Microsoft Entra App Registration & Graph Permissions
$2.99OfficialUse when a task needs Microsoft Graph access: register an Entra app, pick delegated vs application permissions, grant admin consent, authenticate.
cloudentramicrosoft-graphoauth2identityapp-registrationadmin-consent· by SkillingMain
What you get
- ✓10-step procedure
- ✓Runnable Python / JSON included
- ✓7-point quality checklist
- ✓10 pitfalls to avoid
- ✓Installs into 6 tools
- Version
- v1 →
- Last updated
- today
- Length
- 11 min read
- Requires
- Best with a strong model (claude-opus-5)
Works in: Claude Code, Codex, Cline, opencode, OpenClaw, Hermes · Built for large codebases
What you'll need to set up
Fiddly setup — follow closely · 15-25 minA tenant administrator must create (or authorise you to create) an Entra app registration, grant tenant-wide admin consent to the Microsoft Graph permissions it declares, and hand over the client ID plus a certificate or client secret.
AZURE_TENANT_IDAZURE_CLIENT_IDAZURE_CLIENT_SECRETAZURE_CLIENT_CERTIFICATE_PATHAZURE_CLIENT_CERTIFICATE_PASSWORDAZURE_AUTHORITY_HOSTPreview
When to use
Invoke this skill when a task must call Microsoft Graph or another Entra-protected API and:
- No app registration exists yet for the workload and you have to create one, or calls fail with
AADSTS65001,Authorization_RequestDenied, or a bare403because the permission model is wrong, unconsented, or the wrong type. - The workload must move from an interactive user token to an unattended daemon token, or back.
- A client secret is expiring or expired (
AADSTS7000222) and must be rolled, ideally onto a certificate, or someone asks "which Graph permission does X need, and is it delegated or application?"
Do not invoke this skill when the workload runs on Azure compute th
…
🔒 Buy once ($2.99) to unlock the full playbook, download it, and install it in every tool you use.