jonathan-vella/apex/apex-entra-app-registration

Entra App Registration

Microsoft Entra ID (formerly Azure AD) is Microsoft's cloud identity and access-management service. This skill guides app registration, OAuth 2.0 flows, and MSAL integration.

For key concepts, application types, and the 3 common patterns (first-time registration, console app with user auth, service-to-service), read `references/common-patterns.md`.

Rules

• Prefer IaC for managing app registrations when the project uses IaC, scales to many apps, or needs audit history (see `references/BICEP-EXAMPLE.bicep`)
• Prefer certificates or federated identity credentials over client secrets in production
• Protect credential handoff — follow the

additive credential procedure; never expose values to chat, tool output or logs

• Bind identity and approval — use the

identity and permission boundary before authentication, creation, rotation or consent; instructions are not write authorization

• Grant least-privilege API permissions — only the scopes the app actually uses
• CLI for ad-hoc, IaC for production — see `references/cli-commands.md`
• Out of scope: Azure RBAC (apex-azure-rbac), Key Vault audits (apex-azure-compliance), resource security scanning (apex-azure-compliance)

Core Workflow

Five-step procedure (full per-step detail in `references/core-workflow.md`):

1. Register the Application — portal, CLI (`cli-commands.md`), or IaC (`BICEP-EXAMPLE.bicep`)
2. Configure Authentication — redirect URIs / token settings per app type
3. Configure API Permissions — Graph and custom-API scopes (`api-permissions.md`)
4. Create Client Credentials — secret / certificate / federated identity (Key Vault)
5. Implement OAuth Flow — code integration (`oauth-flows.md`, `console-app-example.md`)

Microsoft Authentication Library (MSAL)

Recommended library for integrating with the Microsoft identity platform:

• .NET / C# — Microsoft.Identity.Client
• JavaScript / TypeScript — @azure/msal-browser, @azure/msal-node
• Python — msal

Examples: `references/console-app-example.md`. SDK quick references in references/sdk/: Azure Identity for Rust and the Functions authentication-events extension for .NET. Azure Identity for other languages lives in apex-azure-deploy/references/sdk/.

Security Best Practices

Never hardcode secrets · rotate regularly · prefer certificates over secrets in production · least-privilege API permissions · enable MFA · use managed identity for Azure-hosted apps · validate tokens (issuer / audience / expiration) · HTTPS-only redirect URIs (per the canonical security baseline) · monitor sign-ins via Entra ID logs.

Full details in `references/auth-best-practices.md`.

Reference Index