OAuthseus

Microsoft 365 / Microsoft Graph (Outlook mail, OneDrive, Teams, Calendar)

Curated guide, researched and checked, updated 2026-10-30 · learn.microsoft.com/graph

Download Markdown
Moderate

About an hour to register and test; ~1 week to become a verified publisher; then each enterprise customer's admin must grant consent for mail/calendar/files access (timeline set by the customer, not Microsoft)

Registering a Microsoft Entra app (App registrations > New registration) is self-serve and takes 30-60 minutes, with no Microsoft review of your app or scopes. The real gate is consent inside each customer's tenant: the Microsoft-managed default consent policy (the default for new tenants) no longer lets end users consent to Mail, Calendars, Chat, Files.Read.All, Sites.Read.All and similar Graph scopes, so a B2B agent that reads Outlook mail or calendars needs a tenant admin to grant admin consent in practically every customer org. Publisher verification (free, via a verified Microsoft AI Cloud Partner Program account; Partner Center verification usually 3-5 business days) removes the 'unverified' warning and risk-based step-up blocks, but it does not by itself unlock those high-impact scopes.

How long until your users can connect

Depends on who connects and what you ask for
Your work: 2–6 hoursWaiting on provider: 3–7 daysUsers can connect

Default path assumed: a multitenant B2B agent with a verified publisher. Microsoft does not review your app or scopes. The only Microsoft-side wait is Partner Center business verification for your AI Cloud Partner Program account (Microsoft: 'three to five business days' in most cases); linking the Partner One ID to the app then takes minutes. After that, each customer tenant's admin must grant consent for high-impact Graph scopes; that review time is entirely up to the customer and Microsoft publishes no figure for it.

Choose your launch path to filter the steps

Do these first

  1. 1Decide your audience: 'Multiple Entra ID tenants' for a B2B agent, plus personal accounts only if you need outlook.com users
  2. 2Register the app in a tenant on your real company domain, add a Web redirect URI and a certificate (or a 12-month secret for dev), and add delegated Graph scopes
  3. 3Start Microsoft AI Cloud Partner Program enrollment now; Partner Center verification typically takes 3-5 business days
  4. 4Assume work-tenant customers will need admin consent for Mail/Calendar/Files/Chat and build the admin onboarding flow before launch
  5. 5Test in a second tenant with 'Do not allow user consent' to see the experience locked-down customers get

What you're actually registering

App registration (application object) in a Microsoft Entra tenant, plus one service principal ('Enterprise application') per tenant that uses it. You create one app registration in your home tenant; its Application (client) ID is used by every customer. When a user or admin in another tenant consents, Entra creates a service principal (shown under Enterprise apps) for your app in that tenant and records the delegated grant there. Each end-user connection is a delegated OAuth grant plus a per-user refresh token; application permissions are granted per tenant (admin only) and let the app act without a user via the client credentials flow. Since March 2026 a non-Microsoft multitenant app must have a service principal in every tenant where it authenticates, so app-only access always needs a consent or provisioning step in the customer tenant first.

Request offline_access to get refresh tokens. Default refresh token lifetime is 90 days (24 hours for redirect URIs registered as Single-page application). Refresh tokens rotate on every use; store the newest one. Tokens are revoked on admin or user revocation and on some password resets. Use the /common or /organizations authority for multitenant sign-in, then cache per tenant. Client secrets max out at 24 months (Microsoft recommends under 12) and the value is shown only once; certificates or federated credentials are recommended for production.

What you'll need

  • Microsoft Entra tenant + account with at least Application Developer role

    Any Entra tenant works (for example the Default Directory created with an Azure account). Register with a work or school (Entra) account: apps registered with a personal Microsoft account cannot be publisher verified.

  • Redirect URI(s) per platform

    HTTPS required except http://localhost (port ignored for localhost matching). Max 256 URIs (work/school audiences) or 100 (when personal accounts are included); max 256 characters each; no query parameters for personal-account audiences; wildcards only via the manifest and only for work/school audiences (discouraged).

  • Client credential: certificate (recommended) or client secret (max 24 months)

    Confidential web backends need a credential. Client secrets cannot exceed 24 months; Microsoft recommends under 12 and says not to use secrets in production. Some tenants block secrets with app management policies.

