Apex Entra App Registration
jonathan-vella/apex
WORKFLOW SKILL — Guides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration.
Guides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration.
$ npx skills add microsoft/GitHub-Copilot-for-Azure --skill entra-app-registration -a claude-codeProject install by default; add -g for ~/.claude/skills/.
$ gh skill install microsoft/GitHub-Copilot-for-Azure entra-app-registration --agent claude-codeProject scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).
$ git clone --depth 1 https://github.com/microsoft/GitHub-Copilot-for-Azure.git skills-src && mkdir -p .claude/skills && cp -r skills-src/plugins/azure-skills/skills/entra-app-registration .claude/skills/entra-app-registration && rm -rf skills-srcUse ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.
Claude Code skills documentation · loads skills from .claude/skills/
Install the "entra-app-registration" agent skill from https://github.com/microsoft/GitHub-Copilot-for-Azure/tree/main/plugins/azure-skills/skills/entra-app-registration into .claude/skills/entra-app-registration/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "entra-app-registration", then confirm the skill loads.Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$skill-installer install https://github.com/microsoft/GitHub-Copilot-for-Azure/tree/main/plugins/azure-skills/skills/entra-app-registrationType this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.
$ npx skills add microsoft/GitHub-Copilot-for-Azure --skill entra-app-registration -a codexProject install goes to .agents/skills/; add -g for ~/.codex/skills/.
$ gh skill install microsoft/GitHub-Copilot-for-Azure entra-app-registration --agent codexProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/microsoft/GitHub-Copilot-for-Azure.git skills-src && mkdir -p .agents/skills && cp -r skills-src/plugins/azure-skills/skills/entra-app-registration .agents/skills/entra-app-registration && rm -rf skills-srcUse ~/.agents/skills/ instead of .agents/skills for a personal install.
Codex skills documentation · loads skills from .agents/skills/
Install the "entra-app-registration" agent skill from https://github.com/microsoft/GitHub-Copilot-for-Azure/tree/main/plugins/azure-skills/skills/entra-app-registration into .agents/skills/entra-app-registration/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "entra-app-registration", then confirm the skill loads.Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add microsoft/GitHub-Copilot-for-Azure --skill entra-app-registration -a cursorProject install goes to .agents/skills/; add -g for ~/.cursor/skills/.
$ gh skill install microsoft/GitHub-Copilot-for-Azure entra-app-registration --agent cursorProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/microsoft/GitHub-Copilot-for-Azure.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/plugins/azure-skills/skills/entra-app-registration .cursor/skills/entra-app-registration && rm -rf skills-srcUse ~/.cursor/skills/ instead of .cursor/skills for a personal install.
Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/
Install the "entra-app-registration" agent skill from https://github.com/microsoft/GitHub-Copilot-for-Azure/tree/main/plugins/azure-skills/skills/entra-app-registration into .cursor/skills/entra-app-registration/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "entra-app-registration", then confirm the skill loads.Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gemini skills install https://github.com/microsoft/GitHub-Copilot-for-Azure.git --path plugins/azure-skills/skills/entra-app-registration--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.
$ npx skills add microsoft/GitHub-Copilot-for-Azure --skill entra-app-registration -a gemini-cliProject install goes to .agents/skills/; add -g for ~/.gemini/skills/.
$ gh skill install microsoft/GitHub-Copilot-for-Azure entra-app-registration --agent gemini-cliProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/microsoft/GitHub-Copilot-for-Azure.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/plugins/azure-skills/skills/entra-app-registration .gemini/skills/entra-app-registration && rm -rf skills-srcUse ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.
Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/
Install the "entra-app-registration" agent skill from https://github.com/microsoft/GitHub-Copilot-for-Azure/tree/main/plugins/azure-skills/skills/entra-app-registration into .gemini/skills/entra-app-registration/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "entra-app-registration", then confirm the skill loads.Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gh skill install microsoft/GitHub-Copilot-for-Azure entra-app-registrationInstalls for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).
$ npx skills add microsoft/GitHub-Copilot-for-Azure --skill entra-app-registration -a github-copilotProject install goes to .agents/skills/; add -g for ~/.copilot/skills/.
