Privileged Identity Management Custom Extensions
Microsoft identity platform
The documentation now uses revised Application (client) ID examples in the endpoint URI and `resourceId` configuration sample.
Cross-product topic
Microsoft identity platform
A cross-product view of Microsoft Entra changes related to Microsoft identity platform.
Latest Microsoft identity platform changes
Privileged Identity Management Custom Extensions
Microsoft identity platform
The documentation now consistently uses a different application client ID in the endpoint URI, calling application claim, and `resourceId` examples.
Best Practices Agent Id
Microsoft identity platform
The best-practices documentation now uses the full “Microsoft Entra Agent ID” and “Microsoft Entra ID” names in two recommendations. The guidance itself is unchanged.
Integrate N8n Agent
Microsoft identity platform
The n8n integration page now consistently calls the pattern “Microsoft Entra ID Auth SDK (sidecar)” instead of “Microsoft Entra Auth SDK.”
What Is Agent Id Platform
Microsoft identity platform
The page’s bullet describing platforms and services that create agents retains the same wording and examples, including Copilot Studio, AWS Bedrock, and n8n. No substantive content change is shown.
Optional Claims
Microsoft identity platform
The documentation now explains how to configure granular AMR values for SAML applications through the manifest or Microsoft Graph, since the admin center has no UI option for `include_granular_amr`. It also documents adding the `amr` claim to OIDC token types and clarifies that `include_granular_amr` applies only to SAML.
Workload Identities Github Immutable Subjects
Microsoft identity platform
Replace `<application-object-id>` with the object ID of your app registration. Create one credential for each subject the workflow presents, such as a different branch or environment.
Configure Per App Access
Microsoft identity platform
Replace `{appRegistrationObjectId}` with the application registration's object ID. You can find this value in the Microsoft Entra admin center under **Identity** > **Applications** > **App registrations** by selecting the app registration for your Global Secure Access application and copying the **Object ID** from the **Overview** page. To return to the default behavior, set `trafficRoutingMethod` to `random`. For more information, see [Update application](/graph/api/application-update?view=graph-rest-beta&preserve-view=true).
Workload Identity Federation
Microsoft identity platform
- GitHub Actions. First, configure a trust relationship between your [user-assigned managed identity](workload-identity-federation-create-trust-user-assigned-managed-identity.md) or [application](workload-identity-federation-create-trust.md) in Microsoft Entra ID and a GitHub repo in the [Microsoft Entra admin center](https://entra.microsoft.com) or using Microsoft Graph. Then [configure a GitHub Actions workflow](/azure/developer/github/connect-from-azure) to get an access token from Microsoft identity provider and access Azure resources.
Access token claims reference
Microsoft identity platform
Claims reference with details on the claims included in access tokens issued by the Microsoft identity platform.
Access tokens in the Microsoft identity platform
Microsoft identity platform
Learn about access tokens used in the Microsoft identity platform.
Acquire a token to call a web API (single-page apps)
Microsoft identity platform
Learn how to acquire a token in a single-page app and call a web API using the Microsoft identity platform.
Application model
Microsoft identity platform
Learn about the process of registering your application so it can integrate with the Microsoft identity platform.
Application types for the Microsoft identity platform
Microsoft identity platform
The types of apps and scenarios supported by the Microsoft identity platform.
Authorization basics
Microsoft identity platform
Learn about the basics of authorization in the Microsoft identity platform.
Best practices for the Microsoft identity platform
Microsoft identity platform
Learn about best practices, recommendations, and common oversights when integrating with the Microsoft identity platform.
Call a web API from a web app
Microsoft identity platform
Learn how to build a web app that calls protected web APIs using the Microsoft identity platform. Explore options for ASP.NET Core, ASP.NET, Java, Node.js, and Python.
Call an ASP.NET Core web API with cURL
Microsoft identity platform
Learn how to call a protected ASP.NET Core web API using the Microsoft identity platform with cURL.
Call an ASP.NET Core web API with Insomnia
Microsoft identity platform
Learn how to call a protected ASP.NET Core web API using the Microsoft identity platform and Insomnia.
Claims challenges, claims requests and client capabilities
Microsoft identity platform
Explanation of claims challenges, claims requests, and client capabilities in the Microsoft identity platform.
