$ ~/registry/skill/microsoft-plugin-skills-entra-app-registration

SKILL

entra-app-registration

Name: entra-app-registration
Author: microsoft

Set up Entra ID app registration, OAuth, permissions, and MSAL integration.

Stars

★ 232

Source

GitHub

Updated

2026-07-13

// securityLow risk

Prompt only, no code
Open source

Summary

This skill appears to be prompt-style open-source guidance for Microsoft Entra app registration and OAuth configuration, with no declared secrets, remote endpoints, or local execution capabilities, so overall risk is low. Star count, maintenance visibility, and missing license details slightly limit confidence, but the source points to a Microsoft GitHub repository and no concrete red flags are evident.

CredentialsLow risk

The materials state that the skill itself requires no keys or environment variables. The README only discusses concepts such as client secrets and tenant IDs as part of Entra app registration, rather than indicating that the skill itself collects or stores credentials.

Network egressLow risk

No remote endpoints or outbound data flows are declared. Combined with the 'prompt-only' classification, this appears to be a local prompt/documentation-style skill rather than a tool that sends user data to third-party services.

Code executionLow risk

There is no indication of spawning local processes, running scripts, invoking system commands, or automatically modifying cloud resources. The content is mainly procedural guidance and references, not an actual code-executing capability.

Data accessLow risk

The materials do not show that the skill can read local files, access account data, write configuration, or directly operate on an Azure tenant. Its role appears limited to providing Entra/OAuth configuration guidance, with no significant data access surface exposed.

Supply chainLow risk

The source is a GitHub repository associated with Microsoft and is open source, which materially lowers supply-chain risk through auditability. However, the missing license, low star count, and unknown maintenance status warrant a quick validation of repository activity and release practices before production use.

Recommendations

Treat it as guidance content and do not automatically create high-privilege app registrations or grant sensitive Graph permissions solely based on the skill text.
If you create client secrets or certificates following its guidance, store them in a secure system such as Key Vault and avoid plaintext exposure in chats, repos, or config files.
Before adopting repository content, verify recent commits, release history, issue handling, and whether it is indeed officially maintained by Microsoft.
Apply least privilege when reviewing API permissions, especially for sensitive scopes such as Directory.Read.All and User.ReadWrite.All.

Audited by: gpt-5.4 · 2026-06-16

// install

Copy the install command and let the AI configure it · recommended for beginners

Please install the "entra-app-registration" skill from askskill:
1. Download https://raw.githubusercontent.com/microsoft/GitHub-Copilot-for-Azure/main/plugin/skills/entra-app-registration/SKILL.md
2. Save it as ~/.claude/skills/entra-app-registration/SKILL.md
3. Reload skills and tell me it's ready

// download

Download SKILL.mdInstall manifest ↗

// examples

Create an app registration

Prompt

Guide me through creating a new app registration in Microsoft Entra ID for an internal web app sign-in. Explain the redirect URI, supported account types, and which key details I should save after creation.

Expected

A step-by-step app registration workflow with configuration notes and the client and tenant details to save.

Configure API permissions and consent

Prompt

I need my app to call Microsoft Graph to read basic user profile information. Tell me which API permissions to add, explain delegated vs application permissions, and how admin consent should be handled.

Expected

Clear permission setup guidance covering permission types, recommended scopes, and admin consent instructions.

Generate an MSAL console example

Prompt

Give me a C# console app example using MSAL to sign in a user and acquire an access token for Microsoft Graph. Include required packages, key configuration values, and the sample code structure.

Expected

A usable MSAL console sample plan with dependencies, configuration guidance, and the main code structure.

// docs

Overview

Microsoft Entra ID (formerly Azure Active Directory) is Microsoft's cloud-based identity and access management service. App registrations allow applications to authenticate users and access Azure resources securely.

Key Concepts

Concept	Description
App Registration	Configuration that allows an app to use Microsoft identity platform
Application (Client) ID	Unique identifier for your application
Tenant ID	Unique identifier for your Azure AD tenant/directory
Client Secret	Password for the application (confidential clients only)
Redirect URI	URL where authentication responses are sent
API Permissions	Access scopes your app requests
Service Principal	Identity created in your tenant when you register an app

Application Types

Type	Use Case
Web Application	Server-side apps, APIs
Single Page App (SPA)	JavaScript/React/Angular apps
Mobile/Native App	Desktop, mobile apps
Daemon/Service	Background services, APIs

Core Workflow

Step 1: Register the Application

Create an app registration in the Azure portal or using Azure CLI.

Portal Method:

Navigate to Azure Portal → Microsoft Entra ID → App registrations
Click "New registration"
Provide name, supported account types, and redirect URI
Click "Register"

CLI Method: See references/cli-commands.md IaC Method: See references/BICEP-EXAMPLE.bicep

It's highly recommended to use the IaC to manage Entra app registration if you already use IaC in your project, need a scalable solution for managing lots of app registrations or need fine-grained audit history of the configuration changes.

Step 2: Configure Authentication

Set up authentication settings based on your application type.

Web Apps: Add redirect URIs, enable ID tokens if needed
SPAs: Add redirect URIs, enable implicit grant flow if necessary
Mobile/Desktop: Use http://localhost or custom URI scheme
Services: No redirect URI needed for client credentials flow

Step 3: Configure API Permissions

Grant your application permission to access Microsoft APIs or your own APIs.

Common Microsoft Graph Permissions:

User.Read - Read user profile
User.ReadWrite.All - Read and write all users
Directory.Read.All - Read directory data
Mail.Send - Send mail as a user

Details: See references/api-permissions.md

Step 4: Create Client Credentials (if needed)

For confidential client applications (web apps, services), create a client secret, certificate or federated identity credential.

Client Secret:

Navigate to "Certificates & secrets"
Create new client secret
Copy the value immediately (only shown once)
Store securely (Key Vault recommended)

Certificate: For production environments, use certificates instead of secrets for enhanced security. Upload certificate via "Certificates & secrets" section.

Federated Identity Credential: For dynamically authenticating the confidential client to Entra platform.