$ git clone --depth 1 https://github.com/microsoft/GitHub-Copilot-for-Azure.git skills-src && mkdir -p .github/skills && cp -r skills-src/plugins/azure-skills/skills/entra-app-registration .github/skills/entra-app-registration && rm -rf skills-srcUse ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.
GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/
Install the "entra-app-registration" agent skill from https://github.com/microsoft/GitHub-Copilot-for-Azure/tree/main/plugins/azure-skills/skills/entra-app-registration into .github/skills/entra-app-registration/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "entra-app-registration", then confirm the skill loads.GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add microsoft/GitHub-Copilot-for-Azure --skill entra-app-registration -a opencodeOpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.
$ gh skill install microsoft/GitHub-Copilot-for-Azure entra-app-registration --agent opencodeProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/microsoft/GitHub-Copilot-for-Azure.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/plugins/azure-skills/skills/entra-app-registration .opencode/skills/entra-app-registration && rm -rf skills-srcUse ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.
OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/
Install the "entra-app-registration" agent skill from https://github.com/microsoft/GitHub-Copilot-for-Azure/tree/main/plugins/azure-skills/skills/entra-app-registration into .opencode/skills/entra-app-registration/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "entra-app-registration", then confirm the skill loads.OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
entra-app-registrationGuides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration.
Entra App Registration is an agent skill from microsoft/GitHub-Copilot-for-Azure, published by the product's own GitHub organization. Guides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration. USE FOR: create app registration, register Azure AD app, configure OAuth, set up authentication, add API permissions, generate service principal, MSAL example, console app auth, Entra ID setup, Azure AD authentication. DO NOT USE FOR: Key Vault secrets (use azure-keyvault-expiration-audit), general Azure resource security guidance.
Its SKILL.md is about 2.1k tokens, which your agent loads only when the skill is triggered. The skill folder holds 19 other files, including reference files (for example `references/api-permissions.md`, `references/auth-best-practices.md` and `references/cli-commands.md`).
It sits in Backend & APIs, covering Authentication, OAuth and OpenID Connect and Secrets management. It works with Microsoft Entra ID, Microsoft Azure, Azure Key Vault and Bicep. The repository describes itself as: GitHub Copilot for Azure. The licence is MIT.
5 steps, taken from the step headings in SKILL.md.
Read from SKILL.md and the folder at commit ce94fce. It shows what the files ask for, not the result of running them.
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Shell commands in SKILL.md call:
azFrom the folder's file list and the shell code blocks in SKILL.md.
Links to these hosts (documentation or services it may open):
learn.microsoft.comFrom URLs in SKILL.md, links to its own repository left out.
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.
Entra App Registration loads about 2.1k tokens when it runs, and up to ~21k if it reads all its reference files. Until then it costs about 112 tokens; SKILL.md has 747 words of instructions outside code blocks.
Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.
The automated check found no risky patterns in SKILL.md.
Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.
The full file from microsoft/GitHub-Copilot-for-Azure at commit ce94fce, republished under its MIT licence (© microsoft). 747 words, ~2,058 tokens.
.claude/skills/entra-app-registration/SKILL.md (or your agent's skills folder). This skill also uses 17 other files; get the full folder from GitHub.Microsoft Entra ID (formerly Azure Active Directory) is Microsoft's cloud-based identity and access management service. App registrations allow applications to authenticate users and access Azure resources securely.
| Concept | Description |
|---|---|
| App Registration | Configuration that allows an app to use Microsoft identity platform |
| Application (Client) ID | Unique identifier for your application |
| Tenant ID | Unique identifier for your Azure AD tenant/directory |
| Client Secret | Password for the application (confidential clients only) |
| Redirect URI | URL where authentication responses are sent |
| API Permissions | Access scopes your app requests |
| Service Principal | Identity created in your tenant when you register an app |
| Type | Use Case |
|---|---|
| Web Application | Server-side apps, APIs |
| Single Page App (SPA) | JavaScript/React/Angular apps |
| Mobile/Native App | Desktop, mobile apps |
| Daemon/Service | Background services, APIs |
Create an app registration in the Azure portal or using Azure CLI.