Claims customization
Microsoft identity platform
Learn about the custom claims policy and claims mapping policy types, which are used to modify the claims emitted in tokens in the Microsoft identity platform.
Common steps for public client migration to MSAL
Microsoft identity platform
Include file that explains the common steps you need to take for all public client apps when it comes to migration from ADAL to MSAL.
Configure optional claims
Microsoft identity platform
Learn how to configure optional claims and attributes in access tokens issued by Microsoft identity platform; optional claims can add useful user information for your app.
Create an agent identity blueprint
Microsoft identity platform
Learn how to create an agent identity blueprint that serves as a template for multiple agent identities using Microsoft Graph APIs and PowerShell.
Custom role-based access control for application developers
Microsoft identity platform
Learn about what custom RBAC is and why it's important to implement in applications.
Customer intent: As a developer who creates apps for consumers and business customers, I want to understand the capabilities of Microsoft Entra Exter…
Microsoft identity platform
Compare solutions for using Microsoft Entra External ID to work with people outside your organization, including B2B collaboration and Azure AD B2C.
Customize app JSON Web Token (JWT) claims
Microsoft identity platform
Learn how to customize the claims issued by Microsoft identity platform in the JSON web token (JWT) token for enterprise applications.
Developer’s Guide to Requesting Permissions and Consent in Microsoft Identity Platform
Microsoft identity platform
Learn how developers can request for permissions through consent in the Microsoft identity platform endpoint.
Get a token for a web API that calls web APIs
Microsoft identity platform
As a developer, I want to learn how to acquire tokens for web APIs so that I can enable secure API calls in my application.
How to configure an application to expose a web API
Microsoft identity platform
In this how-to guide, register a web API with the Microsoft identity platform and configure its scopes, exposing it to clients for permissions-based access to the API's resources.
How to: Change the account types supported by an application
Microsoft identity platform
In this how-to, you configure an application registered with the Microsoft identity platform to change who, or what accounts, can access the application.
How to: Remove a registered app from the Microsoft identity platform
Microsoft identity platform
Learn how to remove an application registered with the Microsoft identity platform.
How to: Restore or remove a recently deleted application with the Microsoft identity platform
Microsoft identity platform
In this how-to, you learn how to restore or permanently delete a recently deleted application registered with the Microsoft identity platform.
ID token claims reference
Microsoft identity platform
Learn the details of the claims included in ID tokens issued by the Microsoft identity platform.
ID tokens in the Microsoft identity platform
Microsoft identity platform
Learn about ID tokens used in the Microsoft identity platform.
Include file - Register a daemon in the Microsoft identity platform
Microsoft identity platform
manager: pmwongera
Include file - Register a single-page application in the Microsoft identity platform
Microsoft identity platform
manager: pmwongera
Include file - Register a web application in the Microsoft identity platform
Microsoft identity platform
manager: pmwongera
Increase application security using Zero Trust principles
Microsoft identity platform
Learn how using Zero Trust principles can help increase the security of your application and its data.
Logging errors and exceptions in MSAL.js
Microsoft identity platform
Learn how to log errors and exceptions in MSAL.js
Mark an app as publisher verified
Microsoft identity platform
Describes how to mark an app as publisher verified. When an application is marked as publisher verified, it means that the publisher (application developer) verified the authenticity of their organization using a Cloud Partner Program (CPP) account that completed the verification process and associated this CPP account with that application registration.
Microsoft identity platform accounts & tenant profiles on Android
Microsoft identity platform
An overview of the Microsoft identity platform accounts for Android
Microsoft identity platform admin consent protocols
Microsoft identity platform
A description of authorization in the Microsoft identity platform, including scopes, permissions, and consent.
Microsoft identity platform app-only access scenario
Microsoft identity platform
Learn about when and how to use app-only access in the Microsoft identity platform endpoint.
Microsoft identity platform delegated access scenario
Microsoft identity platform
Learn about when and how to use delegated access in the Microsoft identity platform endpoint.
Microsoft identity platform overview
Microsoft identity platform
Learn about the components of the Microsoft identity platform and how they can help you build identity and access management (IAM) support into your applications.
Microsoft identity platform UserInfo endpoint
Microsoft identity platform
Learn about the UserInfo endpoint on the Microsoft identity platform.
Migrate JavaScript single-page app from implicit grant to authorization code flow
Microsoft identity platform
How to update a JavaScript SPA using MSAL.js 2.x and the authorization code flow with PKCE and CORS support.
