.com/#view/Microsoft_AAD_RegisteredApps/ApplicationsListBlade

  5. Add a credential (certificate, federated credential or secret)

    Apps that run on a server need a credential. Under Certificates & secrets, prefer a certificate (upload the public key) or a federated credential (GitHub Actions, Kubernetes, other OIDC issuers). A client secret is acceptable for local development only: its lifetime is capped at 24 months (Microsoft recommends under 12) and the value is shown once, so copy it before leaving the page.

    • Guided by hand
    • Human step: You press submit
    • After: Register the application

    verapli captures AZURE_CLIENT_SECRET here by plain code: encrypted in your browser, never shown to AI.

    If something goes wrong (3)
    • You left the page and cannot see the secret value any more.: Secret values are never shown again. Create a new secret and delete the old one once nothing uses it. [6]
    • Token requests fail with "Invalid client secret is provided." (AADSTS7000215): You are probably sending the secret ID instead of the secret value, or a mistyped value. Create a new secret and copy its Value column. [8]
    • Token requests fail because "the provided client secret keys are expired". (AADSTS7000222): Create a new credential (ideally a certificate), deploy it, then remove the expired one. [8]

    Where: https://entra.microsoft.com/#view/Microsoft_AAD_RegisteredApps/ApplicationsListBlade

  6. Request API permissions and grant consent

    Under API permissions, add only the permissions the app needs (for example Microsoft Graph User.Read). Users can consent to some delegated permissions themselves, depending on tenant policy; application permissions always need an admin. A Privileged Role Administrator can consent to anything; Cloud Application, Application or AI Administrators can consent to everything except Microsoft Graph application permissions.

    • Guided by hand
    • Human step: You press submit
    • After: Register the application
    If something goes wrong (3)
    • Users see "Need admin approval" or the error says administrator consent is required. (AADSTS90094): A suitable admin grants tenant-wide consent from API permissions, or opens https://login.microsoftonline.com/{tenant}/adminconsent?client_id={client-id}. [9]
    • "The user or administrator hasn't consented to use the application." (AADSTS65001): Send an interactive sign-in so the user can consent, or have an admin grant consent for the tenant. [8]
    • "Application was not found in the directory/tenant." (AADSTS700016): Check the client ID, and that the request goes to the right tenant; a multitenant app must be consented to in the customer's tenant first. [8]

    Where: https://entra.microsoft.com/#view/Microsoft_AAD_RegisteredApps/ApplicationsListBlade

Terms and gotchas

Plain-English summary, not legal advice. Each card links its source.

Can get you bannedThe rules say

Microsoft can suspend API access at any time

The Microsoft APIs Terms of Use let Microsoft suspend or terminate your access "in our sole discretion at any time, for any reason". Breaking the API guidelines (for example scraping, asking for more permissions than you need, or getting around limits) can lead to suspension. [13]

Can cost moneyThe rules say

Keep your registration accurate

Your app registration must be accurate and kept up to date. Access credentials cannot be transferred, and everything done with them is your responsibility. [13]

Can cost moneyThe rules say

Privacy statement must explain how to revoke consent

If users sign in with a Microsoft account and Microsoft does not provide the sign-in screen, your privacy statement must link to https://account.live.com/consent/Manage and/or https://myapps.microsoft.com so users can revoke consent. [13]

Worth knowingThe rules say

An app cannot change tenant

Once created, the application object cannot be moved to another tenant. Pick the owning tenant carefully. [1]

Worth knowingPeople report

Personal-account apps are a dead end

People report that apps created under a personal Microsoft account outside any directory cannot be moved into a tenant and must be recreated (Microsoft Q&A). [14]

What you end up with

Env varSecretFormatWhat it is
AZURE_TENANT_IDnot secretxxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxxDirectory (tenant) ID of the tenant that owns the app.
AZURE_CLIENT_IDnot secretxxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxxApplication (client) ID of the app registration.
AZURE_CLIENT_SECRETsecretopaque string, 16-64 charactersClient secret value (only if you use a secret rather than a certificate or federated credential).

Renewals

  • Client secret expires (maximum lifetime 24 months; Microsoft recommends less than 12): every up to 24 months [6]

Pricing

  • Free tier: Registering apps costs nothing beyond having a tenant; an Azure free account is enough to get one.
  • Azure free account sign-up does not charge you; charges start only if you move to pay-as-you-go and use paid services.

