Microsoft Identity

Twin of the Microsoft identity platform v2 endpoint.

The Entra v2 issuer behind Microsoft Graph integrations. It mints the tokens the Microsoft Graph twin verifies.


Covers	`login.microsoftonline.com`, `graph.microsoft.com/oidc/userinfo`
Auth	Client id and secret, client assertion, bearer access tokens
Issues tokens for	Microsoft Graph
Operations	10

Coverage

Five grants: authorization code, refresh token, client credentials, device code and on-behalf-of. The endpoints behind them are authorize, token, device code, logout, admin consent, discovery and keys, every one of them under its tenant segment, plus UserInfo on the Graph host at /oidc/userinfo.

This twin is added to your environment automatically when you ask for Microsoft Graph, so you rarely request it directly.

Credentials

Any well-formed client id and secret authenticate by default. Set auth.mode to enforced to accept only the values the world knows and get Entra’s 401 invalid_client refusals. See Credentials.

Vendor specific details

A registration marked as a public client is refused whenever it sends a client_secret or client_assertion, in the default permissive mode too. That is AADSTS700025, exactly the way Entra refuses a desktop or CLI app that ships a secret.
A client credentials request has to ask for exactly one <resource>/.default scope. Naming individual application permissions is refused.
Every refusal buries an AADSTS number inside error_description and repeats it in error_codes, so code branching on the number has to read it out of one of those, not off the error string.
The login endpoints fold case and ignore a trailing slash. Graph’s /oidc/userinfo on the same service does neither, and stays case sensitive.

Its own notes

Once a sandbox is running, this twin serves its own operating notes at {control_url}/veris/manual: the credentials it accepts, the API versions it serves, and the fault statuses you can arm against it. They are generated from the same source as its behaviour, so they cannot drift.