---
title: Microsoft Entra
url: https://www.tines.com/stories/docs/credentials/workload-identity-federation/microsoft-entra/
updated: 2026-10-09T18:45:06+00:00
---

*[tines.com](https://www.tines.com/llms.txt) › [Docs](https://www.tines.com/stories/docs/llms.txt) › [Credentials](https://www.tines.com/llm/stories/docs/credentials.md) › [Workload identity Federation](https://www.tines.com/llm/stories/docs/credentials/workload-identity-federation.md)*

# Microsoft Entra

*[View on tines.com](https://www.tines.com/stories/docs/credentials/workload-identity-federation/microsoft-entra/)*

## Introduction

A Microsoft Entra credential authenticates as an app registration through [workload identity federation](https://www.tines.com/docs/credentials/workload-identity-federation). Tines signs a short-lived token for the credential and Microsoft Entra exchanges it for an access token for your app registration, so no client secret or certificate is stored in Tines. Use it for any API the app registration can be granted application permissions to, such as Microsoft Graph or Azure Resource Manager.

You can create the credential with the Microsoft Entra connect flow, which walks you through the steps below, or manually by choosing **Manual creation** and the **Microsoft Entra** credential type. Both show the same trust details.

## Creating a Microsoft Entra credential

### Step 1: Start the credential in Tines

From the credentials page, select **New credential** and choose **Microsoft Entra**, or choose **Manual creation** and then **Microsoft Entra**. Tines shows the credential's **Issuer URL**, **Subject identifier**, and **Audience** (`api://AzureADTokenExchange`, Microsoft's recommended value). Keep this open while you work in Microsoft Entra.

### Step 2: Add a federated credential to your app registration

1. In the [Microsoft Entra admin center](https://entra.microsoft.com/), open your app registration (or create one) and go to **Certificates & secrets › Federated credentials › Add credential**.
2. For the scenario, choose **Other issuer**.
3. Enter the issuer URL, subject identifier, and audience from Tines, give the federated credential a name, and select **Add**.

### Step 3: Grant permissions

Under **API permissions**, add the **Application** permissions your stories need and select **Grant admin consent**. Permissions are included in the token when it is issued, so grant them before connecting.

### Step 4: Enter the app details

Copy the values from the app registration's **Overview** page.

In the connect flow, enter the **Directory (tenant) ID** (the directory ID or a verified domain, e.g. `contoso.onmicrosoft.com`), the **Application (client) ID**, and the **Scope**.

In the manual form, enter the **Token endpoint** (the OAuth 2.0 token endpoint (v2) from the app registration's **Endpoints** list), the **Application (client) ID**, and the **Scope**.

The scope names the API the token is for, as a `/.default` scope: `https://graph.microsoft.com/.default` for Microsoft Graph, or `https://management.azure.com/.default` for Azure Resource Manager.

### Step 5: Save

Saving verifies the connection by requesting a token from Microsoft Entra.

## Using a Microsoft Entra credential

The credential's value is an access token for the scope you entered, renewed automatically. Use it as a bearer token in the `Authorization` header of an HTTP Request action:

```json
"Authorization": "Bearer <<CREDENTIAL.microsoft_entra>>"
```

To call more than one API, create a credential per scope.

## Test credentials

A test credential has its own subject identifier, the live subject with a `:test` suffix, so add a separate federated credential for it, typically on a non-production app registration. See [test credentials](https://www.tines.com/docs/credentials/workload-identity-federation#test-credentials).