Portal Method:
CLI Method: See references/cli-commands.md IaC Method: See references/BICEP-EXAMPLE.bicep
It's highly recommended to use the IaC to manage Entra app registration if you already use IaC in your project, need a scalable solution for managing lots of app registrations or need fine-grained audit history of the configuration changes.
Set up authentication settings based on your application type.
http://localhost or custom URI schemeGrant your application permission to access Microsoft APIs or your own APIs.
Common Microsoft Graph Permissions:
User.Read - Read user profileUser.ReadWrite.All - Read and write all usersDirectory.Read.All - Read directory dataMail.Send - Send mail as a userDetails: See references/api-permissions.md
For confidential client applications (web apps, services), create a client secret, certificate or federated identity credential.
Client Secret:
Certificate: For production environments, use certificates instead of secrets for enhanced security. Upload certificate via "Certificates & secrets" section.
Federated Identity Credential: For dynamically authenticating the confidential client to Entra platform.
Integrate the OAuth flow into your application code.
See:
Walk user through their first app registration step-by-step.
Required Information:
Script: See references/first-app-registration.md
Create a .NET/Python/Node.js console app that authenticates users.
Required Information:
Example: See references/console-app-example.md
Set up daemon/service authentication without user interaction.
Required Information:
Implementation: Use Client Credentials flow (see references/oauth-flows.md#client-credentials-flow)
| Command | Purpose |
|---|---|
az ad app create | Create new app registration |
az ad app list | List app registrations |
az ad app show | Show app details |
az ad app permission add | Add API permission |
az ad app credential reset | Generate new client secret |
az ad sp create | Create service principal |
Complete reference: See references/cli-commands.md
MSAL is the recommended library for integrating Microsoft identity platform.
Supported Languages:
Microsoft.Identity.Client@azure/msal-browser, @azure/msal-nodemsalExamples: See references/console-app-example.md
| Practice | Recommendation |
|---|---|
| Never hardcode secrets | Use environment variables, Azure Key Vault, or managed identity |
| Rotate secrets regularly | Set expiration, automate rotation |
| Use certificates over secrets | More secure for production |
| Least privilege permissions | Request only required API permissions |
| Enable MFA | Require multi-factor authentication for users |
| Use managed identity | For Azure-hosted apps, avoid secrets entirely |
| Validate tokens | Always validate issuer, audience, expiration |
| Use HTTPS only | All redirect URIs must use HTTPS (except localhost) |
| Monitor sign-ins | Use Entra ID sign-in logs for anomaly detection |
© microsoft, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file
SKILL.md and 17 other files (references) in plugins/azure-skills/skills/entra-app-registration of microsoft/GitHub-Copilot-for-Azure.
Open the folder on GitHubat commit ce94fce
We found 5 copies of this SKILL.md (exact, near-identical or edited) in other folders, from 2 other GitHub owners. This page covers the copy in microsoft/GitHub-Copilot-for-Azure, which our catalogue first saw on October 7, 2026.
Entra App Registration next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.
| Skill | Stars | Used in | Tokens | Auto-check | Licence | Repo updated |
|---|---|---|---|---|---|---|
| Entra App Registration this skillmicrosoft/GitHub-Copilot-for-Azure | 255 | 2 repos | ~2.1k | Automated safety check: Pass | MIT | |
| Apex Entra App Registrationjonathan-vella/apex | 217 | — | ~1.3k | Automated safety check: Pass | MIT | |
| Iam Auditbriiirussell/cybersecurity-skills | 413 | — | ~3.1k | Automated safety check: Notes | MIT | |
| Azure Key VaultKilo-Org/kilo-marketplace | 190 | 1 repos | ~1.9k | Automated safety check: Pass | MIT | |
| Azure AuthLeoYeAI/openclaw-master-skills | 2.2k | — | ~4.9k | Automated safety check: Notes | MIT | |
| Entra Idvinayaklatthe/microsoft-security-skills | 175 | — | ~2.3k | Automated safety check: Pass | MIT |
jonathan-vella/apex
WORKFLOW SKILL — Guides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration.
briiirussell/cybersecurity-skills
Audit, design, and migrate Identity and Access Management — cloud provider IAM (AWS, GCP, Azure), identity providers (Okta, Entra ID / Azure AD, Auth0, Google Workspace), application authorization…
Kilo-Org/kilo-marketplace
Guidance for Azure Key Vault — securely storing and managing secrets, keys, and certificates with RBAC, network isolation, managed identity access, soft delete / purge protection, and rotation.
