Microsoft app credentials

A Microsoft app credential signs in as a Microsoft Entra app registration instead of a person (the OAuth 2.0 client credentials flow). One credential works for the Azure AD (Microsoft Entra ID), SharePoint, Microsoft Dataverse, and Dynamics 365 blocks. Connecting a Microsoft account through OAuth keeps working exactly as before; the app credential is an additional option in the same account picker.

Choose how the app signs in

Option	What Sim stores	When to use it
Federated credential (keyless, via Sim OIDC)	Nothing secret: the tenant ID, client ID, and this credential's subject	Recommended. No secret to rotate, expire, or leak.
Client secret	The tenant ID, client ID, and client secret	Quick setup. Secrets expire, so plan to rotate them.
Certificate	The tenant ID, client ID, the certificate, and its private key	When your organization requires certificate credentials. Sim signs each token request with the key.

Every option resolves on Sim's servers at run time, and tokens never appear in block outputs, logs, or anything a model sees. Azure AD and SharePoint blocks get a Microsoft Graph token; Dataverse and Dynamics 365 blocks get a token for the credential's own environment.

Register the app and grant permissions

In the Microsoft Entra admin center, go to App registrations → New registration. A single-tenant app is fine. Copy the Application (client) ID and Directory (tenant) ID from its Overview page.
2
Under API permissions → Add a permission → Microsoft Graph → Application permissions, add what your workflows need, then select Grant admin consent. Application permissions always need admin consent. For example:
- Azure AD: User.Read.All or User.ReadWrite.All, Group.ReadWrite.All, GroupMember.ReadWrite.All, AuditLog.Read.All for sign-in and audit logs, Policy.Read.All for conditional access, UserAuthenticationMethod.Read.All for authentication methods, User.RevokeSessions.All to revoke sessions. Setting a password needs User-PasswordProfile.ReadWrite.All and the app assigned at least the User Administrator role.
- SharePoint: Sites.Read.All or Sites.ReadWrite.All. Creating and editing pages needs Sites.ReadWrite.All. Sites.Selected limits the app to sites you grant it, but searching for sites doesn't work with it, so enter site IDs directly.
Dataverse and Dynamics 365 don't use API permissions. Instead, in the Power Platform admin center, open the environment → Settings → Users + permissions → Application users → New app user, add this app, pick a business unit, and assign a security role. Then enter the environment URL (like https://contoso.crm.dynamics.com) on the credential.

Set up a keyless federated credential

In Sim, add a Microsoft app credential, choose Federated credential (keyless, via Sim OIDC), and enter the tenant ID and client ID. The dialog shows an Issuer, Audience, and Subject.
In the app registration, go to Certificates & secrets → Federated credentials → Add credential → Other issuer. Paste the Issuer and the Subject identifier exactly as shown, set the audience to api://AzureADTokenExchange (the dialog's value), and give it a name. Matching is case-sensitive.
Save in Sim. Sim requests a token as the app and reads the app's own service principal from Microsoft Graph, which needs no extra permission. It also checks that the app refuses a subject no credential holds, so only this credential can use the app. A new federated credential can take a few minutes to take effect; if saving fails with a matching error right after you add it, wait and try again.

An app can have up to 20 federated credentials. Each Sim credential has its own subject, and reconnecting keeps the subject by default so the federated credential keeps working. Keyless credentials are available for workspace credentials, not organization credentials.

From the API or CLI

Run sim credentials keyless-subject microsoft-app-service-account, trust the printed subject as above, then add tenantId and clientId (optionally environmentUrl) to its keylessConfig and pass it to sim credentials create microsoft-app-service-account. See the CLI credentials reference for the full two-step example; the proof expires after 24 hours and works only for the user who requested it.

Use a client secret or certificate

Client secret: under Certificates & secrets → Client secrets → New client secret, copy the secret's Value (not the Secret ID).
Certificate: upload the certificate's public part (.cer, .pem, or .crt) under Certificates & secrets → Certificates, then paste the certificate and its unencrypted PEM RSA private key (2048 to 4096 bits) into Sim. Sim checks the key belongs to the certificate before saving, and signs a PS256 assertion with the certificate's SHA-256 thumbprint.

Self-hosted deployments

Keyless credentials need WORKLOAD_IDENTITY_SIGNING_KEY set and an https issuer Microsoft Entra can reach over the public internet. See AWS credentials for the same settings and for rotating the signing key. App credentials use the global Microsoft Entra endpoint (login.microsoftonline.com) and public-cloud Dataverse environments.

Troubleshooting

"No federated credential on this app matches…": the federated credential's issuer, subject, or audience differs from the dialog (check case and trailing slashes), it's on a different app than the client ID, or it was added moments ago.
"Microsoft Entra rejected the client secret": you pasted the Secret ID, or the secret was deleted. "This client secret has expired": create a new one and reconnect.
"…could not verify the signed assertion": the certificate in Sim isn't the one uploaded to the app registration.
"…the Dataverse environment did not accept it": add the app as an application user of the environment with a security role.
A block fails with 403 "Insufficient privileges": the app is missing an application permission for that operation, or admin consent wasn't granted after adding it.