  • Publisher domain (DNS-verified custom domain)

    Set under Branding & properties. Must match (or the tenant must have DNS-verified) the domain of the email used for Partner Center verification; *.onmicrosoft.com is not accepted for publisher verification. A new domain can be verified by hosting /.well-known/microsoft-identity-association.json.

  • Verified Microsoft AI Cloud Partner Program (formerly MPN) account: Partner One ID of the partner global account (PGA)

    Free. Requires business verification in Partner Center (email, identity, employment via domain documents, legal business registration). The PGA ID must be used, not a location ID. The Entra tenant must be associated with the PGA. Initiator needs Application Administrator or Cloud Application Administrator in Entra plus Partner Admin/Account Admin in Partner Center, and must sign in with MFA.

  • Admin consent onboarding flow and customer-facing permissions justification

    For Mail.*, Calendars.*, Chat.*, OnlineMeetings.*, Files.Read.All, Sites.Read.All and all application permissions, plan for a tenant admin to consent via the admin consent URL or Enterprise apps > Permissions. Document exactly why each scope is needed.

  • Microsoft 365 Publisher Attestation / Microsoft 365 Certification (optional)

    Publisher Attestation is a self-assessment ('most... in one hour or less'). Microsoft 365 Certification is an annual independent audit including penetration testing, contracted and paid through Claranet. Neither is required by Microsoft for Graph OAuth, but some customer tenants require it before enabling an app.

  • Test tenant with M365 mailboxes/Teams (Microsoft 365 Developer Program sandbox or a paid tenant)

    The free E5 sandbox (25 licenses, renewable 90-day subscription) is now only for qualifying members: Visual Studio Professional/Enterprise subscribers, ISV Success / eligible AI Cloud Partner Program tiers, or Premier/Unified Support customers. Setup also requires linking an MCA billing account with an active Azure subscription. Otherwise use a low-cost Microsoft 365 Business trial or paid tenant (an Entra-only tenant has no Exchange mailboxes to test Outlook mail against).

Step by step

11 steps
  1. 1

    Get a tenant to develop and test in

    About 15–120 min

    You do this

    Requires your own sign-in, eligibility checks, identity verification and billing-account linking, which an agent must not do.

    1. If you have a work Entra tenant where you hold at least Application Developer, you can register the app there. For testing mail, calendar and Teams you need users with Microsoft 365 licenses.
    2. If you have Visual Studio Professional/Enterprise, an eligible AI Cloud Partner Program/ISV Success membership, or Premier/Unified Support, join the Microsoft 365 Developer Program and select 'Set up E5 subscription' on the dashboard (instant sandbox with 25 users and sample mail/calendar data).
    3. Be ready to link a Microsoft Customer Agreement billing account with an active Azure subscription; it's mandatory for sandbox setup, but the sandbox itself is free.
    4. If you're not eligible, use a Microsoft 365 Business trial or a small paid tenant. Use a separate test tenant from your production publisher tenant if you want to exercise the cross-tenant consent experience.
    Microsoft 365 Developer Program FAQ (eligibility)Developer Program dashboardPointer ready: highlights “Set up E5 subscription”
  2. 2

    Register the app (App registrations > New registration)

    About 5–15 min

    You do this

    Requires your Entra sign-in. An agent can tell you the name and account-type choice and could do it with Microsoft Graph or the Azure CLI if you give it an already-authenticated session.

    1. Sign in to the Microsoft Entra admin center (entra.microsoft.com) as at least Application Developer. If you have several tenants, use the Settings icon to switch to the right one.
    2. Browse to Entra ID > App registrations and select 'New registration'.
    3. Enter a Name (users see it on the consent screen; you can change it later).
    4. Under 'Supported account types', pick: 'Single tenant only - <your tenant>' (internal), 'Multiple Entra ID tenants' (B2B SaaS agent), 'Any Entra ID Tenant + Personal Microsoft accounts' (B2B + consumers), or 'Personal accounts only'.
    5. Optionally add the first redirect URI now, or skip it and do it in the next step. Select 'Register'.
    6. On the Overview page, copy the 'Application (client) ID' and 'Directory (tenant) ID'.
    Supported account types
    Multiple Entra ID tenants
    Default recommendation for a B2B agent. Add personal accounts only if you need outlook.com users; doing so tightens redirect URI rules.
    Authority in your code
    https://login.microsoftonline.com/organizations (work/school only) or /common (work/school + personal)
    Register an app in Microsoft Entra IDConvert single-tenant app to multitenantPointer ready: highlights “App registrations”
  3. 3

    Add redirect URIs (Authentication > Add Redirect URI)

    About 5–15 min

    Agent prepares, you submit

    An agent can compute the exact callback URLs from your code; pasting them into the portal needs your session.

