Setting the file. One moment.
Chapter 31 · Entra App Registration
Subchapter 31.6
references/first-app-registration.mdMarkdown7 KBView on GitHub
This guide walks you through creating your first Microsoft Entra app registration from scratch.
You’ll learn how to:
You’ll see a form with several fields:
Choose who can use your application:
| Option | When to Use |
|---|---|
| Accounts in this organizational directory only (Single tenant) | Only users from the same tenant of this app registration need access |
| Accounts in any organizational directory (Multi-tenant) | Users from multiple organization tenants need access |
| Accounts in any organizational directory + Personal Microsoft accounts | Users from multiple organization tenants and MSA users need access |
| Personal Microsoft accounts only | Only MSA users need access |
Note: Once selected, users whose account type is not allowed will get errors when trying to get access token for the app registration.
The redirect URI is where authentication responses are sent.
Platform: Select the type:
URI examples:
https://localhost:5001/signin-oidchttp://localhost:3000http://localhostFor your first app: Select “Public client/native” and enter http://localhost
After clicking, you’ll be redirected to your app’s overview page.
On the Overview page, you’ll see critical information. Copy and save these values:
xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx (GUID)xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx (GUID)# Save these in a secure location
APPLICATION_CLIENT_ID="12345678-1234-1234-1234-123456789012"
TENANT_ID="87654321-4321-4321-4321-210987654321"Click “Authentication” in the left menu.
Allow public client flows:
You can change this later if needed.
Where to redirect users after logout.
Click “Save” at the top if you made changes.
Click “API permissions” in the left menu.
You’ll see one default permission:
This allows your app to read the signed-in user’s profile.
Click “+ Add a permission”
Select “Microsoft Graph”
Choose “Delegated permissions” (for user context)
Search for and select permissions you need:
Click “Add permissions”
Some permissions require admin consent:
Status indicator:
Skip this if: You’re building a desktop/mobile/console app (public client)
Do this if: You’re building a web app, API, or service (confidential client)
⚠️ CRITICAL: Copy the secret Value immediately!
# Save this securely (example)
CLIENT_SECRET="abc123~defGHI456jklMNO789pqrSTU"Security tips:
# Set your values
CLIENT_ID="your-client-id-here"
TENANT_ID="your-tenant-id-here"
# Interactive login
az login --scope "https://graph.microsoft.com/.default"
# Get an access token
az account get-access-token --resource "https://graph.microsoft.com"See the complete code example in console-app-example.md
Success:
Common first-time issues:
Tip: Once you get the access token, you can use jwt.ms (opens in a new tab) to decode it and inspect its claims.
Solution:
Solution: