Log inSign upBook a demo
Tines Stories
  1. Docs
  2. Credentials
  3. Workload identity Federation
  1. Docs
  2. Credentials
  3. Workload identity Federation

Microsoft Entra

Last updated

Introduction

A Microsoft Entra credential authenticates as an app registration through workload identity federation. Tines signs a short-lived token for the credential and Microsoft Entra exchanges it for an access token for your app registration, so no client secret or certificate is stored in Tines. Use it for any API the app registration can be granted application permissions to, such as Microsoft Graph or Azure Resource Manager.

You can create the credential with the Microsoft Entra connect flow, which walks you through the steps below, or manually by choosing Manual creation and the Microsoft Entra credential type. Both show the same trust details.

Creating a Microsoft Entra credential

Step 1: Start the credential in Tines

From the credentials page, select New credential and choose Microsoft Entra, or choose Manual creation and then Microsoft Entra. Tines shows the credential's Issuer URL, Subject identifier, and Audience (api://AzureADTokenExchange, Microsoft's recommended value). Keep this open while you work in Microsoft Entra.

Step 2: Add a federated credential to your app registration

  1. In the Microsoft Entra admin center, open your app registration (or create one) and go to Certificates & secrets › Federated credentials › Add credential.

  2. For the scenario, choose Other issuer.

  3. Enter the issuer URL, subject identifier, and audience from Tines, give the federated credential a name, and select Add.

Step 3: Grant permissions

Under API permissions, add the Application permissions your stories need and select Grant admin consent. Permissions are included in the token when it is issued, so grant them before connecting.

Step 4: Enter the app details

Copy the values from the app registration's Overview page.

In the connect flow, enter the Directory (tenant) ID (the directory ID or a verified domain, e.g. contoso.onmicrosoft.com), the Application (client) ID, and the Scope.

In the manual form, enter the Token endpoint (the OAuth 2.0 token endpoint (v2) from the app registration's Endpoints list), the Application (client) ID, and the Scope.

The scope names the API the token is for, as a /.default scope: https://graph.microsoft.com/.default for Microsoft Graph, or https://management.azure.com/.default for Azure Resource Manager.

Step 5: Save

Saving verifies the connection by requesting a token from Microsoft Entra.

Using a Microsoft Entra credential

The credential's value is an access token for the scope you entered, renewed automatically. Use it as a bearer token in the Authorization header of an HTTP Request action:

"Authorization": "Bearer <<CREDENTIAL.microsoft_entra>>"

To call more than one API, create a credential per scope.

Test credentials

A test credential has its own subject identifier, the live subject with a :test suffix, so add a separate federated credential for it, typically on a non-production app registration. See test credentials.

Was this helpful?