    1. In the app registration, under Manage select 'Authentication'.
    2. On the 'Redirect URI configuration' tab select 'Add Redirect URI'.
    3. In 'Select a platform to add redirect URI' choose 'Web' for a server-side agent backend (confidential client, gets 90-day refresh tokens). Use 'Single-page application' only for browser-only code (24-hour refresh tokens). Use 'Mobile and desktop applications' for native or CLI clients.
    4. Enter the redirect URI (HTTPS; http://localhost is allowed for development) and select 'Configure'.
    5. Use separate app registrations for dev and prod so localhost URIs don't ship to production.
    Redirect URI (Web)
    https://<your-domain>/oauth/microsoft/callback
    Must match exactly and is case-sensitive. Max 256 characters.
    Redirect URI (local dev)
    http://localhost:3000/oauth/microsoft/callback
    Port is ignored when matching localhost URIs.
    How to add a redirect URIRedirect URI restrictions and limitationsPointer ready: highlights “Authentication”
  4. 4

    Create a client credential (Certificates & secrets)

    About 5–20 min

    You do this

    The secret value is shown once and must go straight into your secret store; a human should handle it. An agent can generate a self-signed test certificate locally for you to upload.

    1. In the app registration select 'Certificates & secrets'.
    2. Recommended for production: on 'Certificates' select 'Upload certificate' (.cer, .pem or .crt), select 'Add', and record the Thumbprint.
    3. For development: on 'Client secrets' select 'New client secret', add a description, choose an expiry (24 months maximum; Microsoft recommends under 12), and select 'Add'.
    4. Copy the secret 'Value' (not the Secret ID) immediately; it is never displayed again. Put the expiry date in your calendar or monitoring.
    5. If the portal says client secrets are blocked by a tenant-wide policy, your tenant has an app management policy; use a certificate instead.
    Add and manage app credentialsPointer ready: highlights “Certificates & secrets”
  5. 5

    Add Microsoft Graph permissions (API permissions > Add a permission)

    About 10–30 min

    Agent prepares, you submit

    An agent can choose the least-privilege scope list from your feature set; clicking them in requires your session.

    1. Select 'API permissions' > 'Add a permission' > 'Microsoft Graph'.
    2. Choose 'Delegated permissions' for an agent that acts as the signed-in user (the normal case). Choose 'Application permissions' only for background or daemon access to all mailboxes/files in a tenant; these always need tenant admin consent, and for Graph only a Privileged Role Administrator or Global Administrator can grant them.
    3. Under 'Select permissions' add the minimum set, for example openid, profile, offline_access, User.Read, plus what you need: Mail.Read / Mail.Send, Calendars.ReadWrite, Files.Read (own OneDrive) rather than Files.Read.All, Chat.Read, OnlineMeetings.Read.
    4. Select 'Add permissions'. The list under 'Configured permissions' is what users and admins see at consent.
    5. You can also request extra scopes dynamically at runtime. Keep the static list small, because it is what the admin reviews.
    Typical delegated scopes for an email/calendar agent
    openid profile offline_access User.Read Mail.Read Mail.Send Calendars.ReadWrite
    Mail.* and Calendars.* are excluded from user consent under the Microsoft-managed default policy, so expect admin consent in work tenants.
    Configure app access to web APIs / Microsoft GraphMicrosoft Graph permissions referencePointer ready: highlights “API permissions”
  6. 7

    Set a verified publisher domain (Branding & properties)

    About 10–60 min

    Agent prepares, you submit

    An agent can generate and deploy microsoft-identity-association.json to your site; selecting the domain in the portal needs your session.

