entra-app-registration-c85f9c — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited entra-app-registration-c85f9c (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Microsoft Entra ID (formerly Azure Active Directory) is Microsoft's cloud-based identity and access management service. App registrations allow applications to authenticate users and access Azure resources securely.
| Concept | Description |
|---|---|
| App Registration | Configuration that allows an app to use Microsoft identity platform |
| Application (Client) ID | Unique identifier for your application |
| Tenant ID | Unique identifier for your Azure AD tenant/directory |
| Client Secret | Password for the application (confidential clients only) |
| Redirect URI | URL where authentication responses are sent |
| API Permissions | Access scopes your app requests |
| Service Principal | Identity created in your tenant when you register an app |
| Type | Use Case |
|---|---|
| Web Application | Server-side apps, APIs |
| Single Page App (SPA) | JavaScript/React/Angular apps |
| Mobile/Native App | Desktop, mobile apps |
| Daemon/Service | Background services, APIs |
Create an app registration in the Azure portal or using Azure CLI.
Portal Method:
CLI Method: See references/cli-commands.md IaC Method: See references/BICEP-EXAMPLE.bicep
It's highly recommended to use the IaC to manage Entra app registration if you already use IaC in your project, need a scalable solution for managing lots of app registrations or need fine-grained audit history of the configuration changes.
Set up authentication settings based on your application type.
http://localhost or custom URI schemeGrant your application permission to access Microsoft APIs or your own APIs.
Common Microsoft Graph Permissions:
User.Read - Read user profileUser.ReadWrite.All - Read and write all usersDirectory.Read.All - Read directory dataMail.Send - Send mail as a userDetails: See references/api-permissions.md
For confidential client applications (web apps, services), create a client secret, certificate or federated identity credential.
Client Secret:
Certificate: For production environments, use certificates instead of secrets for enhanced security. Upload certificate via "Certificates & secrets" section.
Federated Identity Credential: For dynamically authenticating the confidential client to Entra platform.
Integrate the OAuth flow into your application code.
See:
Walk user through their first app registration step-by-step.
Required Information:
Script: See references/first-app-registration.md
Create a .NET/Python/Node.js console app that authenticates users.
Required Information:
Example: See references/console-app-example.md
Set up daemon/service authentication without user interaction.
Required Information:
Implementation: Use Client Credentials flow (see references/oauth-flows.md#client-credentials-flow)
| Command | Purpose |
|---|---|
az ad app create | Create new app registration |
az ad app list | List app registrations |
az ad app show | Show app details |
az ad app permission add | Add API permission |
az ad app credential reset | Generate new client secret |
az ad sp create | Create service principal |
Complete reference: See references/cli-commands.md
MSAL is the recommended library for integrating Microsoft identity platform.
Supported Languages:
Microsoft.Identity.Client@azure/msal-browser, @azure/msal-nodemsalExamples: See references/console-app-example.md
| Practice | Recommendation |
|---|---|
| Never hardcode secrets | Use environment variables, Azure Key Vault, or managed identity |
| Rotate secrets regularly | Set expiration, automate rotation |
| Use certificates over secrets | More secure for production |
| Least privilege permissions | Request only required API permissions |
| Enable MFA | Require multi-factor authentication for users |
| Use managed identity | For Azure-hosted apps, avoid secrets entirely |
| Validate tokens | Always validate issuer, audience, expiration |
| Use HTTPS only | All redirect URIs must use HTTPS (except localhost) |
| Monitor sign-ins | Use Entra ID sign-in logs for anomaly detection |
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.