Optional claims reference
Microsoft identity platform
Claims reference with details on the optional claims that can be included in tokens in the Microsoft identity platform.
Overview of permissions and consent in the Microsoft identity platform
Microsoft identity platform
Learn the foundational concepts and scenarios around consent and permissions in the Microsoft identity platform
Publisher verification overview
Microsoft identity platform
Learn about benefits, program requirements, and frequently asked questions in the publisher verification program for the Microsoft identity platform.
Quickstart - Call a web API in a sample daemon app
Microsoft identity platform
A daemon app code sample quickstart that shows how to acquire an access token to call a protected web API by using Microsoft identity platform
Quickstart: Add sign in with Microsoft to an Android app
Microsoft identity platform
In this quickstart, learn how Android applications can call an API that requires access tokens issued by the Microsoft identity platform.
Quickstart: Add sign in with Microsoft to an iOS or macOS app
Microsoft identity platform
In this quickstart, learn how an iOS or macOS app can sign in users, get an access token from the Microsoft identity platform, and call the Microsoft Graph API.
Quickstart: Add sign in with Microsoft to an iOS or macOS app
Microsoft identity platform
In this quickstart, learn how an iOS or macOS app can sign in users, get an access token from the Microsoft identity platform, and call the Microsoft Graph API.
Quickstart: Call a web API that is protected by the Microsoft identity platform
Microsoft identity platform
In this quickstart, you download and modify a code sample that demonstrates how to protect an ASP.NET web API by using the Microsoft identity platform for authorization.
Quickstart: Call an ASP.NET web API that is protected by the Microsoft identity platform
Microsoft identity platform
In this quickstart, learn how to call an ASP.NET web API that's protected by the Microsoft identity platform from a Windows Desktop (WPF) application.
Quickstart: Call an ASP.NET web API that is protected by the Microsoft identity platform
Microsoft identity platform
In this quickstart, learn how to call an ASP.NET web API that's protected by the Microsoft identity platform from a Windows Desktop (WPF) application.
Quickstart: Call Microsoft Graph from a Java daemon
Microsoft identity platform
In this quickstart, you learn how a Java app can get an access token and call an API protected by Microsoft identity platform endpoint, using the app's own identity
Quickstart: Call Microsoft Graph from a Java daemon
Microsoft identity platform
In this quickstart, you learn how a Java app can get an access token and call an API protected by Microsoft identity platform endpoint, using the app's own identity
Quickstart: Call Microsoft Graph from a Node.js console app
Microsoft identity platform
In this quickstart, you download and run a code sample that shows how a Node.js console application can get an access token and call an API protected by a Microsoft identity platform endpoint, using the app's own identity
Quickstart: Call Microsoft Graph from a Node.js console app
Microsoft identity platform
In this quickstart, you download and run a code sample that shows how a Node.js console application can get an access token and call an API protected by a Microsoft identity platform endpoint, using the app's own identity
Quickstart: Call Microsoft Graph from a Python daemon
Microsoft identity platform
In this quickstart, you learn how a Python process can get an access token and call an API protected by Microsoft identity platform, using the app's own identity
Quickstart: Call Microsoft Graph from a Python daemon
Microsoft identity platform
In this quickstart, you learn how a Python process can get an access token and call an API protected by Microsoft identity platform, using the app's own identity
Quickstart: Protect an ASP.NET Core web API with the Microsoft identity platform
Microsoft identity platform
In this quickstart, you download and modify a code sample that demonstrates how to protect an ASP.NET Core web API by using the Microsoft identity platform for authorization.
Quickstart: Protect an ASP.NET Core web API with the Microsoft identity platform
Microsoft identity platform
In this quickstart, you download and modify a code sample that demonstrates how to protect an ASP.NET Core web API by using the Microsoft identity platform for authorization.
Quickstart: Register an app in the Microsoft identity platform
Microsoft identity platform
In this quickstart, you learn how to register an application with the Microsoft identity platform.
Quickstart: Sign in users and call Microsoft Graph from an Android app
Microsoft identity platform
In this quickstart, learn how Android applications can call an API that requires access tokens issued by the Microsoft identity platform.
Quickstart: Sign in users and call Microsoft Graph in a Universal Windows Platform app
Microsoft identity platform
In this quickstart, learn how a Universal Windows Platform (UWP) application can get an access token and call an API protected by Microsoft identity platform.