    1. Make sure your company domain (the one in the email you will use for Partner Center) is a DNS-verified custom domain in the tenant, or verify it as the publisher domain directly.
    2. In the app registration open 'Branding & properties'. Under 'Publisher domain' choose 'Configure a domain' (or 'Update domain').
    3. Choose 'Select a verified domain' if the tenant already has it; otherwise choose 'Verify a new domain', host https://<domain>/.well-known/microsoft-identity-association.json with your application ID, and select 'Verify and save domain'.
    4. The publisher domain cannot be *.onmicrosoft.com if you want publisher verification.
    /.well-known/microsoft-identity-association.json
    {"associatedApplications":[{"applicationId":"<your-client-id>"}]}
    Serve as application/json.
    Configure an app's publisher domainPointer ready: highlights “Branding & properties”
  7. 8

    Enroll in the Microsoft AI Cloud Partner Program and pass Partner Center verification

    About 30–90 min

    You do this

    Involves legal business details, government-ID identity verification and accepting agreements; a human must do it. An agent can prepare the document checklist.

    1. Using a work account in the same Entra tenant as the app (or associate that tenant later), enroll your company in the Microsoft AI Cloud Partner Program in Partner Center. Membership needed for verification is free.
    2. Use a business email on your company domain (not a free email). It must match the app's publisher domain or a DNS-verified domain in the tenant.
    3. Have ready: business registration or incorporation documents and domain registrar documentation showing business name, address and dates. Make sure names and addresses match official records exactly.
    4. Track status under Account settings > Legal info > Verification Summary. Answer any 'Pending User Action' requests quickly; only the primary contact gets these emails.
    5. Once 'Authorized', note the Partner One ID of the partner global account (PGA), not a location ID.
    Publisher verification requirementsUnderstand the Partner Center verification processPartner Center Legal infoPointer ready: highlights “Legal info”
  8. 9

    Mark the app as publisher verified (Add Partner ID to verify publisher)

    About 5–15 min

    You do this

    Requires MFA sign-in by a user with Application Administrator or Cloud Application Administrator in Entra and Partner Admin/Account Admin in Partner Center.

    1. Sign in with MFA to the Entra admin center. Open App registrations > your app > 'Branding & properties'.
    2. Confirm the Publisher domain is set (previous step).
    3. Select 'Add Partner ID to verify publisher' near the bottom, review the requirements, enter your Partner One ID and select 'Verify and save'.
    4. Wait a few minutes. On success a blue verified badge appears next to 'Publisher display name'. Re-test with prompt=consent to see the badge on the consent prompt.
    5. Repeat for every app registration (for example separate prod and staging apps), or do it in bulk with Microsoft Graph.
    Mark an app as publisher verifiedTroubleshoot publisher verificationPointer ready: highlights “Branding & properties”
  9. 11

    (Optional) Publisher Attestation or Microsoft 365 Certification

    About 1–40 hours

    You do this

    Requires Partner Center access, legal attestations and (for certification) a paid audit contract. An agent can draft the attestation answers and collect evidence.

    1. Start with Publisher Attestation: a self-assessment of security, data handling and compliance, published on Microsoft Learn. Microsoft says most take an hour or less.
    2. If enterprise customers or the Teams Admin portal reviewers require it, pursue Microsoft 365 Certification: an annual independent audit (application security, operational security, data handling/privacy, including penetration testing). Contract the audit through Claranet.
    3. Consider ACAT (App Compliance Automation Tool in the Azure portal) to automate evidence if you host on Azure or AWS.
    Microsoft 365 App Compliance Program overviewPublisher AttestationMicrosoft 365 CertificationPointer ready: highlights “Microsoft 365 and Copilot”

What can block you, and the way around

  • Users see 'Need admin approval' for Mail.Read / Calendars / Files.Read.All even though the scopes don't say 'Admin consent required'

    You'll see: Work-account users in a customer tenant can't self-consent to scopes that Graph marks as user-consentable (e.g. Mail.Read, Calendars.ReadWrite, Chat.Read, Files.Read.All, Sites.Read.All). The prompt asks for admin approval.

