--- title: Microsoft Entra ID credentials description: Documentation for the Microsoft Entra ID credentials. Use these credentials to authenticate Microsoft Entra ID in n8n, a workflow automation platform. contentType: [integration, reference] priority: medium --- # Microsoft Entra ID credentials You can use these credentials to authenticate the following nodes: * [Microsoft Entra ID](/08-0-0-Workflow/integrations/builtin/app-nodes/n8n-nodes-base.microsoftentra.md) ## Prerequisites - Create a Microsoft Entra ID account or subscription. - If the user account is managed by a corporate Microsoft Entra account, the administrator account has enabled the option “User can consent to apps accessing company data on their behalf” for this user (see the [Microsoft Entra documentation](https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/grant-admin-consent)). Microsoft includes an Entra ID free plan when you create a [Microsoft Azure](https://azure.microsoft.com/) account. ## Supported authentication methods - OAuth2 ## Related resources Refer to [Microsoft Entra ID's documentation](https://www.microsoft.com/en-us/security/business/identity-access/azure-active-directory) for more information about the service. ## Using OAuth2 ```{include} ../../../../_snippets/integrations/builtin/credentials/cloud-oauth-button.md ``` For self-hosted users, there are two main steps to configure OAuth2 from scratch: 1. [Register an application](#register-an-application) with the Microsoft Identity Platform. 2. [Generate a client secret](#generate-a-client-secret) for that application. Follow the detailed instructions for each step below. For more detail on the Microsoft OAuth2 web flow, refer to [Microsoft authentication and authorization basics](https://learn.microsoft.com/en-us/graph/auth/auth-concepts). ### Register an application Register an application with the Microsoft Identity Platform: 1. Open the [Microsoft Application Registration Portal](https://aka.ms/appregistrations). 2. Select **Register an application**. 3. Enter a **Name** for your app. 4. In **Supported account types**, select **Accounts in any organizational directory (Any Azure AD directory - Multi-tenant) and personal Microsoft accounts (for example, Skype, Xbox)**. 5. In **Register an application**: 1. Copy the **OAuth Callback URL** from your n8n credential. 2. Paste it into the **Redirect URI (optional)** field. 3. Select **Select a platform** > **Web**. 6. Select **Register** to finish creating your application. 7. Copy the **Application (client) ID** and paste it into n8n as the **Client ID**. Refer to [Register an application with the Microsoft Identity Platform](https://learn.microsoft.com/en-us/graph/auth-register-app-v2) for more information. ### Generate a client secret With your application created, generate a client secret for it: 1. On your Microsoft application page, select **Certificates & secrets** in the left navigation. 1. In **Client secrets**, select **+ New client secret**. 1. Enter a **Description** for your client secret, such as `n8n credential`. 1. Select **Add**. 1. Copy the **Secret** in the **Value** column. 1. Paste it into n8n as the **Client Secret**. 1. Select **Connect my account** in n8n to finish setting up the connection. 1. Log in to your Microsoft account and allow the app to access your info. Refer to Microsoft's [Add credentials](https://learn.microsoft.com/en-us/graph/auth-register-app-v2#add-credentials) for more information on adding a client secret. ### Microsoft Graph API Base URL Microsoft Entra ID credentials extend the Microsoft OAuth2 API credentials and support different Microsoft cloud environments. Select the appropriate endpoint based on your tenant's cloud environment: - **Global**: Use for standard Microsoft 365 tenants (default) - **US Government**: Use for Azure US Government (GCC) tenants - **US Government DOD**: Use for Azure US Government Department of Defense tenants - **China**: Use for Microsoft 365 operated by 21Vianet in China ```{warning} Government Cloud Authorization URLs If you're using a government cloud tenant, you may also need to update the **Authorization URL** and **Access Token URL** fields in your credential to use the government cloud endpoints. For example: - US Government: Use `https://login.microsoftonline.us/{tenant}/oauth2/v2.0/authorize` and `https://login.microsoftonline.us/{tenant}/oauth2/v2.0/token` - Replace `{tenant}` with your tenant ID or use `common` for multi-tenant apps ``` ## Setting custom scopes Microsoft Entra ID credentials use the following scopes by default: * [`openid`](https://learn.microsoft.com/en-us/entra/identity-platform/scopes-oidc#the-openid-scope) * [`offline_access`](https://learn.microsoft.com/en-us/entra/identity-platform/scopes-oidc#the-offline_access-scope) * [`AccessReview.ReadWrite.All`](https://learn.microsoft.com/en-us/graph/permissions-reference#accessreviewreadwriteall) * [`Directory.ReadWrite.All`](https://learn.microsoft.com/en-us/graph/permissions-reference#directoryreadwriteall) * [`NetworkAccessPolicy.ReadWrite.All`](https://learn.microsoft.com/en-us/graph/permissions-reference#networkaccesspolicyreadwriteall) * [`DelegatedAdminRelationship.ReadWrite.All`](https://learn.microsoft.com/en-us/graph/permissions-reference#delegatedadminrelationshipreadwriteall) * [`EntitlementManagement.ReadWrite.All`](https://learn.microsoft.com/en-us/graph/permissions-reference#entitlementmanagementreadwriteall) * [`User.ReadWrite.All`](https://learn.microsoft.com/en-us/graph/permissions-reference#userreadwriteall) * [`Directory.AccessAsUser.All`](https://learn.microsoft.com/en-us/graph/permissions-reference#directoryaccessasuserall) * [`Sites.FullControl.All`](https://learn.microsoft.com/en-us/graph/permissions-reference#sitesfullcontrolall) * [`GroupMember.ReadWrite.All`](https://learn.microsoft.com/en-us/graph/permissions-reference#groupmemberreadwriteall) To select different scopes for your credentials, enable the **Custom Scopes** slider and edit the **Enabled Scopes** list. Keep in mind that some features may not work as expected with more restrictive scopes. ## Common issues Here are the known common errors and issues with Microsoft Entra credentials. ```{include} ../../../../_snippets/integrations/builtin/credentials/microsoft-need-admin-approval.md ```