Quickstart: Register an application in Microsoft Entra ID
Article
In this quickstart, you learn how to register an application in Microsoft Entra ID. This process is essential for establishing a trust relationship between your application and the Microsoft identity platform. By completing this quickstart, you enable identity and access management (IAM) for your app, allowing it to securely interact with Microsoft services and APIs.
A workforce or external tenant. You can use your Default Directory for this quickstart. If you need an external tenant, complete set up an external tenant.
Register an application
Registering your application in Microsoft Entra establishes a trust relationship between your app and the Microsoft identity platform. The trust is unidirectional. Your app trusts the Microsoft identity platform, and not the other way around. Once created, the application object can't be moved between different tenants.
Follow these steps to create the app registration:
If you have access to multiple tenants, use the Settings icon
in the top menu to switch to the tenant in which you want to register the application.
Browse to Identity > Applications > App registrations and select New registration.
Enter a meaningful Name for your, for example identity-client-app. App users can see this name, and it can be changed at any time. You can have multiple app registrations with the same name.
Under Supported account types, specify who can use the application. We recommend you select Accounts in this organizational directory only for most applications. Refer to the table below for more information on each option.
Supported account types
Description
Accounts in this organizational directory only
For single-tenant apps for use only by users (or guests) in your tenant.
Accounts in any organizational directory
For multitenant apps and you want users in any Microsoft Entra tenant to be able to use your application. Ideal for software-as-a-service (SaaS) applications that you intend to provide to multiple organizations.
Accounts in any organizational directory and personal Microsoft accounts
For multitenant apps that support both organizational and personal Microsoft accounts (for example, Skype, Xbox, Live, Hotmail).
Personal Microsoft accounts
For apps used only by personal Microsoft accounts (for example, Skype, Xbox, Live, Hotmail).
Select Register to complete the app registration.
The application's Overview page is displayed. Record the Application (client) ID, which uniquely identifies your application and is used in your application's code as part of validating the security tokens it receives from the Microsoft identity platform.
Important
New app registrations are hidden to users by default. When you're ready for users to see the app on their My Apps page you can enable it. To enable the app, in the Microsoft Entra admin center navigate to Identity > Applications > Enterprise applications and select the app. Then on the Properties page, set Visible to users? to Yes.
Grant admin consent (external tenants only)
Once you register your application, it gets assigned the User.Read permission. However, for external tenants, the customer users themselves can't consent to this permission. You as the admin must consent to this permission on behalf of all the users in the tenant:
From the Overview page of your app registration, under Manage select API permissions.
Select Grant admin consent for < tenant name >, then select Yes.
Select Refresh, then verify that Granted for < tenant name > appears under Status for the permission.
Add a redirect URI
A redirect URI is where the Microsoft identity platform sends security tokens after authentication. You can configure redirect URIs in Platform configurations in the Microsoft Entra admin center. For Web and Single-page applications, you need to specify a redirect URI manually. For Mobile and desktop platforms, you select from generated redirect URIs. Follow these steps to configure settings based on your target platform or device:
In the Microsoft Entra admin center, in App registrations, select your application.
Under Manage, select Authentication.
Under Platform configurations, select Add a platform.
Under Configure platforms, select the tile for your application type (platform) to configure its settings.
Platform
Configuration settings
Example
Web
Enter the Redirect URI for a web app that runs on a server. Front channel logout URLs can also be added
Enter the app Package name, which generates a redirect URI for you. Find it in the AndroidManifest.xml file. Also generate and enter the Signature hash.
Select this platform for desktop apps or mobile apps not using MSAL or a broker. Select a suggested Redirect URI, or specify one or more Custom redirect URIs
After registering an app, you can add certificates, client secrets (a string), or federated identity credentials as credentials to your confidential client app registration. Credentials allow your application to authenticate as itself, requiring no interaction from a user at runtime, and are used by confidential client applications that access a web API.
Sometimes called an application password, a client secret is a string value your app can use in place of a certificate to identify itself.
Client secrets are less secure than certificate or federated credentials and therefore should not be used in production environments. While they may be convenient for local app development, it is imperative to use certificate or federated credentials for any applications running in production to ensure higher security.
In the Microsoft Entra admin center, in App registrations, select your application.
If you're using an Azure DevOps service connection that automatically creates a service principal, you need to update the client secret from the Azure DevOps portal site instead of directly updating the client secret. Refer to this document on how to update the client secret from the Azure DevOps portal site:
Troubleshoot Azure Resource Manager service connections.
Federated identity credentials are a type of credential that allows workloads, such as GitHub Actions, workloads running on Kubernetes, or workloads running in compute platforms outside of Azure access Microsoft Entra protected resources without needing to manage secrets using workload identity federation.
To add a federated credential, follow these steps:
In the Microsoft Entra admin center, in App registrations, select your application.
In the Federated credential scenario drop-down box, select one of the supported scenarios, and follow the corresponding guidance to complete the configuration.
Customer managed keys for encrypt data in your tenant using Azure Key Vault in another tenant.
GitHub actions deploying Azure resources to configure a GitHub workflow to get tokens for your application and deploy assets to Azure.
Kubernetes accessing Azure resources to configure a Kubernetes service account to get tokens for your application and access Azure resources.
Other issuer to configure the application to trust a managed identity or an identity managed by an external OpenID Connect provider to get tokens for your application and access Azure resources.
The Microsoft identity platform offers a variety of code samples tailored for different application types and platforms. To explore these samples, refer to;
In this module, we explore the process of creating an app registration in Microsoft Entra ID. Then explore the settings and configuration options. You create a single page app, register multitenant app, and other options. As part of this process, we dig into granting user access to apps and configure how and when they can use the app and its data.