Source [4]

For agents

The same entry as JSON: /api/v1/entries/microsoft/entra-app-registration · requirements /api/v1/requirements/microsoft/entra-app-registration · terms /api/v1/terms/microsoft/entra-app-registration.

Remote MCP (read-only, no auth)
claude mcp add --transport http verapli https://verapli.com/mcp

> "What do I need for Microsoft Entra ID app registration, and how long will it take?"
  → tools/call requirements { "provider_id": "microsoft/entra-app-registration" }

Sources

  1. How to register an app in Microsoft Entra ID Prerequisites (Azure account, at least Application Developer role, workforce or external tenant), registration steps, supported account types, app object cannot move between tenants, apps hidden from My Apps by default, admin consent for external tenants. · accessed 25 October 2026 · official
  2. Create a Microsoft Entra tenant (identity platform) A tenant is needed to register apps; an account with no tenant shows a GUID under the account name and cannot register apps until a tenant exists; initial domain is <name>.onmicrosoft.com and cannot be changed. · accessed 25 October 2026 · official
  3. Quickstart - Access and create new tenant Only paid customers can create additional Workforce tenants; free-tenant or trial users cannot create more tenants and are pointed to a free Azure account; Tenant Creator role; creator becomes Global Administrator; emergency access accounts recommendation. · accessed 25 October 2026 · official
  4. Azure free account Free account needs a phone number, a non-prepaid credit or debit card and a Microsoft or GitHub account; temporary verification hold; credit usable for 30 days; account must move to pay-as-you-go or services are disabled; one free account per new customer. · accessed 25 October 2026 · official
  5. Troubleshoot issues when you sign up for a new account in the Azure portal Common Azure sign-up blockers and fixes (profile and card details, existing account, retry in private window). · accessed 25 October 2026 · official
  6. Add and manage app credentials in Microsoft Entra ID Certificate (.cer/.pem/.crt) recommended over client secrets; client secret lifetime limited to 24 months, recommended under 12 months; secret value shown only once; federated credentials for GitHub Actions/Kubernetes/other issuers. · accessed 25 October 2026 · official
  7. Redirect URI (reply URL) best practices and limitations Redirect URIs must be https except localhost; case-sensitive; 256 max (work/school) or 100 max (with personal accounts); 256 characters each; no query parameters or wildcards when personal accounts are supported; AADSTS50011 on mismatch. · accessed 25 October 2026 · official
  8. Microsoft Entra authentication and authorization error codes Meaning of AADSTS50011, AADSTS50194, AADSTS65001, AADSTS90094, AADSTS700016, AADSTS7000215, AADSTS7000222. · accessed 25 October 2026 · official
  9. Grant tenant-wide admin consent to an application Roles that can grant admin consent (Privileged Role Administrator for any permission; Cloud Application/Application/AI Administrator for all except Microsoft Graph application permissions); admin consent URL format. · accessed 25 October 2026 · official
  10. Configure an app's publisher domain Multitenant apps registered after 30 November 2020 show "unverified" on the consent prompt unless publisher verified; single-root-domain redirect URI restriction when publisher domain is null. · accessed 25 October 2026 · official
  11. EnvironmentCredential Class (Azure.Identity) Standard environment variable names AZURE_TENANT_ID, AZURE_CLIENT_ID, AZURE_CLIENT_SECRET, AZURE_CLIENT_CERTIFICATE_PATH. · accessed 25 October 2026 · official
  12. application: addPassword - Microsoft Graph v1.0 Secrets can be created through Microsoft Graph (also at application creation); default lifetime two years; secretText is 16-64 characters and cannot be retrieved later. · accessed 25 October 2026 · official
  13. Terms of Use - Microsoft APIs Registration must be accurate and kept up to date; credentials are non-transferable; least-data and least-permission rule; privacy statement must link to consent-revocation pages; Microsoft may suspend or terminate at any time. · accessed 25 October 2026 · official
  14. How to move an Azure application created under a personal account to a directory? (Microsoft Q&A) People report the portal labels apps created under a personal account as "not contained within any directory", says creating apps outside a directory is deprecated, and that such apps cannot be moved into a tenant (must be recreated). · accessed 25 October 2026 · community

Provider rules change. This page is generated from verapli registry version 2026.1025.387; spotted something out of date? Tell us. Microsoft is not affiliated with verapli.