    Do this: This is the Microsoft-managed default user consent policy ('Let Microsoft manage your consent settings'), which is the default for new tenants and excludes these scopes. Publisher verification does not lift it. Route the customer's admin to the admin consent URL, or ask them to enable the admin consent workflow. Where possible, use narrower scopes (Files.Read instead of Files.Read.All; Files.ReadWrite.AppFolder) that aren't excluded.

  • AADSTS90094 / risky-app step-up for unverified multitenant apps

    You'll see: Users in other tenants see that the app is from an unverified publisher and can't consent. Error AADSTS90094 says an admin must grant permission.

    Do this: Complete publisher verification (Partner One ID + verified publisher domain). Risk-based step-up is on by default, so it applies to multitenant apps registered after November 8, 2020 that request more than basic sign-in and profile scopes.

  • Publisher verification fails: domain mismatch or onmicrosoft.com

    You'll see: 'Verify and save' errors, or the Partner ID is rejected.

    Do this: The publisher domain must not be *.onmicrosoft.com. The domain of the email used for Partner Center verification must equal the publisher domain or be a DNS-verified custom domain in the tenant. Use the PGA Partner One ID (not a location ID), and associate the app's tenant with the PGA if it isn't the primary tenant. The initiating user needs both the Entra and Partner Center roles and must sign in with MFA. Apps registered with a personal Microsoft account can't be verified; re-register in an Entra tenant.

  • Partner Center business verification stuck or rejected

    You'll see: Verification Summary shows 'Pending User Action' or 'Not Verified' for employment or business verification.

    Do this: Upload domain-registrar documents and business registration documents whose name and address exactly match the account (no abbreviations). Use a business email, not a free one. Respond quickly; only the primary contact gets requests. Submit an appeal if rejected.

  • Application permissions can't be approved by the customer's Application Administrator

    You'll see: The customer admin sees 'Grant admin consent' but can't approve Graph application permissions (e.g. Mail.Read app-only).

    Do this: Graph app roles need a Privileged Role Administrator (or Global Administrator). Admin consent workflow reviewers likewise can't approve Graph application permissions unless they're Global Administrators. Prefer delegated permissions for user-driven agents.

  • AADSTS50011 redirect URI mismatch

    You'll see: Sign-in fails with 'The reply URL specified in the request does not match the reply URLs configured for the application'.

    Do this: Register the exact URI (case-sensitive path, correct platform type) on the application object. Watch trailing-slash behavior for URIs with no path, the http vs https scheme (http only for localhost), and the platform: a 'Web' URI used from SPA code fails CORS token redemption.

  • Expired client secret silently breaks all connections

    You'll see: Token requests start failing with invalid_client after 6-24 months.

    Do this: Secrets are capped at 24 months. Add a second secret before expiry and roll over, or move to a certificate / federated credential. Alert on the expiry date.

  • Can't get a free Microsoft 365 developer sandbox

    You'll see: The Developer Program dashboard doesn't offer 'Set up E5 subscription', or sandbox setup is blocked at billing configuration.

    Do this: The sandbox is now limited to Visual Studio Pro/Enterprise subscribers, eligible AI Cloud Partner Program / ISV Success members, and Premier/Unified Support customers. It also requires an MCA billing account with an active Azure subscription. Otherwise use a Microsoft 365 Business trial or a paid tenant for testing.

  • Customer tenant blocks your app via sign-in audience or app management policies

    You'll see: Your app works in most tenants but a customer reports blocked sign-in. Or you can't create a multitenant registration in a corporate tenant.

    Do this: Organizations can use app management policies (Workload ID Premium) to block creation of multitenant or personal-account apps in their own tenant. If your company's tenant does this, register the publisher app in a dedicated tenant you control. Customers can also scope or disable your service principal. Ask them to check Enterprise apps.

