how to create a client ID and Client Secret for MultiTenant App Registration

Question

how to create a client ID and Client Secret for MultiTenant App Registration

Answer 1

Hello @Tim Crumley

Thank you for reaching out to the Microsoft Q&A team,

creating a multi-tenant app registration and generating the associated Client ID and Client Secret is a straightforward process. Please follow the steps below:

1. Sign into the Azure portal and go to Microsoft Entra ID > App registrations.
2. Click New registration.
   • Give your app a name (Enter a meaningful Name)
   • Under Supported account types, pick Accounts in any organizational directory (Any Azure AD directory – Multitenant).
   • (Optionally) add a Redirect URI if you need one.
   • Hit Register.
3. On the app’s Overview page, copy down the Application (client) ID and Directory (tenant) ID.
4. In the left menu, choose Certificates & secrets.
5. Click New client secret.
   • Enter a description (e.g. “MyApp Secret”).
   • Pick an expiry (max 24 months).
   • Click Add, then immediately copy the secret Value somewhere safe-this value won’t show again after you leave the page.
   For a best practice Microsoft recommends using certificates or managed identities instead of client secrets for production workloads whenever possible, as they provide a more secure authentication mechanism.

References:

• Tutorial: Register an app with Microsoft Entra ID
• Create an app to access Microsoft Defender for Endpoint without a user
• Create a secure partner application
• Use client secrets with Microsoft.Identity.Web

Thanks

Venkat.M

Answer 2

For a multitenant app registration in Microsoft Entra ID, create the app registration first, then add a client secret.

1. Sign in to the Azure portal or Microsoft Entra admin center.
2. Go to Microsoft Entra ID / Identity > Applications > App registrations.
3. Select New registration.
4. Enter a name for the application.
5. For Supported account types, select Accounts in any organizational directory to make it multitenant.
6. If required for the app flow, add a Web platform and configure the Redirect URI.
   • For some multitenant web app scenarios, the redirect URI must point to a live web app endpoint.
   • In the Defender for Endpoint multitenant example, https://portal.azure.com is added as a redirect URI.
7. Select Register.
8. After the app is created, copy the Application (client) ID from the app overview page.
9. To create the client secret, open Certificates & secrets > Client secrets > New client secret.
10. Enter a description, choose an expiration, and select Add.
11. Immediately copy the secret value and store it securely. It is shown only once and cannot be retrieved later.

If the app must be used across multiple customer tenants, each tenant must grant consent to the app. In the Defender for Endpoint multitenant scenario, approval is required in each tenant where the app will run.

---

• Tutorial: Register an app with Microsoft Entra ID
• Create an app to access Microsoft Defender for Endpoint without a user
• Create a secure partner application
• Use client secrets with Microsoft.Identity.Web