entra-app-registration by microsoft/azure-skills
npx skills add https://github.com/microsoft/azure-skills --skill entra-app-registrationMicrosoft Entra ID(前身为 Azure Active Directory)是微软基于云的身份和访问管理服务。应用注册允许应用程序安全地验证用户身份并访问 Azure 资源。
| 概念 | 描述 |
|---|---|
| 应用注册 | 允许应用使用 Microsoft 身份平台的配置 |
| 应用程序(客户端)ID | 应用程序的唯一标识符 |
| 租户 ID | Azure AD 租户/目录的唯一标识符 |
| 客户端密码 | 应用程序的密码(仅限机密客户端) |
| 重定向 URI | 发送身份验证响应的 URL |
| API 权限 | 应用请求的访问范围 |
| 服务主体 | 注册应用时在租户中创建的身份 |
| 类型 | 用例 |
|---|---|
Microsoft Entra ID (formerly Azure Active Directory) is Microsoft's cloud-based identity and access management service. App registrations allow applications to authenticate users and access Azure resources securely.
| Concept | Description |
|---|---|
| App Registration | Configuration that allows an app to use Microsoft identity platform |
| Application (Client) ID | Unique identifier for your application |
| Tenant ID | Unique identifier for your Azure AD tenant/directory |
| Client Secret | Password for the application (confidential clients only) |
| Redirect URI | URL where authentication responses are sent |
| API Permissions | Access scopes your app requests |
| Service Principal | Identity created in your tenant when you register an app |
广告位招租
在这里展示您的产品或服务
触达数万 AI 开发者,精准高效
暂无相关 Skills
| Web 应用程序 |
| 服务器端应用、API |
| 单页应用 | JavaScript/React/Angular 应用 |
| 移动/本机应用 | 桌面、移动应用 |
| 守护程序/服务 | 后台服务、API |
在 Azure 门户或使用 Azure CLI 创建应用注册。
门户方法:
CLI 方法: 参见 references/cli-commands.md IaC 方法: 参见 references/BICEP-EXAMPLE.bicep
如果您已在项目中使用 IaC、需要可扩展的解决方案来管理大量应用注册,或者需要配置更改的细粒度审计历史,强烈建议使用 IaC 来管理 Entra 应用注册。
根据您的应用程序类型设置身份验证。
http://localhost 或自定义 URI 方案授予您的应用程序访问 Microsoft API 或您自己的 API 的权限。
常见的 Microsoft Graph 权限:
User.Read - 读取用户个人资料User.ReadWrite.All - 读取和写入所有用户Directory.Read.All - 读取目录数据Mail.Send - 以用户身份发送邮件详细信息: 参见 references/api-permissions.md
对于机密客户端应用程序(Web 应用、服务),创建客户端密码、证书或联合身份凭据。
客户端密码:
证书: 对于生产环境,使用证书而非密码以增强安全性。通过"证书和密码"部分上传证书。
联合身份凭据: 用于将机密客户端动态验证到 Entra 平台。
将 OAuth 流程集成到您的应用程序代码中。
参见:
引导用户逐步完成首次应用注册。
所需信息:
创建一个对用户进行身份验证的 .NET/Python/Node.js 控制台应用。
所需信息:
设置无需用户交互的守护程序/服务身份验证。
所需信息:
实现: 使用客户端凭据流(参见 references/oauth-flows.md#client-credentials-flow)
| 命令 | 用途 |
|---|---|
az ad app create | 创建新的应用注册 |
az ad app list | 列出应用注册 |
az ad app show | 显示应用详情 |
az ad app permission add | 添加 API 权限 |
az ad app credential reset | 生成新的客户端密码 |
az ad sp create | 创建服务主体 |
完整参考: 参见 references/cli-commands.md
MSAL 是集成 Microsoft 身份平台的推荐库。
支持的语言:
Microsoft.Identity.Client@azure/msal-browser, @azure/msal-nodemsal| 实践 | 建议 |
|---|---|
| 切勿硬编码密码 | 使用环境变量、Azure Key Vault 或托管身份 |
| 定期轮换密码 | 设置过期时间,自动化轮换 |
| 使用证书而非密码 | 生产环境更安全 |
| 最小权限原则 | 仅请求必需的 API 权限 |
| 启用 MFA | 要求用户进行多因素身份验证 |
| 使用托管身份 | 对于 Azure 托管的应用程序,完全避免使用密码 |
| 验证令牌 | 始终验证颁发者、受众、过期时间 |
| 仅使用 HTTPS | 所有重定向 URI 必须使用 HTTPS(localhost 除外) |
| 监控登录活动 | 使用 Entra ID 登录日志进行异常检测 |
每周安装量
12.8K
代码仓库
GitHub 星标数
2
首次出现
5 天前
安全审计
安装于
github-copilot12.8K
opencode17
gemini-cli17
codex17
amp16
cline16
| Type | Use Case |
|---|---|
| Web Application | Server-side apps, APIs |
| Single Page App (SPA) | JavaScript/React/Angular apps |
| Mobile/Native App | Desktop, mobile apps |
| Daemon/Service | Background services, APIs |