LeoYeAI/openclaw-master-skills
Microsoft Entra ID (Azure AD) authentication for React SPAs with MSAL.js and Cloudflare Workers JWT validation using jose library.
vinayaklatthe/microsoft-security-skills
Guidance for Microsoft Entra ID (formerly Azure AD) — cloud identity and access management and the control plane for Zero Trust.
timothywarner-org/claude-code
A skill your agent uses when authoring, reviewing, or refactoring Azure Bicep code.
microsoft/GitHub-Copilot-for-Azure
Discovers available Azure OpenAI model capacity across regions and projects.
microsoft/GitHub-Copilot-for-Azure
Unified Azure OpenAI model deployment skill with intelligent intent-based routing.
microsoft/GitHub-Copilot-for-Azure
Azure Storage Services including Blob Storage, File Shares, Queue Storage, Table Storage, and Data Lake.
microsoft/GitHub-Copilot-for-Azure
Build, deploy, evaluate, optimize, fine-tune, and manage Microsoft Foundry agents, models, and resources end to end.
microsoft/GitHub-Copilot-for-Azure
Provision Microsoft Entra Agent Identity Blueprints, BlueprintPrincipals, and per-instance Agent Identities via Microsoft Graph, and configure OAuth 2.0 token exchange (fmipath, OBO, cross-tenant)…
microsoft/GitHub-Copilot-for-Azure
Assess Kubernetes workloads and cluster configuration for AKS Automatic compatibility.
Categories
Guides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration. Entra App Registration is an agent skill from microsoft/GitHub-Copilot-for-Azure, published by the product's own GitHub organization.0 authentication, and MSAL integration.
Entra App Registration fits situations like: : create app registration; register Azure AD app; configure OAuth; set up authentication.
Run `npx skills add microsoft/GitHub-Copilot-for-Azure --skill entra-app-registration -a claude-code`. Or copy the skill folder (plugins/azure-skills/skills/entra-app-registration in microsoft/GitHub-Copilot-for-Azure) into .claude/skills/entra-app-registration in your project. Claude Code loads it when a task matches its description.
Run `npx skills add microsoft/GitHub-Copilot-for-Azure --skill entra-app-registration -a codex`. Or copy the skill folder (plugins/azure-skills/skills/entra-app-registration in microsoft/GitHub-Copilot-for-Azure) into .agents/skills/entra-app-registration in your project. Codex loads it when a task matches its description.
Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add microsoft/GitHub-Copilot-for-Azure --skill entra-app-registration -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/entra-app-registration, .gemini/skills/entra-app-registration, .github/skills/entra-app-registration and .opencode/skills/entra-app-registration in your project.
Going by SKILL.md and its folder, Entra App Registration needs the command-line tools its instructions call (az). Our summary lists: Python 3; Node.js.
SKILL.md names 1 domain. As links in the text: learn.microsoft.com. This is read from the text; nothing was executed.
Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.
Entra App Registration is published under the MIT licence (declared in SKILL.md). It allows redistribution, so the full SKILL.md is shown on this page.
About 2.1k tokens (SKILL.md is roughly 8.2k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full. Its references folder adds about 19k tokens, read only when the agent opens those files.
Skills that share tags, products or a category with Entra App Registration: Apex Entra App Registration (jonathan-vella/apex, 217 stars), Iam Audit (briiirussell/cybersecurity-skills, 413 stars), Azure Key Vault (Kilo-Org/kilo-marketplace, 190 stars) and Azure Auth (LeoYeAI/openclaw-master-skills, 2.2k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.
microsoft (a GitHub organization, an official publisher) maintains it in microsoft/GitHub-Copilot-for-Azure, which has 255 GitHub stars. The repository holds 61 skills in this directory. The repository was last updated on October 9, 2026.
Source: microsoft/GitHub-Copilot-for-Azure on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.