Turn identity requirements into a controlled Microsoft Entra app registration with bounded permissions, safe credentials, exact verification, and rollback.
Entra app registrations break in quiet ways. A client ID gets used where an object ID was required. A browser app receives a secret it cannot protect. A broad Graph permission gets granted because nobody mapped the actual action. A successful token request is treated as proof that tenant restrictions and downstream authorization work.
Entra App Registration turns the job into a reviewable identity change. It separates the application object from tenant-local service principals, records stable identifiers and evidence quality, and derives the account audience, OAuth flow, platform, redirect URIs, API permissions, consent, credentials, and token checks from named requirements. Every planned field change includes its current evidence, approval boundary, expected effect, read-back, and recovery path.
Use it for new registrations, OAuth or OIDC client changes, MSAL integrations, application and delegated permissions, consent planning, workload federation, certificates, controlled secret rotation, redirect URI changes, exposed APIs, and production recovery. It keeps Azure RBAC and application code outside the registration boundary unless the request explicitly requires a separate workstream.
Version 1.0.0 was reviewed on 2026-07-17 and evaluated through Codex CLI with gpt-5.6-sol in 12 fresh read-only contexts. The candidate scored 100 across three cases, compared with 86.25 for the same agent without the skill and 77.92 for the exact official free upstream. The cases covered an ambiguous multi-tenant SPA, a canonical workload-federation plan, and recovery after an unsafe credential reset. All cases passed. The closest case-level margin over upstream was 10 points. This evaluation measures the supplied cases. It does not prove that a live tenant matches the supplied evidence, that an operator has authority, that consent was granted, or that authentication works without current read-back and tests. The reviewed package SHA-256 is 39d8b786ce076ea361b35ce25967fcc2c8c716b8bc5ff3b130239331b98d2188.
The package includes a read-only checker for an optional canonical JSON registration plan. Passing it confirms the declared structure, stable-identity fields, redirect URI rules, safe credential metadata, change controls, verification states, rollback, and verdict precedence. It cannot contact Microsoft Entra, authorize a mutation, validate tokens, inspect consent, or prove sign-in. Maintenance and install support are handled by the platform-operated publisher for this listing.
Input
Plan Microsoft sign-in for a React SPA at one production and one local callback. Employees and selected customer tenants should sign in. Product asks for calendar access, but tenant policy and consent ownership are not yet defined. Do not change production.
Output
An approval-ready plan that keeps unknown tenant and object IDs explicit, selects authorization code with PKCE, records exact platform-specific redirects, maps the required delegated permissions, rejects unsupported broad access, names consent and tenant-policy blockers, and defines read-back, positive, negative, and rollback checks.
Input
Create canonical JSON for a single-tenant GitHub Actions workload that reads group membership from Microsoft Graph. Keep the existing certificate working until the federated path is proven. Approval is pending.
Provide the tenant and environment, the people or workloads that must authenticate, the downstream actions they need, the application type, current registration or manifest evidence, affected application and service-principal identifiers, approval scope, and recovery constraints. Ask for a read-only plan, an approval-ready canonical JSON record, execution of an already approved bounded change, verification of current state, or recovery from a failed credential or redirect update. The skill stops before mutation when target identity, authority, permission mapping, current evidence, or recovery is unsafe or ambiguous.
Who or what authenticates, supported tenants, application type, hosting boundary, downstream APIs and actions, environments, and availability needs.
Tenant ID plus the application client ID, application object ID, and tenant-local service-principal object ID for an existing registration. New-registration plans may leave object IDs unknown until creation.
Current manifest or field snapshot, owners, redirect URIs, permissions, consent and credential metadata, sign-in evidence, requested mode, and the exact approved mutation boundary when execution is requested.
A way to read back application and service-principal state, test the intended and negative authentication paths, inspect safe token metadata and downstream authorization, review audit evidence, and restore or compensate changes.
SKILL.md; controlled Entra registration planning, change, verification, and recovery workflow; canonical registration-plan contract; read-only registration-plan checker; Agent Skills interface metadata
No reviews yet.
Output
Schema-bound JSON with exact tenant and workload subject, null future object IDs, least-privilege application permission, identity-team consent ownership, no secret value, add-test-switch-observe-retire overlap, field-level read-back, downstream and negative tests, rollback, and a ready-for-approval verdict.
Input
Production sign-in failed after a credential reset. We have a client ID and tenant ID but no application or service-principal object IDs. An operator also wants to replace a redirect URI, grant Mail.Send application permission, and remove the old certificate immediately.
Output
A blocked recovery record that resolves exact objects before mutation, keeps secret material out of chat, preserves the possibly working certificate, separates redirect, credential, permission, and consent changes, demands a current snapshot and approval, verifies registration plus application behavior, and defines containment and rollback triggers.
Creator
Llirven6