Quickstart: Sign in users and call Microsoft Graph in a Windows desktop app
Microsoft identity platform
In this quickstart, learn how a Windows Presentation Foundation (WPF) application can get an access token and call an API protected by the Microsoft identity platform.
Quickstart: Sign in users and call Microsoft Graph in a Windows desktop application
Microsoft identity platform
In this quickstart, learn how a Windows Presentation Foundation (WPF) app can get an access token and call an API protected by the Microsoft identity platform.
Redirect URI (reply URL) best practices and limitations
Microsoft identity platform
A description of the best practices and limitations of redirect URIs in the Microsoft identity platform.
Refresh tokens in the Microsoft identity platform
Microsoft identity platform
Learn about refresh tokens that are used in the Microsoft identity platform.
Set up a test environment for your app
Microsoft identity platform
Learn how to set up a Microsoft Entra test environment so you can test your application integrated with Microsoft identity platform. Evaluate whether you need a separate tenant for testing or if you can use your production tenant.
Shared device mode overview
Microsoft identity platform
Learn how Microsoft Entra ID's shared device mode feature enables device sharing for your frontline workers.
Sign in users in a Node.js/Express web app
Microsoft identity platform
In this tutorial, you add support for signing-in users in a web app.
Sign in users in an Android app by using Microsoft identity platform
Microsoft identity platform
Set up an Android app project that signs in users into customer facing app by in an external tenant or employees in a workforce tenant
Signing Key Rollover in Microsoft identity platform
Microsoft identity platform
This article discusses the best practices for signing key rollover in Microsoft Entra ID.
Support and help options for Microsoft identity platform developers
Microsoft identity platform
Learn where to get help and find answers to your questions as you build identity and access management (IAM) solutions that integrate with Microsoft Entra ID and other components of the Microsoft identity platform.
Support single sign-on and app protection policies in mobile apps you develop
Microsoft identity platform
Explanation and overview of building mobile applications that support single sign-on and app protection policies using the Microsoft identity platform and integrating with Microsoft Entra ID.
Supported account types
Microsoft identity platform
Conceptual documentation about audiences and supported account types in in the Microsoft identity platform
Troubleshoot publisher verification
Microsoft identity platform
Describes how to troubleshoot publisher verification for the Microsoft identity platform by calling Microsoft Graph APIs.
Tutorial-Call Microsoft Graph API from a Express.js web app
Microsoft identity platform
Learn how to acquire an access token in a Node/Express.js web to read user's profile detail from Microsoft Graph API
Tutorial: Build and secure an ASP.NET Core web API with the Microsoft identity platform
Microsoft identity platform
Protect the endpoint of an API, then run it to ensure it's listening for HTTP requests.
Tutorial: Call a protected ASP.NET Core web API
Microsoft identity platform
Learn how to call a web API whose endpoints are protected using the Microsoft identity platform
Tutorial: Call Microsoft Graph API from a Python Flask web app
Microsoft identity platform
Call Microsoft Graph API from a Python Flask web app
Tutorial: Call protected web API from your .NET daemon app
Microsoft identity platform
Learn about how to call a protected web API from your .NET client daemon app. In this tutorial, we call Microsoft Graph API.
Tutorial: Sign in users and call the Microsoft Graph API in an Electron desktop app
Microsoft identity platform
In this tutorial, you build an Electron desktop app that can sign in users and use the auth code flow to obtain an access token from the Microsoft identity platform and call the Microsoft Graph API.
Tutorial: Use role-based access control in your .NET MAUI desktop app using the Microsoft identity platform
Microsoft identity platform
This tutorial demonstrates how to add app roles to .NET Multi-platform App UI (.NET MAUI) shell and receive them in the ID token.
Tutorial: Use role-based access control in your .NET MAUI mobile app using the Microsoft identity platform
Microsoft identity platform
This tutorial demonstrates how to add app roles to .NET Multi-platform App UI (.NET MAUI) and receive them in the ID token.
Update an app's requested permissions in Microsoft Entra ID
Microsoft identity platform
Learn how developers can stop applications from requesting unnecessary permissions and also add new permissions for applications in the Microsoft identity platform.
Updates and breaking changes
Microsoft identity platform
Learn about changes to the Microsoft identity platform that can impact your application.
