Source: microsoft/azure-skills · Maintainer: Microsoft · License: MIT · Checked: 26 October 2026
What is the entra-app-registration skill?
The entra-app-registration skill teaches a coding agent how to register an application in Microsoft Entra ID (formerly Azure Active Directory), give it API permissions and credentials, and wire sign-in into code with MSAL. It is for developers who need an app to sign users in with Microsoft accounts or call Microsoft Graph and other protected APIs.
Its description reads: "Guides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration." The trigger list that follows includes "create app registration", "register Azure AD app", "add API permissions", "generate service principal" and "MSAL example".
The skill ships in microsoft/azure-skills, the Azure Skills Plugin. The README lists it under "Work across data, AI, identity, and platform services". The SKILL.md frontmatter lists version 1.2.1, author Microsoft and license MIT; the folder has no LICENSE file of its own, so the repo's MIT License applies.
As of 26 October 2026, its skills.sh page listed about 565,800 installs (snapshot, 26 October 2026).
What does it do?
The SKILL.md defines the key terms (client ID, tenant ID, client secret, redirect URI, service principal), four app types (web, single-page, mobile or native, daemon or service) and a five-step workflow.
1. Register the app. Portal steps, the CLI reference or a Bicep template. The skill calls IaC "highly recommended" if your project already uses it, if you manage many registrations, or if you need an audit history of changes. The template uses the Microsoft Graph Bicep extension and needs Bicep v0.21.1 or later.
2. Configure authentication for the app type: redirect URIs for web apps and SPAs, http://localhost or a custom scheme for mobile and desktop, and no redirect URI for a service using client credentials.
3. Add API permissions. It lists common Microsoft Graph permissions such as User.Read and Mail.Send, and a longer reference explains delegated versus application permissions, the .default scope and admin consent.
4. Create credentials for confidential clients: a client secret ("Copy the value immediately (only shown once)"), a certificate, which it recommends for production, or a federated identity credential.
5. Implement the OAuth flow using the flow reference and console app examples.
Three named patterns sit on top of that workflow:
| Pattern | What the agent asks you for | Reference |
|---|---|---|
| First-time app registration | Name, app type, redirect URIs, permissions | first-app-registration.md |
| Console app with user sign-in | Language, auth library (MSAL recommended), permissions | console-app-example.md |
| Service-to-service auth | Service name, target API, secret or certificate | Client credentials section of oauth-flows.md |
The reference folder is the bulk of the skill:
cli-commands.md:az ad app createfor web, SPA, public client and multi-tenant apps, the four sign-in audience values, secrets and certificates, permissions and admin consent, service principals, owners, and setup and cleanup scripts.oauth-flows.md: authorization code, authorization code with PKCE, client credentials, device code and refresh flows, plus token types and scopes.console-app-example.md: complete console apps in C#, Python and Node.js, with interactive and device code sign-in.troubleshooting.md: fixes for AADSTS errors, debugging tools and Entra sign-in logs.sdk/: short Azure Identity notes for Python, .NET, TypeScript, Java and Rust, plus Key Vault secrets notes and a .NET note on authentication events.
A security table near the end of the SKILL.md says: never hardcode secrets, rotate them, prefer certificates, request least-privilege permissions, require MFA, use managed identity for Azure-hosted apps, validate tokens, use HTTPS for every redirect URI except localhost, and watch Entra sign-in logs. Microsoft's quickstart for registering an app covers the same portal steps.
How do you install the entra-app-registration skill?
The repo README documents these routes.
Claude Code: the Azure Skills Plugin. Run inside Claude Code:
/plugin install azure@claude-plugins-official
Or run /plugin and search for "azure". See Claude Code plugins.
GitHub Copilot CLI:
/plugin marketplace add microsoft/azure-skills
/plugin install azure@azure-skills
Codex and Cursor. The README says to run codex plugin marketplace add microsoft/azure-skills, then install azure from /plugins; for Cursor, use the Cursor Marketplace or Settings, then Plugins. See Codex skills and Cursor skills.
Skill only. This skill relies on the Azure CLI and code, not on MCP tools, so copying just the folder works well:
npx skills add https://github.com/microsoft/azure-skills --skill entra-app-registration
Prerequisites: an Azure account, and the Azure CLI signed in with az login for the CLI route. Creating registrations and granting admin consent need the matching rights in your Entra tenant.
How do you use it?
Say what the app is and what it needs to reach. The skill is model-invoked, so the agent loads it when you mention app registration, OAuth setup, API permissions or MSAL.
Example prompts (suggestions, not quotes from the repo):
Register a single-tenant web app called billing-portal with redirect URI https://billing.example.com/signin-oidc.Set up client credentials so this nightly Python job can call Microsoft Graph. Use a certificate, not a secret.Write a Node.js console app that signs me in with device code and prints my Graph profile.Convert our app registration to Bicep so it lives in the infra folder.I'm getting AADSTS50011 when I sign in locally. What's wrong?
Expect it to ask for the app type, redirect URIs and permissions before it creates anything.
Tips and limits
From the repo, Microsoft Learn and skills.sh, not from testing:
- It changes your tenant.
az ad app create,az ad app credential resetand admin consent commands act on your directory. The CLI reference also includes a cleanup script that deletes every app matching a name pattern; read any such script before running it. - Skip implicit grant for SPAs. The SKILL.md says SPAs may "enable implicit grant flow if necessary." Microsoft's implicit grant page warns: "Microsoft recommends you do not use the implicit grant flow." The skill's own flow reference covers authorization code with PKCE, and the same Microsoft page recommends the authorization code flow for new single-page apps.
- A pointer goes nowhere. The description says to use "azure-keyvault-expiration-audit" for Key Vault secrets, but no skill by that name exists in the repo. That audit is a reference file inside the Azure compliance skill.
- Confirm Graph permission IDs. The reference tables list permission GUIDs; the permissions guide itself shows how to look them up in the portal, Graph Explorer or the CLI before you paste one into a command.
- Security audits. On skills.sh, Gen Agent Trust Hub (Safe), Socket and Snyk all rated it Pass on 15 September 2026.
The MIT License lets you copy and change the skill as long as you keep Microsoft's copyright and license notices.
Save it in your Kipt library
Identity setups tend to repeat inside a team: the same tenant, naming rules, approved permissions and certificate policy. An edited copy keeps those in the skill. In Kipt, open Skills and paste the skill's GitHub folder link into the import box, or drop the folder or a .zip; the references and Bicep file come with it. Skills in your private GitHub repo install into Claude Code or Codex with one command:
npx skills add https://github.com/<you>/<repo>.git --all -g
Kipt is not affiliated with Microsoft.
Similar skills
- OAuth skill: Matteo Collina's OAuth 2.0 and 2.1 guidance for Fastify apps, including PKCE and token checks.
- Better Auth skill: auth for TypeScript apps that run their own sign-in.
- Azure compliance skill: audits Key Vault secrets and certificates for expiry, including app credentials.
- Azure storage skill: the managed identity and RBAC patterns for reaching storage once an app has an identity.
- Firebase auth basics skill: Firebase's own skill for apps on Firebase Authentication.