skills.rest
thangchung
thangchungCOMMUNITY
Explore all skills by this author →
Website𝕏@thangchungGitHub

entra-app-registration

Guides Microsoft Entra ID app registration, OAuth 2.0 flows, and MSAL integration.

25|4|Updated Dec 21, 2025
Search Tags:#authentication#azure cli#msal#oauth 2.0#app registration#api permissions#microsoft entra id
One-click install
npx skills add https://github.com/thangchung/agent-engineering-experiment --skill entra-app-registration-thangchung
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: entra-app-registration
Source: https://github.com/thangchung/agent-engineering-experiment/tree/main/agentgateway-entraid-obo/.claude/skills/entra-app-registration
Command: npx skills add https://github.com/thangchung/agent-engineering-experiment --skill entra-app-registration-thangchung

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? Setting up Microsoft Entra ID (Azure AD) app registrations involves many error-prone steps: choosing the right application type, configuring redirect URIs, adding API permissions, granting admin consent, and wiring OAuth flows into code. This Skill provides step-by-step guidance, CLI commands, and working code examples to complete these tasks correctly. ## Core Features & Use Cases - App Registration Workflows: Create and configure app registrations via Azure Portal, Azure CLI, or Bicep IaC for web apps, SPAs, mobile apps, and daemon services. - OAuth 2.0 & MSAL Implementation: Implement authorization code, PKCE, client credentials, device code, and refresh token flows with complete C#, Python, and Node.js console app examples. - Permissions & Troubleshooting: Configure delegated and application permissions, grant admin consent, and diagnose common errors like redirect URI mismatches and invalid client secrets. - Use Case: You need a .NET console app that signs in users and calls Microsoft Graph. This Skill walks you through registering the app, adding User.Read permission, and provides a complete MSAL code sample. ## Quick Start Ask the assistant to register a new Microsoft Entra app for a single-page application with a localhost redirect URI and User.Read permission.

Frequently Asked Questions about entra-app-registration

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I create an app registration in Microsoft Entra ID?▼

Create an app registration via the Azure Portal under Microsoft Entra ID > App registrations > New registration, or run az ad app create with a display name and redirect URIs. You then receive an Application (client) ID and Tenant ID needed for authentication.

How to add Microsoft Graph API permissions to an app registration?▼

Add permissions in the Portal under API permissions, or use az ad app permission add with the Microsoft Graph resource ID and the permission ID. Use Scope for delegated permissions and Role for application permissions, then grant admin consent where required.

What is the difference between delegated and application permissions?▼

Delegated permissions let the app act on behalf of a signed-in user, while application permissions let the app act with its own identity for background services. Application permissions always require admin consent.

Should I use DefaultAzureCredential in production?▼

No, DefaultAzureCredential is recommended for local development only because its fallback chain is unpredictable. In production, use ManagedIdentityCredential for Azure-hosted apps or ClientCertificateCredential for on-premises workloads.

Why am I getting the AADSTS50011 redirect URI mismatch error?▼

This error occurs when the redirect URI in your request does not exactly match a registered URI, including case and trailing slashes. Verify the URI is registered under the correct platform type (Web, SPA, or Public client) in the Authentication section.

When should I use certificates instead of client secrets?▼

Use certificates instead of client secrets for production confidential clients because they are more secure and easier to rotate. Client secrets are acceptable for development but must be stored securely, such as in Azure Key Vault.

Related Skills

Explore More Software Engineering Skills→
kubiyabotkubiyabot
16

azure

Manage Azure resources via the native az CLI.

Official
Advanced
AradotsoAradotso
4

microsoft-agent365-devtools-cli

Orchestrate Azure provisioning, Entra ID consent, and Microsoft 365 packaging for Agent 365 applications.

Official
Advanced
tomztomz

azure-security

Provide Azure security hardening guidance for identity, access, secrets, and policy enforcement.

Community
Advanced
davidrrowleydavidrrowley

azure-identity-java

Authenticate Java applications with Azure services using standardized credential providers.

Community
Intermediate