On this page

Entra ID Auth

Kind: EntraIdAuth
Configuration object: entraIdAuth

Use Entra ID Auth to acquire an access token for a selected resource authority and pass the auth object to a REST call. Authentication and resource permissions must already be configured for the host.

Inputs

The step uses its configured identity and resource authority. Incoming workflow data does not select the tenant, application, secret, or token audience. Secrets are supplied through protected runtime credential configuration.

Configuration

Property	Default	Usage
`cloud`	`AzureCommercial`	Cloud from the table below.
`tenantId`	`""`	Optional configured tenant GUID or verified tenant domain. Required where the chosen principal/host needs it.
`applicationId`	`""`	Optional nonempty service-principal application GUID, also selectable from Vault.
`credentialName`	`"ENTRA_AUTH"`	Runtime credential binding for protected principal configuration.
`resourceAuthority`	`""`	Empty selects that cloud's ARM audience. Otherwise use a valid HTTPS resource, `api://` application authority, or resource-application GUID.
`interactiveAuthentication`	`false`	Interactive Web preview through the host's configured SPA identity and tenant.
`useManagedIdentityInProduction`	`true`	Packaged production hosts use their managed identity. Disable to select principal configuration in production too.
`managedIdentityClientId`	`""`	Optional user-assigned managed-identity client GUID; empty selects system-assigned identity.
`customAuthorityHost`	`""`	Organization-provided authentication host for classified clouds. Must be a public HTTPS origin without path, query, fragment, or nondefault port.

The requested resource scope ends in /.default. If resourceAuthority already has that suffix, it is preserved.

Cloud	Authority host	Default resource authority
`AzureCommercial`	`https://login.microsoftonline.com`	`https://management.azure.com`
`AzureGovernment`	`https://login.microsoftonline.us`	`https://management.core.usgovcloudapi.net`
`AzureGovernmentDoD`	`https://login.microsoftonline.us`	`https://management.core.usgovcloudapi.net`
`AzureChina`	`https://login.chinacloudapi.cn`	`https://management.core.chinacloudapi.cn`
`AzureGovernmentSecret`	Organization-provided	Organization-provided
`AzureGovernmentTopSecret`	Organization-provided	Organization-provided

Resource-provider presets include Graph and its supported sovereign endpoints, Key Vault, Storage, SQL Database, Cosmos DB, AI Services, Foundry, Search, Monitor, Power BI, and Databricks. Changing the authentication cloud does not automatically rewrite downstream REST URLs. Use the endpoint and audience documented for that resource and cloud.

Outputs

Field	Meaning
`accessToken`	Runtime access token. Handle it as a secret.
`expiresOn`	Token expiration timestamp.
`tokenType`	`"Bearer"`.
`scope`	Requested resource scope.
`authority`	Selected authentication authority host.

Connect this output to REST call under inputName: "auth" and configure the REST token input as {{auth.accessToken}}. Token acquisition fails on an empty or expired result.

Example

{
  "id": "authenticate",
  "name": "Authorize an ARM read",
  "kind": "EntraIdAuth",
  "outputName": "auth",
  "entraIdAuth": {
    "cloud": "AzureCommercial",
    "credentialName": "ENTRA_AUTH",
    "resourceAuthority": "https://management.azure.com",
    "useManagedIdentityInProduction": true
  }
}

Connect it to a REST step with bearerToken set to {{auth.accessToken}}, credentialName set to "", authenticationHeader set to "Authorization", and authenticationPrefix set to "Bearer ". Leave the REST tokenScope unset.

Operational notes

Development principal configuration uses Credentials:<binding>:TenantId, ApplicationId, and ClientSecret. Production managed identities need resource permissions independently.

Interactive preview requires valid InteractiveEntra host settings. PWA principal preview uses the same-origin token backend for supported public clouds. Classified authorities require organization-provided endpoints, network access, and preview-session trust confirmation.

Tokens are redacted from Preview events and result archives. Keep auth objects out of prompts and persisted workflow input. Token-bearing runs start with fresh authentication.