What we checked

0 tested 33 documented 1 inferred 1 unverified
  • CorrectedUser consent default: can users consent to Mail.Read / Calendars / Files.Read.All?Common advice says Mail.Read and Calendars.Read 'don't require admin consent' because Graph marks them user-consentable. Current Microsoft Learn (manage-app-consent-policies, updated 2026-08) says the Microsoft-managed policy, which is the default for new tenants, excludes Mail.*, Calendars.*, Chat.*, OnlineMeetings.*, Contacts.ReadWrite, Tasks.*, People.Read, Files.Read.All, Sites.Read.All and EWS/IMAP/POP scopes from user consent. Admin consent is therefore effectively required for email/calendar agents in default-configured tenants.Read against official docs, 2026-10-30
  • CorrectedNov 2020 'users can't consent to unverified multitenant apps' ruleThe rule is conditional, not absolute: it applies when risk-based step-up consent is enabled (enabled by default), to apps registered after Nov 8, 2020 that request more than basic sign-in/profile from other tenants, and it only changes behavior when user consent is enabled. The result is step-up to admin consent with AADSTS90094.Read against official docs, 2026-10-30
  • ConfirmedClient secret maximum lifetime24 months maximum (custom lifetimes beyond that are not allowed); Microsoft recommends under 12 months and says secrets should not be used in production.Read against official docs, 2026-10-30
  • ConfirmedPublisher verification requirements and costRequires the verified PGA Partner One ID of the Microsoft AI Cloud Partner Program (formerly MPN), a publisher domain that isn't onmicrosoft.com and matches the verification email domain, Entra + Partner Center roles, and MFA. It's free, needs no license, and is 'verified in minutes' once prerequisites are met. Not supported in national clouds or Azure AD B2C.Read against official docs, 2026-10-30
  • ConfirmedHow long Partner Center (MPN) verification takesThe Partner Center doc (2026-07-27) says 'three to five business days' in most cases, longer if additional review is needed.Read against official docs, 2026-10-30
  • CorrectedFree Microsoft 365 E5 developer sandbox availabilityOlder advice says anyone can get a free renewable E5 developer tenant. The current FAQ (2026-09) limits it to Visual Studio Pro/Enterprise subscribers, eligible AI Cloud Partner Program/ISV Success tiers, and Premier/Unified Support customers. It requires linking an MCA billing account with an active Azure subscription, lasts up to 90 days (renewable if still eligible), and has 25 licenses.Read against official docs, 2026-10-30
  • Couldn't verifyRestriction on creating multitenant apps / new-tenant requirementsNo Microsoft Learn page found imposing a blanket restriction on multitenant app creation. What we found: (1) the registration quickstart now recommends single tenant for most apps; (2) since March 31, 2026, non-Microsoft multitenant apps can't authenticate in a tenant without a service principal there (retire-service-principal-less-authentication); (3) admins can block multitenant/personal-account app creation through app management policies (beta, Workload ID Premium).Read against official docs, 2026-10-30
  • CorrectedAccount-type and redirect URI UI labelsThe register quickstart (2026-05-14) lists 'Single tenant only - <your tenant>', 'Multiple Entra ID tenants', 'Any Entra ID Tenant + Personal Microsoft accounts' and 'Personal accounts only', replacing 'Accounts in this organizational directory only' etc. The redirect URI doc now says 'Redirect URI configuration' tab > 'Add Redirect URI' instead of 'Add a platform'. Navigation is 'Entra ID > App registrations', not 'Identity > Applications > App registrations'.Read against official docs, 2026-10-30
  • ConfirmedRefresh token lifetime90 days default; 24 hours for SPA redirect URIs. Tokens rotate on use.Read against official docs, 2026-10-30
  • ConfirmedWho can grant admin consent for Graph application permissionsPrivileged Role Administrator (or Global Administrator) for Graph app roles. Cloud Application Administrator, AI Administrator and Application Administrator can grant everything except Microsoft Graph app roles.Read against official docs, 2026-10-30
  • ConfirmedAutomated: developer console (https://entra.microsoft.com/#view/Microsoft_AAD_RegisteredApps/ApplicationsListBlade)Loaded: "Microsoft Entra admin center".Live HTTP probe, 2026-10-30
  • ConfirmedAutomated: OIDC discovery document (https://login.microsoftonline.com/common/v2.0/.well-known/openid-configuration)Discovery document found. authorization_endpoint=https://login.microsoftonline.com/common/oauth2/v2.0/authorize; token_endpoint=https://login.microsoftonline.com/common/oauth2/v2.0/token; PKCE methods: not advertised; scopes: openid, profile, email, offline_access.Live HTTP probe, 2026-10-30
  • ConfirmedAutomated: authorize endpoint with a fake client_id (https://login.microsoftonline.com/common/oauth2/v2.0/authorize)Endpoint answered HTTP 200 ("Sign in to your account").Live HTTP probe, 2026-10-30
  • ConfirmedAutomated: 34 quotes re-fetched and matched against their cited pages34 of 34 quotes found verbatim in the live page HTML. 21/21 source URLs returned HTTP 200.Read against official docs, 2026-10-30

