Daily.Entra.News
Aboutmerill.net
Microsoft Entra ID

V2 Howto App Gallery Listing

24 June 2026Updated+37 / −24 lines

In brief

Learn how to publish your application in Microsoft Entra application gallery.

What Entra admins need to know

Review the documentation change to determine whether it affects tenant configuration, security posture, or rollout plans.

This editorial summary was generated by AI from the documentation changes. Verify important details in the full Microsoft Learn article.

Documentation change

Open on Microsoft Learn ↗

The comparison below is an extract of the Microsoft Learn article showing only the changed content. Open the full article for complete context.

You can sign up for a free, test Development account. It's free for 90 days and you get all of the premium Microsoft Entra features with it. You can also extend the account if you use it for development work: Join the Microsoft 365 Developer Program.

Checklist for applications supportingthat support SSO

Here's the quickReview this checklist for you before you submit the applicationa request to list your application in the Microsoft Entra App Gallery.application gallery.

SAML single sign-on applicationSSO requirements

The followingThese requirements apply to SAML-based SSOsingle sign-on (SSO) applications.

Authentication requirements

Your application must meet the following authentication requirements:

  • Application should support SAML 2.0 Protocol either in Service Provider initiated mode or Identity Provider Initiated (IDP) mode or both (Required)
  • Application should validate the SAML token for certificate key, certificate validity, Issuer, Audience and other user claims as needed. (Required)
  • Test your SAML integration with Microsoft Entra ID using a non-gallery application. (Required).
  • Applications should support SAML Single Logout functionality. (Recommended)
  • Application should fetch the IDP SAML federation metadata from Microsoft Entra ID using the link that Microsoft provides. This helps reduce the configuration overload for customers and certificate rotation. See the certificate rotation guidance. (Recommended).
  • Application should provide the user interface and APIs for customers to configure the single sign-on for their instance of the application. (Recommended)
  • Application should provide an ability to enforce the SSO functionality to the entire tenant so that all the users must use single sign-on. For administrators, and to support break glass scenarios, you can support other authentication options or bypass mechanisms as needed. (Recommended).

ISV Specific Requirements:

As an independent software vendor (ISV), your application must also meet these requirements:

  • Application should be published in SaaS application model in cloud or distributed to customers for their installation (IaaS) so that the application can be owned and configured by customers as needed. (Required)
  • Establish an engineering and support point of contact to support customers during App Gallery onboarding and post onboarding (Required)
  • Document your SAML SSO configuration publicly (Required)
  • Meet the various compliance requirements for listing your application in those clouds like Public, USGov, China, Germany, France, Singapore etc. This is only required if you plan to publish your application in those clouds. (Required)

Multi-tenant

Multitenant OIDC SSO requirements

These requirements apply to multitenant OpenID Connect (OIDC) SSO applications.

Your application must meet the following authentication requirements:

Authentication Requirements:

  • Application should support OpenID Connect protocol for authentication as per the guidance provided here by Microsoft.Microsoft provides. We recommend using the OAuth 2.0 Auth Code Grant flow. Microsoft recommends you do not use OAuth 2.0 Resource owner Password Credentials flow. Similarly, OAuth 2.0 device authorization grant flow should not be used unless explicitly needed. (Required)
  • If you are developing a cloud application, then Microsoft recommends setting the application as a multi-tenantmultitenant application. Please see the guidance on converting your app to multitenant. (either single tenant or multi-tenantmultitenant model is required)
  • If the cloud application is set up for every customer using IaaS or PaaS architecture then the single tenant application model is acceptable.
  • Use Microsoft Entra ID V2 endpoint for authentication (Required)
  • Application should be using least privileged permissions for their scenarios. Please refer to our MS Graph API documentation to find the least privileged permission for the APIs. (Required)
  • Application should not be using secrets if the application wants to use client credentials flow, then the certificate should be used instead of secrets for retrieving the access token. (Required)
  • SPA applications shouldn't use the OAuth 2.0 Implicit Grant Flow for security reasons and they should use authorization code flow instead. (Recommended).

ISV specific requirements

As an ISV, your application must also meet these requirements:

  • Application should be published in SaaS application model whether in cloud or distributed to customers for their installation so that the application can be owned and configured by customers as needed. (Required)
  • Sign-in page should have a Sign in with Microsoft button and follow the branding guidelines. (Recommended).
  • Application should be publisher verified by using your MPN ID. Please follow the guidance published here.Microsoft publishes. (Required)
  • Establish an engineering and support point of contact to support customers post gallery onboarding (Required)
  • Document your OIDC OAuth SSO configuration publicly (Required)
  • Meet the various compliance requirements for listing your application in different clouds like Public, USGov, China, Germany, France, Singapore etc. This is only required if you plan to publish your application in those clouds. (Required)
  • Microsoft Entra App Gallery doesn't onboard public client applications.

Checklist for SCIM Provisioning Apps

provisioning apps

Here's the quickReview this checklist for you before you submit the applicationa request to list your SCIM provisioning application in the Microsoft Entra App Gallery.application gallery.

SCIM API Requirements:

requirements
  • Support a SCIM 2.0 user and group endpoint (Only User Provisioning is required but User and Group Provisioning both are recommended).
  • Support at least 25 requests per second per tenant to ensure that users and groups are provisioned and deprovisioned without delay (Required).
  • Validate and test your SCIM User and/or Group Provisioning integration with SCIM Validator and non-gallery application template (Required).
  • Support updating multiple group memberships with a single PATCH (Recommended).
  • Support for SCIM bulk APIs, which can improve the connector performance (Recommended).

SCIM Authentication Requirements:

authentication requirements

Support OAuth 2.0 Client Credentials flow in SCIM Provisioning authentication (Required). We aren't onboarding any SCIM Provisioning application with long lived bearer tokens, basic authentication, or Code Auth Grant flow.

  • OAuth 2.0 Client Credentials Flow (Required)
    • Provide the ability to rotate client secrets regularly. ISVs should enable smooth rotation by allowing multiple active secrets and supporting deletion of old secrets. Alternatively, customers can create new client_id and client_secret.
    • Access Token should be only valid for 60 minutes (1 hour) to 6 hours but not less than 60 minutes (Required)

ISV Specific Requirements

requirements for SCIM apps
  • Establish an engineering and support point of contact to support customers post Microsoft Entra App Gallery onboarding and for Microsoft to reach out in future (Required)
  • Document your SCIM endpoint publicly and share the link (Required)
  • Deploy your SCIM Provisioning to at least 100 mutual customers using the Microsoft Entra non-gallery approach to qualify for the Microsoft Entra App Gallery listing.
  • Share at least five customer Microsoft Entra tenant IDs so that they can participate in a private preview program once the connector is ready for testing.
  • If applicable, meet the various compliance requirements for listing your application in different clouds like USGov, China, Germany, France, Singapore, etc. (Required)

Known Limitation on SCIM limitations for SCIM-based user Provisioning

provisioning

See this Known issues for app provisioning for the full list of known limitations in the Microsoft Entra SCIM outbound provisioning.

Create and publish documentation

Before you submit your application, prepare the documentation your customers and Microsoft need. The following sections describe what to publish on your own site and what to provide to Microsoft.

Provide app documentation for your site

Ease of adoption is an important factor for those people that make decisions about enterprise software. Documentation that's clear and easy to follow helps your users adopt technology and it reduces support costs. Ease of adoption is an important factor for those people that make decisions about enterprise software. Documentation that's clear and easy to follow helps your users adopt technology and it reduces support costs.

Create documentation that includes the following information at minimum: