Authenticate to Microsoft Dataverse using MSAL OAuth 2.0 client credentials flow

Steps

1. Register an application in Microsoft Entra ID (Azure AD); note the Application (client) ID, Directory (tenant) ID, and create a client secret or upload a certificate for the app.
2. Grant the app access to Dataverse: in the Azure portal, add the Dynamics CRM API permission 'user_impersonation' (for delegated) or configure the app as an Application User in Dataverse Power Platform Admin Center with a security role.
3. Create an Application User in the Dataverse environment: go to Power Platform Admin Center > Environment > Users > App Users, add the app registration, and assign an appropriate security role.
4. Use MSAL in your application to acquire a token: construct a ConfidentialClientApplication with the clientId, tenantId, and clientSecret; then call AcquireTokenForClient with scope ["https://<org>.crm.dynamics.com/.default"].
5. Include the returned access token in all Web API calls as an Authorization: Bearer <token> header; tokens are short-lived (typically 1 hour) — use MSAL's built-in token cache to avoid unnecessary re-authentication.
6. For multi-environment scenarios, parameterize the resource URL (https://<org>.crm.dynamics.com) and request a new token per environment since tokens are resource-scoped.