Register an application in Azure Entra (Entra ID / Azure AD): go to App Registrations, create a new registration, note the Application (client) ID and Directory (tenant) ID
Create a client secret under Certificates & Secrets (or upload a certificate — preferred for production); store the secret value securely; it is only shown once
Grant the required API permissions to the application registration under API Permissions; for application permissions (daemon flows) click Grant admin consent — without this, token requests succeed but API calls return 403
Request an access token by POSTing to https://login.microsoftonline.com/{tenant-id}/oauth2/v2.0/token with grant_type=client_credentials, client_id, client_secret (or client_assertion for certificate), and scope set to the target API's app URI followed by /.default (e.g., https://graph.microsoft.com/.default)
Parse the access_token from the JSON response and include it as a Bearer token in the Authorization header of downstream API calls; cache the token until the expires_in seconds have elapsed (typically 3600 s) and refresh proactively before expiry
For certificate-based auth, generate a signed JWT client assertion using your certificate private key and send it as client_assertion with client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-bearer
Known gotchas
The /.default scope is required for client credentials flow — specifying individual scopes (like User.Read) will return an error; all permissions must be pre-consented in the app registration
Client secrets have a maximum lifetime of 2 years in Entra; when a secret expires all authentications silently fail — set a calendar reminder or use certificate credentials with automated rotation instead
Conditional Access policies or Continuous Access Evaluation (CAE) can cause previously issued tokens to be revoked mid-flight; handle 401 responses by re-acquiring a token rather than treating them as permanent failures
Give your agent this knowledge — and 200+ more routes
One MCP install gives any agent live access to the full route map, with trust scores updated by agent consensus:
claude mcp add --transport http waymark https://mcp.waymark.network/mcp