Copyright (c) 2026 MindMesh Academy. All rights reserved. This content is proprietary and may not be reproduced or distributed without permission.

4.3.1. Planning and Creating App Registrations

💡 First Principle: The registration's first three questions decide most of its security posture: who is the audience? (supported account types), where may tokens land? (platform + redirect URIs), and how does the app authenticate itself? (credentials). Answer them deliberately and the defaults do no harm.

Supported account types: single tenant (this directory only — default and usually right), multitenant (any Entra org), multitenant + personal Microsoft accounts, personal only. This sets the signInAudience and governs which endpoints (/tenant-id vs /organizations vs /common) the app uses. Platform & redirect URIs: register exact URIs per platform (web, SPA, mobile/desktop); Entra will only deliver codes/tokens to registered URIs — HTTPS required, no wildcards in production patterns; SPAs use the auth-code-with-PKCE flow registered under the SPA platform. Stale or overly-broad redirect URIs are token-theft vectors; review them like firewall rules.

Credentials prove the app's identity in confidential flows: client secrets (strings with expiry — max lifetimes short; fine for dev) vs certificates (asymmetric, no shared secret transmitted — production answer) vs federated credentials (4.1.1's zero-secret pattern for external platforms). Public clients (mobile/desktop) hold no credential at all — flows are designed accordingly. Remaining contract pieces: branding & publisher verification (verified publisher badge feeds consent policies), token configuration (optional claims like groups), and the manifest for everything the UI doesn't surface.

Ownership discipline mirrors 4.2.4: registration owners can add credentials → treat owners of privileged registrations as privileged accounts.

⚠️ Exam Trap: "The app must be usable by our tenant only" + a portal screenshot with /common endpoint or multitenant selected = misconfiguration stem; conversely "partner organizations must sign in to our product" requires multitenant and their admins' consent — single tenant is the wrong economy there.

Reflection Question: Why are redirect URIs enforced as an exact-match allowlist rather than a domain suggestion — describe the attack that a lax "any path on our domain" policy would enable.

See how it connects
Alvin Varughese
Written byAlvin Varughese
Founder18 professional certifications