App Registration in Azure: Quickly How Do I Register an Application Step by Step?

By SP Doctor in Microsoft 365 on November 25, 2023November 25, 2023

In this “App Registration in Azure” article, we will learn what an app registration is in Azure and how to register an app in Azure step by step. We will also learn about other various processes in app registration, like how to configure authentication (client secret), API permissions, add a scope, expose an API, etc.

In the era of cloud computing, Microsoft Azure stands as a stalwart, offering a robust and comprehensive platform for a myriad of applications. One of the key components that facilitates the integration and authentication of these applications is the process of app registration in Azure. This pivotal step lays the foundation for secure and efficient communication between your application and Azure services.

Table of Contents

Understanding App Registration in Azure

In this section, we will understand the app registration process in Azure.

Basic understanding of App Registration

App registration in Azure is more than just a procedural step; it is the key to unlocking the full potential of your application within the Azure ecosystem. At its core, app registration establishes a unique identity for your application within the Azure Active Directory (AAD), acting as a digital passport that allows your application to traverse the diverse landscapes of Azure services. This process involves defining the characteristics and capabilities of your application, laying the groundwork for seamless integration, secure authentication, and controlled access to Azure resources.

When initiating the app registration process, you are essentially creating a digital persona for your application. This persona includes critical details such as the application’s name, supported account types (whether it caters to single or multiple tenants), and the redirect URI, which determines where Azure will send authentication responses. This step sets the stage for a customized and tailored interaction between your application and Azure.

Moreover, app registration is not a one-size-fits-all endeavour. Azure provides flexibility in authentication methods, allowing you to choose between client secrets, certificates, and redirect URIs based on your application’s specific needs. By configuring these authentication settings, you are establishing the rules of engagement, ensuring that only authorized entities can access and interact with your application.

App registration goes beyond mere formality by empowering developers and administrators to define the scope of their application’s capabilities. This is achieved through the assignment of API permissions, which dictate the specific actions your application can perform within Azure services. Whether it’s reading user profiles, managing resources, or executing other bespoke functionalities, the granular control afforded by app registration ensures that your application operates within the bounds of intended use.

As a part of the app registration journey, it is essential to retrieve and safeguard key identifiers—namely, the Application (Client) ID and the Directory (Tenant) ID. These unique identifiers serve as the digital fingerprints of your application, allowing it to establish a secure and authenticated connection with Azure services.

Benefits of App Registration in Azure

Following are the benefits of app registration in Azure:

Security: App registration in Azure ensures secure and authenticated communication, reducing the risk of unauthorized access to resources.
Controlled Access: By assigning specific permissions, you have granular control over what actions your application can perform within Azure services.
Scalability: The registration process is designed to accommodate the scalability needs of your application, whether it’s a small-scale service or a large-scale enterprise solution.
Integration: Azure app registration facilitates smooth integration with other Azure services, providing a seamless experience for developers and end-users.

In the intricate web of cloud services, app registration in Azure emerges as a vital thread, weaving together security, control, and scalability. Navigating the steps of registration not only ensures a robust connection between your application and Azure but also sets the stage for a dynamic and secure cloud computing experience. Embrace the world of app registration in Azure, and unlock the full potential of your applications in the cloud.

Before we get into the app registration in the Azure portal, let’s understand what a Microsoft Entra ID is.

What is Microsoft Entra ID?

Azure Active Directory is now knowns as Microsoft Entra ID. Microsoft primarily used “Microsoft account” or “Azure Active Directory” for user identities across its services. The Microsoft account is commonly used for consumer-oriented services like Outlook.com, Xbox Live, and Skype, while Azure Active Directory is more prevalent in business and enterprise scenarios.

Microsoft Entra ID serves as a cloud-centric solution for identity and access management, operating as a directory and identity management service in the cloud. Its functionality extends to providing authentication and authorization services across a range of Microsoft offerings, including Microsoft 365, Dynamics 365, and Microsoft Azure.

Why do I need app registration in Azure, and how do they relate to my app service?

App registration in Azure is crucial for several reasons, and its relationship with your App Service is pivotal in achieving a secure, integrated, and scalable application environment.

