entra-app-registration Skill for Claude: Register Apps in Microsoft Entra ID

Guides Claude through registering an app in Microsoft Entra ID, setting permissions and adding sign-in with MSAL.

Installs: 572.7K; on skills.sh
Stars: 1.6K; on GitHub
Files: 16; besides SKILL.md
Updated: Oct 2026; last repo commit

entra-app-registration walks Claude through the whole Microsoft Entra ID app registration job. That means registering the app, setting authentication, picking Microsoft Graph permissions, creating credentials and writing the OAuth 2.0 code with MSAL. It works through the portal, the Azure CLI or Bicep.

It covers three patterns: a first app registration, a console app with user sign-in, and service-to-service sign-in with client credentials. Some steps create secrets and grant API permissions, so read each command before you approve it.

Good for

Developers adding Microsoft sign-in to a web, SPA, mobile or service app
Teams setting up service-to-service auth with secrets or certificates
Beginners doing their first app registration

Install entra-app-registration

Claude Code

Copy this prompt.

Install the entra-app-registration skill in Claude Code. Run this command:

/plugin install azure@claude-plugins-official

Then check that it loaded and tell me how to use it.

2
Paste it into Claude Code. It shows the change and asks before running it.

Requires Azure CLI signed in.

Pick one route, not both. The plugin installs all the Azure skills and wires in the Azure and Foundry tool servers they call. The skills CLI route installs only the skills named in the command, and does not wire in the Azure or Foundry tool servers, so enable the Azure MCP server separately if you want the tools the skills call. Sign in with az login first.

From the project README. Source.

What's in the skill

When it loads

Guides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration. USE FOR: create app registration, register Azure AD app, configure OAuth, set up authentication, add API permissions, generate service principal, MSAL example, console app auth, Entra ID setup, Azure AD authentication. DO NOT USE FOR: Key Vault secrets (use azure-keyvault-expiration-audit), general Azure resource security guidance.

Sections in SKILL.md

Overview
Key Concepts
Application Types
Core Workflow
Step 1: Register the Application
Step 2: Configure Authentication
Step 3: Configure API Permissions
Step 4: Create Client Credentials (if needed)
Step 5: Implement OAuth Flow
Common Patterns
Pattern 1: First-Time App Registration
Pattern 2: Console Application with User Authentication
Pattern 3: Service-to-Service Authentication
MCP Tools and CLI
Azure CLI Commands
Microsoft Authentication Library (MSAL)

Key facts

Author: Microsoft
License: MIT (stated in SKILL.md)
GitHub stars: 1,609 for the whole microsoft/azure-skills repo (Nov 2, 2026)
Last commit: Oct 30, 2026
What installs: SKILL.md plus 16 bundled files (guides and examples); no scripts in the file list
Needs: Azure CLI for the az ad commands it lists, or the Azure portal
Part of: The azure plugin in microsoft/azure-skills
skills.sh audits: Gen Agent Trust Hub pass, Socket pass, Snyk pass
Works in: GitHub Copilot, Claude Code, Cursor, Codex, Gemini CLI, OpenCode (plugin README)

What it includes

Portal, Azure CLI or Bicep registration
Uses az ad app create or the portal. The skill recommends Bicep if you already use infrastructure as code.
Write · Step 1: Register the application
Redirect URIs and settings by app type
Web apps, SPAs, mobile and desktop apps, and services each get different settings.
Write · Step 2: Configure authentication
Adds Microsoft Graph and API permissions
Uses az ad app permission add, with examples like User.Read and Mail.Send.
Write · Step 3: API permissions
Creates a client secret, certificate or federated credential
Uses az ad app credential reset for secrets. The value is shown once.
Write · Step 4: Credentials
Writes MSAL sign-in code for .NET, JavaScript or Python
Reference guides cover OAuth flows and a console app example.
Write · Step 5: OAuth flow
Certificates over secrets, least privilege, managed identity
A table of recommended practices, including never hardcoding secrets.
Security best practices

From the official docs

Permissions

High risk

Claude can create client secrets and grant API permissions in your Entra tenant. Try it in a test tenant and read each az ad command before you approve it.

What it can do

Read your data
Create and change things
Delete things
Read-only mode

Watch out for

It can create secrets and grant API permissions
The skill runs az ad commands that add credentials and permissions to your tenant. Review each command and use a test tenant first.
Secret values appear once
A new client secret is shown a single time. Store it in Key Vault, not in chat or code.
It writes sign-in code into your project
The OAuth examples add MSAL code. Review it before you commit.

Technical details

Scopes	Creates and edits Entra app registrations Grants API permissions to an app Creates client secrets and credentials

Questions

What does entra-app-registration do?

It guides Claude through registering an app in Microsoft Entra ID, configuring permissions and credentials, and writing OAuth 2.0 sign-in code with MSAL.

How do I install it?

Use the install box at the top of this page. In Claude Code the plugin command installs the Azure skills together with the Azure tools they call, so pick it unless you want this one skill only. Run az login before you start.

Can it create secrets in my tenant?

Yes. It can run az ad app credential reset to create a client secret and az ad app permission add to add API permissions. Approve those commands one by one.

Is it safe?

It makes real identity changes, so treat it as high risk and try it in a test tenant first. skills.sh lists Gen Agent Trust Hub, Socket and Snyk as pass.

Which languages does it cover?

Its MSAL notes cover .NET (Microsoft.Identity.Client), JavaScript and TypeScript (@azure/msal-browser, @azure/msal-node) and Python (msal).

Should I use a secret or a certificate?

The SKILL.md recommends certificates over secrets for production, and managed identity for Azure-hosted apps.

Does it work in the Claude app, Codex or Cursor?

The Azure README lists GitHub Copilot, Claude Code, Cursor, Codex, Gemini CLI and OpenCode as hosts for the plugin. It does not list the Claude desktop or web app.

Information

updated Nov 2, 2026

Repository: microsoft/azure-skills
Folder: skills/entra-app-registration

microsoft/azure-skills skills.sh

Sources

Docs, issue trackers and discussions this page is built from.

Show all 3

microsoft/azure-skills README · github.com
entra-app-registration SKILL.md · github.com
entra-app-registration on skills.sh · skills.sh