agentsclimarketplace

Azure easy auth

Skill ericsche/CodingSkills/plugins/codingskills/skills/azure-easy-auth

Custom agent skills for GitHub Copilot & Claude Code, from Microsoft-ecosystem dev experience (Azure, .NET, M365, Graph).

Install
npx -y skills add ericsche/CodingSkills --skill azure-easy-auth

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

2 things to look at

  • 20 days oldThe repository was created 20 days ago. New is not bad, but a brand new repository carrying a familiar-sounding name is the shape a typosquat arrives in, and there has been no time for anyone else to find a problem with it.
  • 0 stars0 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Configure Microsoft Entra ID (Azure AD) authentication for Azure App Service Easy Auth and Azure Static Web Apps. Use when setting up sign-in, protecting APIs, adding Google/Microsoft personal accounts, or debugging 403 "allowed applications" and client-principal issues.

The file declares its own license as MIT. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.

SKILL.md

2.2 KB, 495 tokens by cl100k_base, as published. Nobody here has run it

Azure Entra ID / Easy Auth setup

Guidance for wiring up authentication on Azure App Service (Easy Auth) and Azure Static Web Apps (SWA), based on real deployments.

Azure Static Web Apps (SWA)

  • Configure providers in staticwebapp.config.json.

  • Microsoft personal / Live accounts: use the aad provider with issuer https://login.microsoftonline.com/common/v2.0.

  • Google: add via customOpenIdConnectProviders (requires the SWA Standard plan).

  • The API reads the authenticated user from the x-ms-client-principal header (base64-encoded JSON). Decode it server-side to get user id, roles, claims.

  • Protect API routes, not SPA routes for a Blazor WASM / SPA front end. Example route rule:

    { "route": "/api/inscriptions", "methods": ["POST"], "allowedRoles": ["authenticated"] }

  • Local emulator note: the SWA CLI emulator needs AAD_CLIENT_ID in the environment for the aad provider, otherwise it errors with AAD_CLIENT_ID not found in env for 'aad' provider.

Azure App Service Easy Auth

  • An EMPTY defaultAuthorizationPolicy.allowedApplications does NOT mean allow-all. The caller's token appid/azp must be explicitly listed, or the request returns 403. Add the client's azp to allowedApplications.
  • Diagnose 403s with AppServiceAuthenticationLogs — look for does not match any of the allowed applications.
  • Validate the token you actually receive: check aud (should equal the Easy Auth clientId), azp (the calling app), scp/roles, and ver (2.0).

Debugging checklist

  1. Decode the incoming token (jwt.ms) and confirm aud, azp, scp/roles.
  2. For App Service 403s, confirm the caller azp is in allowedApplications.
  3. For SWA, confirm the provider issuer and that the protected route targets the API, not the SPA shell.
  4. Check the platform auth logs before changing app code.

Gives 0 of the 12 instructions most containers cloud skills give in 495 tokens

Counted across 607 of the 657 authors here whose files we hold, read 2026-08-06

  • run containers as a non-root userin 69 of 607, across 49 files
  • use multi-stage buildsin 52 of 607, across 41 files
  • use Promise.all for independent operationsin 47 of 607, across 13 files
  • import directly instead of barrel filesin 46 of 607, across 12 files
  • use ternary instead of AND for conditionalsin 45 of 607, across 12 files
  • use Set or Map for O(1) lookupsin 42 of 607, across 10 files
  • create a .dockerignore filein 41 of 607, across 31 files
  • Read individual rule files for detailsin 39 of 607, across 9 files
  • authenticate server actions like API routesin 35 of 607, across 7 files
  • use next/dynamic for heavy componentsin 34 of 607, across 9 files
  • use React.cache for per-request deduplicationin 34 of 607, across 10 files
  • copy dependency files before source codein 34 of 607, across 21 files

Said here and by no other author read

  • Configure providers in staticwebapp.config.json
  • Use the aad provider for Microsoft personal accounts
  • Add Google via customOpenIdConnectProviders
  • Decode the x-ms-client-principal header server-side
  • Protect API routes instead of SPA routes
  • Set the AAD_CLIENT_ID environment variable

Grouped from the skills themselves: near-identical wordings counted once, and counted by distinct author, so one author publishing three of these counts once. Length counted with cl100k_base; the agent that loads this file may tokenize it differently.

Keep looking

Skills are one crate of 328,083. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.