Authentication and Authorization: App registration allows you to define how users or services authenticate with your application. By configuring authentication settings, you ensure that only authorized entities can access your App Service. This step is fundamental in safeguarding your application against unauthorized access and potential security threats.
Secure Communication: App registration provides your application with the necessary credentials and permissions to securely communicate with Azure services, including your App Service. This ensures that data transmitted between your application and the App Service remains confidential and protected from interception or tampering.
Granular Access Control: Through the assignment of API permissions during the app registration process, you gain granular control over what actions your application can perform within Azure services, including your App Service. This facilitates a principle of least privilege, where your application only has access to the specific resources and functionalities it requires, enhancing security.
Resource Integration: App registration establishes the connection between your application and Azure services, allowing for seamless integration with your App Service. This integration is essential for applications that rely on various Azure resources, databases, or other services to function effectively. It ensures that your application can leverage the full suite of Azure capabilities.
Token-based Authentication: App registration enables the use of tokens for authentication. When a user or service accesses your App Service, tokens generated during the authentication process are validated against the information stored in Azure AD, confirming the identity and permissions of the entity making the request. This token-based authentication enhances the overall security posture of your application.
Scaling Capabilities: As your application grows, app registration provides a scalable authentication and authorization framework. This ensures that regardless of the scale of your App Service, the authentication process remains efficient, and access control mechanisms are easily manageable.
User Experience: For applications involving user authentication, app registration allows you to configure redirect URIs, ensuring a smooth and user-friendly experience. After users authenticate, they are seamlessly redirected back to your App Service, enhancing the overall usability of your application.
Single Sign-On (SSO): App registration supports single sign-on capabilities, streamlining the user experience across various Azure services, including your App Service. Once authenticated, users can seamlessly access multiple resources without the need for repeated logins.

App registration in Azure is the linchpin for securing, integrating, and scaling your application, and its close relationship with your App Service ensures a cohesive and robust application environment within the Azure ecosystem. By configuring app registration settings appropriately, you not only enhance the security of your App Service but also enable seamless collaboration with other Azure services, contributing to a more efficient and user-friendly application experience.

What are the Steps for App Registration in Azure?

To register an app in Azure, we need to follow the below steps:

Navigate to Azure Portal: Access the Azure portal, the central hub for managing your Azure resources. Once logged in, select the Azure Active Directory service.
Access App Registrations: Within the Azure Active Directory, locate and select “App registrations” or “Azure AD App registrations,” depending on the version of the portal. This is the gateway to managing and creating application registrations.
Initiate New Registration: Click on the “New registration” button. This prompts you to provide essential details about your application, such as its name, supported account types (single or multi-tenant), and the redirect URI.
Configure Authentication: In the newly created application, configure authentication settings. This involves defining how users or services will authenticate with your application. Common methods include client secrets, certificates, and redirect URIs for web applications.
Assign API Permissions: Grant your application the necessary permissions to access Azure resources. This step ensures that your app has the right to perform specific actions, such as reading user profiles or managing resources.
Retrieve Application ID and Tenant ID: After successful registration, note down the Application (Client) ID and the Directory (Tenant) ID. These identifiers are crucial for your application to authenticate with Azure services.
Generate Client Secrets or Certificates: Depending on your authentication method, create client secrets or upload certificates to secure the communication between your application and Azure services.
Configure Redirect URIs: If your application involves user authentication, configure the redirect URIs to ensure that users are redirected appropriately after authentication.

Demo: Register a sample app in Azure step by step

If you don’t have your Microsoft Developer Programme Free Subscription, create a trial tenant by referring to this article: Create Free Microsoft 365 developer program account step by step.

Now let’s register a sample app, practically following the above steps.

Login to Azure Portal

Step 1: Login to Azure Portal.

Create a new app registration

Step 2: Search for “App Registration” service.

App registration services in AzureClick on the “App registrations” service link.

Click on the “+ New registration” link.

Create a new app registration in Azure portal

Enter the name of the application, it is recommended to provide user friendly name. The user-facing display name for this application (this can be changed later).

Select the default supported account type: Accounts in this organizational directory only (MSFT only – Single tenant); however, you may select other account types as well. Each type of account description is given below:

Supported account types

Who can use this application or access this API?

Accounts in this organizational directory only (MSFT only – Single tenant)
Accounts in any organizational directory (Any Microsoft Entra ID tenant – Multitenant)
Accounts in any organizational directory (Any Microsoft Entra ID tenant – Multitenant) and personal Microsoft accounts (e.g. Skype, Xbox)
Personal Microsoft accounts only

Then, click on the “Register” button.

We will get into the app registration overview page.