What we couldn't confirm

  • Microsoft publishes no turnaround time for customer admin consent; it depends on each organization's IT review. We found no reliable community figures.
  • Microsoft 365 Certification duration and cost are not published on the Microsoft pages we read. The audit is contracted with Claranet and repeats yearly.
  • We found no Microsoft Learn source for a blanket restriction on creating multitenant apps in new tenants. The current registration guide only recommends single tenant 'for most applications'. Tenant-level app management policies (Workload ID Premium) and a reported preview 'Allow only certain tenants' option (community source) exist but weren't fully verified.
  • Whether verified publishers are exempt from the Microsoft-managed exclusions (Mail, Calendars, Files.Read.All, etc.) isn't stated. The doc lists no exemption, so we assume they aren't. Tenants on custom or legacy consent settings may behave differently.
  • UI labels are mid-transition: the registration quickstart (May 2026) uses 'Single tenant only' / 'Multiple Entra ID tenants' and 'Add Redirect URI', while other pages still say 'Accounts in any organizational directory', 'Add a platform' and 'Branding'. The Chrome pointer may need both variants.
  • Partner Center verification can exceed 3-5 business days when additional review is triggered; no upper bound is published.
  • We did not exercise the console. All labels come from documentation only.

Sources

  1. s1How to register an app in Microsoft Entra ID (official docs, accessed 2026-10-30)
  2. s2Publisher verification overview (official docs, accessed 2026-10-30)
  3. s3Mark an app as publisher verified (official docs, accessed 2026-10-30)
  4. s4Add and manage app credentials in Microsoft Entra ID (official docs, accessed 2026-10-30)
  5. s5Configure how users consent to applications (official docs, accessed 2026-10-30)
  6. s6Manage app consent policies (official docs, accessed 2026-10-30)
  7. s7Configure the admin consent workflow (official docs, accessed 2026-10-30)
  8. s8Grant tenant-wide admin consent to an application (official docs, accessed 2026-10-30)
  9. s9Configure risk-based step-up consent (official docs, accessed 2026-10-30)
  10. s10Redirect URI (reply URL) best practices and limitations (official docs, accessed 2026-10-30)
  11. s11How to add a redirect URI to your application (official docs, accessed 2026-10-30)
  12. s12Refresh tokens in the Microsoft identity platform (official docs, accessed 2026-10-30)
  13. s13Convert single-tenant app to multitenant on Microsoft Entra ID (official docs, accessed 2026-10-30)
  14. s14Retirement of service principal-less authentication (official docs, accessed 2026-10-30)
  15. s15Configure an app's publisher domain (official docs, accessed 2026-10-30)
  16. s16Microsoft 365 App Compliance Program overview (official docs, accessed 2026-10-30)
  17. s17Understand the verification process in Partner Center (official docs, accessed 2026-10-30)
  18. s18Microsoft 365 Developer Program FAQ (official docs, accessed 2026-10-30)
  19. s19Web API app registration and API permissions (official docs, accessed 2026-10-30)
  20. s20Microsoft to Block Users Granting Third-Party App Access to User Sites and Files (Office 365 for IT Pros) (community, accessed 2026-10-30)
  21. s21audiencesConfiguration resource type (Microsoft Graph beta) (official docs, accessed 2026-10-30)
  22. p1Live probe (console): Loaded: "Microsoft Entra admin center". (probe, accessed 2026-10-30)
  23. p2Live probe (oidc-discovery): Discovery document found. authorization_endpoint=https://login.microsoftonline.com/common/oauth2/v2. (probe, accessed 2026-10-30)
  24. p3Live probe (authorize-endpoint): Endpoint answered HTTP 200 ("Sign in to your account"). (probe, accessed 2026-10-30)