VisuAuth.Entra.Web 0.3.0-alpha.77

This is a prerelease version of VisuAuth.Entra.Web.

dotnet add package VisuAuth.Entra.Web --version 0.3.0-alpha.77

NuGet\Install-Package VisuAuth.Entra.Web -Version 0.3.0-alpha.77

This command is intended to be used within the Package Manager Console in Visual Studio, as it uses the NuGet module's version of Install-Package.

<PackageReference Include="VisuAuth.Entra.Web" Version="0.3.0-alpha.77" />

For projects that support PackageReference, copy this XML node into the project file to reference the package.

<PackageVersion Include="VisuAuth.Entra.Web" Version="0.3.0-alpha.77" />
                    

                            Directory.Packages.props

<PackageReference Include="VisuAuth.Entra.Web" />
                    

                            Project file

For projects that support Central Package Management (CPM), copy this XML node into the solution Directory.Packages.props file to version the package.

paket add VisuAuth.Entra.Web --version 0.3.0-alpha.77

The NuGet Team does not provide support for this client. Please contact its maintainers for support.

#r "nuget: VisuAuth.Entra.Web, 0.3.0-alpha.77"

#r directive can be used in F# Interactive and Polyglot Notebooks. Copy this into the interactive tool or source code of the script to reference the package.

#:package VisuAuth.Entra.Web@0.3.0-alpha.77

#:package directive can be used in C# file-based apps starting in .NET 10 preview 4. Copy this into a .cs file before any lines of code to reference the package.

#addin nuget:?package=VisuAuth.Entra.Web&version=0.3.0-alpha.77&prerelease
                    

                            Install as a Cake Addin

#tool nuget:?package=VisuAuth.Entra.Web&version=0.3.0-alpha.77&prerelease
                    

                            Install as a Cake Tool

The NuGet Team does not provide support for this client. Please contact its maintainers for support.

VisuAuth.Entra.Web

Operator sign-in for the VisuAuth.Entra (Microsoft Entra ID / Workforce) adapter.

Why you need it

AddVisuAuthEntra(...) wires Microsoft Graph with app-only credentials. That authenticates the app to Microsoft — it does not sign a human in, and it registers no authentication scheme at all.

The VisuAuth admin dashboard requires an authenticated user by default, so without a sign-in scheme it has nothing to challenge with and the operator has no way in. This package adds that scheme, wrapping Microsoft.Identity.Web:

builder.Services.AddVisuAuth().AddAdminUi();
builder.Services.AddVisuAuthEntra(builder.Configuration);
builder.Services.AddVisuAuthEntraSignIn(builder.Configuration);

var app = builder.Build();
app.UseStaticFiles();
app.UseRouting();
app.UseAuthentication();
app.UseAuthorization();
app.MapVisuAuth();
app.Run();

Skip this package only if you already front /visuauth/admin with your own authentication, or you called AllowAnonymousVisuAuthAdmin() because the dashboard is fenced off some other way. Never leave the Entra admin anonymous on a reachable network — the adapter holds directory-wide Graph permissions, so an anonymous visitor would be administering your real tenant.

Configuration

Bind from VisuAuth:Entra:Web (a separate app registration from the Graph one — see below):

dotnet user-secrets set "VisuAuth:Entra:Web:TenantId"     "<guid>"
dotnet user-secrets set "VisuAuth:Entra:Web:ClientId"     "<guid>"
dotnet user-secrets set "VisuAuth:Entra:Web:ClientSecret" "<value>"

Key	Default	Notes
`TenantId`	(required)	Usually the same GUID as `VisuAuth:Entra:TenantId`.
`ClientId`	(required)	The sign-in app registration, not the Graph app.
`ClientSecret`	—	Required for a confidential web client.
`Instance`	`https://login.microsoftonline.com/`	Override for sovereign clouds.
`CallbackPath`	`/signin-oidc`	Must match the registration's redirect URI exactly.
`SignedOutCallbackPath`	`/signout-callback-oidc`	Must match the post-logout redirect URI.

App registration

Add a redirect URI of https://<your-host>/signin-oidc (Web platform) and a post-logout redirect URI of https://<your-host>/signout-callback-oidc. No Graph application permissions are needed here — this registration only signs operators in; the Graph app is the one with User.ReadWrite.All and friends.

Why two app registrations?

The Graph adapter uses app-only client credentials (the app acts as itself); sign-in uses the authorization-code flow (a human acts as themselves). Microsoft treats these as separate apps, and sharing one means the same secret signs both your admin Graph calls and your sign-in redirects.

Restricting to a role

By default any authenticated user in the tenant reaches the dashboard. To limit it to an app role, register a policy under VisuAuth's admin policy name:

using VisuAuth.AdminUi.DependencyInjection;

builder.Services.AddAuthorizationBuilder()
    .AddPolicy(VisuAuthAdminUiServiceCollectionExtensions.AdminAuthorizationPolicy,
        policy => policy.RequireRole("VisuAuth.Admin"));

Declare the app role on the sign-in registration's manifest and assign it to the operators who should get in.

License

Apache 2.0 — see the repository.

Product	Compatible and additional computed target framework versions.
.NET	net10.0 is compatible. net10.0-android was computed. net10.0-browser was computed. net10.0-ios was computed. net10.0-maccatalyst was computed. net10.0-macos was computed. net10.0-tvos was computed. net10.0-windows was computed.

Compatible target framework(s)

Included target framework(s) (in package)

Learn more about Target Frameworks and .NET Standard.

net10.0
- Azure.Identity (>= 1.17.2)
- Microsoft.AspNetCore.Authentication.JwtBearer (>= 10.0.0)
- Microsoft.Extensions.DependencyInjection.Abstractions (>= 10.0.7)
- Microsoft.Extensions.Logging.Abstractions (>= 10.0.7)
- Microsoft.Extensions.Options.ConfigurationExtensions (>= 10.0.0)
- Microsoft.Extensions.Options.DataAnnotations (>= 10.0.0)
- Microsoft.Graph (>= 5.95.0)
- Microsoft.Identity.Web (>= 4.10.0)
- Microsoft.Kiota.Abstractions (>= 1.22.0)
- System.IdentityModel.Tokens.Jwt (>= 8.18.0)
- System.Security.Cryptography.Xml (>= 10.0.10)
- VisuAuth.Abstractions (>= 0.3.0-alpha.77)
- VisuAuth.Entra (>= 0.3.0-alpha.77)

NuGet packages

This package is not used by any NuGet packages.

GitHub repositories

This package is not used by any popular GitHub repositories.

Version	Downloads	Last Updated
0.3.0-alpha.77	31	7/30/2026
0.3.0-alpha.76	34	7/29/2026
0.3.0-alpha.75	28	7/29/2026
0.3.0-alpha.74	35	7/29/2026
0.3.0-alpha.73	28	7/29/2026
0.3.0-alpha.72	41	7/29/2026
0.3.0-alpha.71	33	7/29/2026
0.3.0-alpha.70	29	7/29/2026
0.3.0-alpha.69	24	7/29/2026
0.3.0-alpha.68	52	7/15/2026
0.3.0-alpha.67	43	7/15/2026
0.3.0-alpha.66	50	7/15/2026

See https://github.com/VisuAuth/visuauth/blob/main/CHANGELOG.md for release notes.