On this screen, we can see the application (client) ID. Also called the client ID, this value uniquely identifies your application on the Microsoft identity platform. So, we need to note down this value in Notepad or any other editor for further use. This application’s code, or more typically, an authentication library used in your application, also uses the client ID. The ID is used as part of validating the security tokens it receives from the identity platform.

Note:

If you are working with the SharePoint Online site and want to generate a client ID and secret for the application permission, you can do it from the SharePoint site itself. To achieve this, refer to this article: In 4 steps access SharePoint online data using postman tool

Add a redirect URI

Click on the “Add a Redirect URI” link from the “Redirect URIs” section.

Configure Platform Configurations

Depending on the platform or device this application is targeting, additional configuration may be required such as redirect URIs, specific authentication settings, or fields specific to the platform.

Click on the “+ Add a platform” link.

Platform configurations in Azure App registration

Then, click on the “Web” link.

Enter the redirect URI and refer to this redirect URI (reply URL) restrictions and limitations article.

Configure web redirect URI azure app registration

Click on the “Configure” button.

Add credentials – Add a client secret

Click on the “Certificate & Secrets” from the Authentication section.

Click on the “+ New client secret” link.

Enter the description of the client secret. Leave the expires selection as the default.

Copy this value before you leave this screen; otherwise, you will lose it and need to recreate it again. You can share this client secret ID value with a remote application to authenticate through the Azure app registration. For example, if you want to authenticate your Copilot Power virtual agent Chatbot through the Azure app registration, you need to configure this client secret ID value in Copilot Studio.

Copy client secret value from Azure app registration

Next step is to configure the API permissions.

API Permissions

Click on the “API Permissions” link from the left side menu.

Click on the “+ Add a permission” link.

Select your required APIs from the list.

Add an API permission in Azure App registration

Click on the “Grant admin consent for <your organization>” name.

Grant Admin Consent for your organization

Then, we will get the “Grant admin consent confirmation” message. Click on the “Yes” button.

Then, we can see the status of the “Grant admin consent for your organization”.

Admin consent status in Azure for API permissions

The next step is to expose an API.

Expose an API: Scopes defined by this API

Define custom scopes to restrict access to data and functionality protected by the API. An application that requires access to parts of this API can request that a user or admin consent to one or more of these. Adding a scope here creates only delegated permissions. If you are looking to create application-only scopes, use ‘App roles’ and define app roles assignable to application type.

To expose an API follow the below steps:

Click on the “Expose an API” link from the left side panel.

Click on the “+ Add a scope” link.

Expose an API to add a scope in Azure App registrationNote:

You’ll need to set an Application ID URI before you can add a permission. The tool has created one automatically for you, but you can change it, if you need.

The application ID URI format is as below:

api://<application-client-id>

Click on the “Save & Continue” button.

Refer to the below table and fill in the details in the “Add a scope” screen.

Field	Description	Example
Scope name	The name of your scope. A common scope naming convention is resource.operation.constraint.	Employees.Read.All
Who can consent	Whether this scope can be consented to by users or if admin consent is required. Select Admins only for higher-privileged permissions.	Admins and users
Admin consent display name	A short description of the scope’s purpose that only admins will see.	Read-only access to Employee records
Admin consent description	A more detailed description of the permission granted by the scope that only admins will see.	Allow the application to have read-only access to all Employee data.
User consent display name	A short description of the scope’s purpose. Shown to users only if you set Who can consent to Admins and users.	Read-only access to your Employee records
User consent description	A more detailed description of the permission granted by the scope. Shown to users only if you set Who can consent to Admins and users.	Allow the application to have read-only access to your Employee data.

Add a scope demo example:

Add a scope in Azure App registration expose an API

Click on the “Add scope” button.

Then, we can see the scopes details in the tabular format.

Scopes table in Azure app registration Expose an API

Summary: Understanding App Registration in Azure

Thus, in this article, we have learned what an app registration is in Azure and how to register an app in Azure step by step. We have also learned about other various processes in app registration, like how to configure authentication (client secret), API permissions, add a scope, expose an API, etc.

Understanding app registration is diving into the intricacies of how your application establishes its presence, gains authentication, and navigates the vast Azure landscape. It is the cornerstone of a secure, integrated, and scalable cloud computing experience, ensuring that your application not only meets its functional requirements but does so within the bounds of a well-defined and secure Azure environment.

App Registration in Azure: Quickly How Do I Register an Application Step by Step?