Create an app registration in the Azure portal or using Azure CLI.
Portal Method:
CLI Method: See references/cli-commands.md IaC Method: See references/BICEP-EXAMPLE.bicep
It's highly recommended to use the IaC to manage Entra app registration if you already use IaC in your project, need a scalable solution for managing lots of app registrations or need fine-grained audit history of the configuration changes.
Set up authentication settings based on your application type.
http://localhost or custom URI schemeGrant your application permission to access Microsoft APIs or your own APIs.
Common Microsoft Graph Permissions:
User.Read - Read user profileUser.ReadWrite.All - Read and write all usersDirectory.Read.All - Read directory dataMail.Send - Send mail as a userDetails: See references/api-permissions.md
For confidential client applications (web apps, services), create a client secret, certificate or federated identity credential.
Client Secret:
Certificate: For production environments, use certificates instead of secrets for enhanced security. Upload certificate via "Certificates & secrets" section.
Federated Identity Credential: For dynamically authenticating the confidential client to Entra platform.
Integrate the OAuth flow into your application code.
See:
Walk user through their first app registration step-by-step.
Required Information:
Script: See references/first-app-registration.md
Create a .NET/Python/Node.js console app that authenticates users.
Required Information:
Example: See references/console-app-example.md
Set up daemon/service authentication without user interaction.
Required Information:
Implementation: Use Client Credentials flow (see references/oauth-flows.md#client-credentials-flow)
| Command | Purpose |
|---|---|
az ad app create | Create new app registration |
az ad app list | List app registrations |
az ad app show | Show app details |
az ad app permission add | Add API permission |
az ad app credential reset | Generate new client secret |
az ad sp create | Create service principal |
Complete reference: See references/cli-commands.md
MSAL is the recommended library for integrating Microsoft identity platform.
Supported Languages:
Microsoft.Identity.Client@azure/msal-browser, @azure/msal-nodemsalExamples: See references/console-app-example.md
| Practice | Recommendation |
|---|---|
| Never hardcode secrets | Use environment variables, Azure Key Vault, or managed identity |
| Rotate secrets regularly | Set expiration, automate rotation |
| Use certificates over secrets | More secure for production |
| Least privilege permissions | Request only required API permissions |
| Enable MFA | Require multi-factor authentication for users |
| Use managed identity | For Azure-hosted apps, avoid secrets entirely |
| Validate tokens | Always validate issuer, audience, expiration |
| Use HTTPS only | All redirect URIs must use HTTPS (except localhost) |
| Monitor sign-ins | Use Entra ID sign-in logs for anomaly detection |
Weekly Installs
12.8K
Repository
GitHub Stars
2
First Seen
5 days ago
Security Audits
Installed on
github-copilot12.8K
opencode17
gemini-cli17
codex17
amp16
cline16