Guide to registering applications in Microsoft Entra ID and obtaining access tokens using the OAuth2 client credentials flow.
Registering an application in Microsoft Entra ID (formerly Azure AD) is the essential first step for enabling authentication and authorization with Microsoft Identity Services. An app registration tells Entra ID that your application intends to use Microsoft identity and gives the app a unique Application (client) ID, credentials, and configuration used during authentication flows.Why register an application? Core benefits:
Centralized application management in Microsoft Entra ID.
Secure user authentication using Entra ID authentication mechanisms.
Fine-grained authorization via scopes and permissions.
Integration with Azure services (Key Vault, Blob Storage, SQL, etc.).
App-to-app authentication using client credentials (client secret or certificate).
Cross-platform SDKs and developer tooling.
Global scale and industry-standard security for authentication tokens.
Since app registrations are stored in Microsoft Entra ID, they inherit Entra ID’s security, policy, and scalability capabilities.This guide walks through the Azure portal steps to create an app registration and then requests an access token using the client credentials flow. The same registration details (client_id, client_secret/certificate, tenant) are used to authenticate and request tokens from the Microsoft Identity Platform.Getting started: open the Azure portal and navigate to Microsoft Entra ID (the new name for Azure Active Directory).
In the Microsoft Entra ID blade, open App registrations to create a new app.
Click New registration, supply a Name (in this lesson we use “app-sec-reg”), and choose the Supported account types. Optionally add a Redirect URI for interactive web flows. For simple service-to-service (non-interactive) scenarios, Redirect URI is not required.Account type guidance:
Supported account type
Use case
When to choose
Accounts in this organizational directory only (single tenant)
Internal apps used only within one tenant
Use for internal business apps
Accounts in any organizational directory (multi-tenant)
Apps used by multiple organizations
Use for B2B or ISV apps
Accounts in any org and personal Microsoft accounts
Broad consumer + org access
Use for apps targeting both work and personal accounts
Personal Microsoft accounts only
Consumer-only apps
Use for single-user consumer apps
After clicking Register, the portal shows the app registration details. Copy the Application (client) ID and Directory (tenant) ID — you will use the client_id (and tenant) when requesting tokens.
You can view endpoints for the Microsoft identity platform (authorize endpoints, token endpoints, OpenID configuration, etc.). For client credentials flows you will call the token endpoint.Example endpoints (replace the tenant ID with your tenant ID):
For this tutorial we will request an access token from the v2 token endpoint.Next: create credentials for the application. For production use, a certificate is recommended. For quick testing you can create a client secret in Certificates & secrets.
After adding a client secret, copy its value immediately. You cannot retrieve the secret value later from the portal — if you lose it you must create a new secret.
Requesting a token (client credentials grant)
Use grant_type=client_credentials for app-to-app (no user) authentication.
HTTP POST example (application/x-www-form-urlencoded) to the v2 token endpoint:
Copy
POST https://login.microsoftonline.com/1e0fa212-37dc-45f5-bb0f-b60687cac64b/oauth2/v2.0/tokenContent-Type: application/x-www-form-urlencodedclient_id=5a683b67-8a0d-4834-8a45-fb8167003e2d&client_secret=xWNBQ~7_W_xiJ0iWtGQYGcGctwgCxW83mV0enbLG&grant_type=client_credentials&scope=https://graph.microsoft.com/.default
(If using Postman: select Body → x-www-form-urlencoded and enter the key/value pairs, or use Bulk Edit to paste them.)A successful response returns a JSON payload containing an access token:
Token validation checklist (when your API receives a token):
Verify the token signature using the issuer’s public keys (from OpenID configuration).
Verify the issuer (iss) matches expected issuer for the tenant.
Verify the audience (aud) matches your API or Microsoft Graph.
Verify token expiry (exp) and not-before (nbf).
Verify required claims (appid, scopes/roles) are present.
How the token is issued
The Microsoft Identity Platform issues tokens after authenticating the client (by client secret or certificate) and validating requested scopes/permissions. Your app then presents the token to APIs (Microsoft Graph or other resource APIs) to authenticate and authorize requests.
Calling Microsoft Graph with the token
Acquire the access_token as shown above.
Add Authorization: Bearer <access_token> header to your HTTP requests.
Call Graph endpoints, for example:
GET https://graph.microsoft.com/v1.0/usersEnsure your app registration has the appropriate application permissions in the Azure portal and that an admin has granted consent where required.Further reading and references
This completes the app registration and token issuance overview. Next, you can use the access token to call Microsoft Graph or other protected APIs and learn how to validate tokens in your application code.
