Authentication is one of those features many of us implement without fully understanding what's happening behind the scenes.
Most tutorials tell you to:
- Register an app
- Install a NuGet package
- Copy a few configuration values
- Run the application
It works, but why does it work?
Recently, I spent some time learning Microsoft Entra ID authentication from scratch and wanted to understand the complete flow instead of just copying code from the documentation.
Here's a simplified overview.
What is Microsoft Entra ID?
Microsoft Entra ID is Microsoft's cloud based Identity and Access Management (IAM) service.
Instead of storing usernames and passwords in your application, you delegate authentication to Microsoft.
Your application never sees the user's password.
User
│
▼
ASP.NET Core App
│
Redirect
▼
Microsoft Entra ID
│
Authenticate User
▼
Return Secure Tokens
OAuth 2.0 vs OpenID Connect
This was probably the biggest takeaway for me.
OAuth 2.0 is for authorization.
It answers:
What resources can this application access?
OpenID Connect (OIDC) is for authentication.
It answers:
Who is the authenticated user?
When using Microsoft Entra ID, you'll typically receive:
ID Token → User identity
Access Token → Call APIs such as Microsoft Graph
The Authentication Flow
Here's what actually happens after clicking Sign In.
User
↓
ASP.NET Core
↓
Microsoft Entra ID
↓
User signs in
↓
Authorization Code
↓
ID Token + Access Token
↓
Authentication Cookie
↓
Authenticated User
The nice part is that Microsoft.Identity.Web handles most of this for you.
App Registration
Before your application can authenticate users, it must be registered in Microsoft Entra ID.
The important values you'll need are:
- Client ID
- Tenant ID
- Redirect URI
- Client Secret (for server side applications)
These values are later used inside your appsettings.json.
ASP.NET Core Setup
Installing Microsoft Entra ID support is surprisingly simple.
dotnet add package Microsoft.Identity.Web
dotnet add package Microsoft.Identity.Web.UI
dotnet add package Microsoft.Identity.Web.DownstreamApi
Configure authentication.
builder.Services
.AddAuthentication(OpenIdConnectDefaults.AuthenticationScheme)
.AddMicrosoftIdentityWebApp(
builder.Configuration.GetSection("AzureAd"));
Protect your controller.
[Authorize]
public class HomeController : Controller
{
public IActionResult Index()
{
return View();
}
}
That's enough to redirect unauthenticated users to Microsoft Entra ID automatically.
Calling Microsoft Graph
Once the user signs in, your application receives an Access Token.
You can use it to call Microsoft Graph and access resources such as:
- User profile
- Calendar
- Emails
- OneDrive
- Teams
The Microsoft.Identity.Web library automatically manages token acquisition and caching, which keeps the implementation clean.
Common Issues
The most common problems I ran into while learning were:
- Redirect URI mismatch (
AADSTS50011) - Invalid Client Secret
- Missing Microsoft Graph permissions
- Choosing Single Tenant instead of Multi Tenant
Most authentication issues came down to configuration rather than code.
Final Thoughts
Microsoft Entra ID seemed intimidating when I first started learning it, but after understanding the authentication flow, everything else became much easier.
Once you understand:
- OAuth 2.0
- OpenID Connect
- ID Tokens
- Access Tokens
- Authorization Code Flow
the configuration starts making much more sense.
Want the Full Walkthrough?
This post only covers the high level concepts.
I wrote a much more detailed guide on Medium where I explain:
- Complete authentication flow
- App Registration
- ASP.NET Core (.NET 9) implementation
- Microsoft.Identity.Web
- Microsoft Graph integration
- Common authentication errors
- Working code examples
👉 Read the full article on Medium: (https://medium.com/@gaurav110dev/the-complete-microsoft-entra-id-authentication-guide-for-asp-net-core-dd7064d24ea7?sharedUserId=gaurav110dev)
SOCIAL SHARE CARD GENERATOR