Microsoft Power Platform Authentication

generated: '2026-09-06'
method: searched
source: >-
  https://learn.microsoft.com/en-us/power-platform/admin/programmability-authentication-v2 and
  https://learn.microsoft.com/en-us/power-platform/admin/programmability-permission-reference
  (both HTTP 200, fetched 2026-09-06), reconciled with the securitySchemes derived from
  openapi/microsoft-power-platform-metadata-api-openapi.yml,
  openapi/microsoft-power-platform-records-api-openapi.yml and
  openapi/_original/microsoft-power-platform-enterprise-policies-openapi.json
docs: https://learn.microsoft.com/en-us/power-platform/admin/programmability-authentication-v2
summary:
  types:
  - oauth2
  oauth2_flows:
  - authorizationCode
  - clientCredentials
  - implicit
  api_keys: false
  api_key_note: >-
    There are no API keys anywhere in the Power Platform surface. Every call on every host is a
    Microsoft Entra ID bearer token, which is why there is no test/live key prefix in sandbox/.
schemes:
- name: oauth2
  type: oauth2
  applies_to:
  - Microsoft Dataverse Web API
  - Power Platform API
  provider: Microsoft Entra ID (formerly Azure AD)
  flows:
  - flow: authorizationCode
    authorizationUrl: https://login.microsoftonline.com/common/oauth2/v2.0/authorize
    tokenUrl: https://login.microsoftonline.com/common/oauth2/v2.0/token
    use: interactive user / delegated access
  - flow: clientCredentials
    tokenUrl: https://login.microsoftonline.com/{tenantId}/oauth2/v2.0/token
    use: service principal / application user
    note: >-
      For Dataverse a service principal also needs a matching APPLICATION USER inside the
      environment with a security role. A valid token alone is not access.
  description: >-
    Microsoft Entra ID OAuth 2.0. The token audience is the resource being called, not a shared
    Power Platform audience.
  audiences:
  - resource: Dataverse
    scope: https://{org}.api.crm.dynamics.com/.default
  - resource: Power Platform API
    scope: https://api.powerplatform.com/.default
  - resource: Dataverse MCP server
    scope: Dynamics CRM mcp.tools
    note: Delegated permission; the client app id must also be allow-listed per environment.
  sources:
  - openapi/microsoft-power-platform-metadata-api-openapi.yml
  - openapi/microsoft-power-platform-records-api-openapi.yml
- name: azure_auth
  type: oauth2
  applies_to:
  - Power Platform Enterprise Policies (Azure Resource Manager)
  provider: Microsoft Entra ID
  flows:
  - flow: implicit
    authorizationUrl: https://login.microsoftonline.com/common/oauth2/authorize
    scopes:
      user_impersonation: impersonate your user account
  description: >-
    Declared verbatim in Microsoft's own Swagger for the Microsoft.PowerPlatform resource
    provider. Standard Azure Resource Manager auth against the management.azure.com audience.
  sources:
  - openapi/_original/microsoft-power-platform-enterprise-policies-openapi.json
oidc:
  discovery: https://login.microsoftonline.com/{tenant}/v2.0/.well-known/openid-configuration
  note: >-
    No Power Platform host serves its own openid-configuration - the identity plane is Entra ID.
    See well-known/microsoft-power-platform-well-known.yml.
authorization:
  model: >-
    Two independent layers. Entra ID decides whether the caller may reach the API; Dataverse
    security roles and Power Platform admin permissions decide what the caller may do once in.
    A 403 means the second layer refused and no retry will help.
  reference: https://learn.microsoft.com/en-us/power-platform/admin/programmability-permission-reference
observed:
- url: https://api.powerplatform.com/licensing/billingPolicies?api-version=2022-03-01-preview
  status: 401
  www_authenticate: Bearer error="invalid_token"
  probed: '2026-09-06'
- url: https://api.bap.microsoft.com/.well-known/security.txt
  status: 401
  probed: '2026-09-06'