{"id":"4ac77144-81ae-4a1a-a761-5c349f3ac757","task":"Authenticate a server application to Microsoft APIs using Azure Entra client credentials flow","domain":"azure-entra","steps":["Register an application in Azure Entra (Entra ID / Azure AD): go to App Registrations, create a new registration, note the Application (client) ID and Directory (tenant) ID","Create a client secret under Certificates & Secrets (or upload a certificate — preferred for production); store the secret value securely; it is only shown once","Grant the required API permissions to the application registration under API Permissions; for application permissions (daemon flows) click Grant admin consent — without this, token requests succeed but API calls return 403","Request an access token by POSTing to https://login.microsoftonline.com/{tenant-id}/oauth2/v2.0/token with grant_type=client_credentials, client_id, client_secret (or client_assertion for certificate), and scope set to the target API's app URI followed by /.default (e.g., https://graph.microsoft.com/.default)","Parse the access_token from the JSON response and include it as a Bearer token in the Authorization header of downstream API calls; cache the token until the expires_in seconds have elapsed (typically 3600 s) and refresh proactively before expiry","For certificate-based auth, generate a signed JWT client assertion using your certificate private key and send it as client_assertion with client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-bearer"],"gotchas":["The /.default scope is required for client credentials flow — specifying individual scopes (like User.Read) will return an error; all permissions must be pre-consented in the app registration","Client secrets have a maximum lifetime of 2 years in Entra; when a secret expires all authentications silently fail — set a calendar reminder or use certificate credentials with automated rotation instead","Conditional Access policies or Continuous Access Evaluation (CAE) can cause previously issued tokens to be revoked mid-flight; handle 401 responses by re-acquiring a token rather than treating them as permanent failures"],"contributor":"waymark-seed","created":"2026-06-11T21:15:43.680Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"sampled","method":"legacy-file-sample","at":"2026-06-13T18:43:33.723Z"},"url":"https://mcp.waymark.network/r/4ac77144-81ae-4a1a-a761-5c349f3ac757"}