Validation differences by supported account types
Microsoft identity platform
Learn about the validation differences of various properties for different supported account types when registering your app with the Microsoft identity platform.
Web API app registration and API permissions
Microsoft identity platform
In this quickstart, you learn how to configure app registration and API permissions for a Web API, and how to grant admin consent to these permissions.
Web API that calls web APIs
Microsoft identity platform
Build a web API that calls other APIs using the Microsoft identity platform. Learn how to acquire tokens and make secure API calls.
What's new in the Microsoft identity platform docs
Microsoft identity platform
New and updated articles in the Microsoft identity platform documentation.
Quickstart Access Log With Graph Api
Microsoft identity platform
To complete the scenario in this quickstart, you need:
App registrations must not have dangling or abandoned domain redirect URIs
Microsoft identity platform
author: kenwith
Inactive applications don’t have highly privileged Microsoft Graph API permissions
Microsoft identity platform
author: kenwith
Power Apps - Dataverse Agent users with Microsoft Entra Agent ID
Microsoft identity platform
We’re introducing a new feature in public preview, Dataverse Agent users, powered by Microsoft Entra Agent ID. Rollout of this feature will start on May 4, 2026, and is expected to reach North America by May 22, 2026.
Create an agent identity blueprint
Microsoft identity platform
Learn how to create an agent identity blueprint that serves as a template for multiple agent identities using Microsoft Graph APIs and PowerShell.
Recommendation to migrate to Microsoft Graph API
Microsoft identity platform
Learn about the Microsoft Entra recommendation to migrate from Azure Active Directory Graph APIs to Microsoft Graph APIs.
Customer intent: As a developer or DevOps engineer, I want to use the Azure REST API to manage my external tenant.
Microsoft identity platform
author: garrodonnell
Reset guest redemption status
Microsoft identity platform
Learn how to reset the redemption status for a guest user in Microsoft Entra External ID. This guide covers using the admin center, PowerShell, and Microsoft Graph API.
Assign a remote network to a traffic forwarding profile for Global Secure Access
Microsoft identity platform
Assign remote networks to traffic forwarding profiles through the Microsoft Entra admin center or Microsoft Graph API to route branch office traffic through Global Secure Access.
Simplifying agent management with Agent 365
Microsoft identity platform
Starting May 1, 2026, Microsoft is retiring the Agent registry and Agent collections blades in the Microsoft Entra admin center. Agent 365 will be the unified platform for agent management, with a new API replacing the existing one. No immediate admin action is required.
Configure a multitenant organization using PowerShell or Microsoft Graph API
Microsoft identity platform
ai-usage: ai-assisted
Configure cross-tenant synchronization using PowerShell or Microsoft Graph API
Microsoft identity platform
ai-usage: ai-assisted
Configure multitenant organization policy templates using the Microsoft Graph API
Microsoft identity platform
ai-usage: ai-assisted
Call a Microsoft Graph API from an agent using .NET
Microsoft identity platform
This article explains how to call a Microsoft Graph API from an agent using agent identities or an agent's user account.
Configure a multitenant organization using PowerShell or Microsoft Graph API
Microsoft identity platform
Create and manage a multitenant organization using Microsoft Graph PowerShell or Microsoft Graph API. Covers creating the organization, adding tenants, joining, and managing roles.
Configure cross-tenant synchronization using PowerShell or Microsoft Graph API
Microsoft identity platform
Configure cross-tenant synchronization using Microsoft Graph PowerShell or Microsoft Graph API. Includes enabling synchronization, setting up automatic redemption, creating provisioning jobs, and testing on-demand provisioning.
Configure multitenant organization policy templates using Microsoft Graph API
Microsoft identity platform
Configure cross-tenant access and identity synchronization policy templates for multitenant organizations using the Microsoft Graph API. Covers automatic redemption, inbound sync, and template management.
How to Assign a Remote Network to a Traffic Forwarding Profile for Global Secure Access
Microsoft identity platform
Assign remote networks to traffic forwarding profiles through the Microsoft Entra admin center or Microsoft Graph API to route branch office traffic through Global Secure Access.
How to list remote networks for Global Secure Access
Microsoft identity platform
View and review all remote networks in your Global Secure Access deployment using the Microsoft Entra admin center or Microsoft Graph API.