Microsoft Entra IDV2 Howto App Gallery Listing
In brief
Learn how to publish your application in Microsoft Entra application gallery.
Documentation change
You can sign up for a free, test Development account. It's free for 90 days and you get all of the premium Microsoft Entra features with it. You can also extend the account if you use it for development work: Join the Microsoft 365 Developer Program.
Checklist for applications supporting SSO
Here's the quick checklist for you before you submit the application request to list your application in Microsoft Entra App Gallery.
Checklist for applications that support SSO
SAML single sign-on application requirements
Review this checklist before you submit a request to list your application in the Microsoft Entra application gallery.
The following requirements apply to SAML-based SSO applications.
SAML SSO requirements
These requirements apply to SAML-based single sign-on (SSO) applications.
Your application must meet the following authentication requirements:
Authentication requirements
- Application should support SAML 2.0 Protocol either in Service Provider initiated mode or Identity Provider Initiated (IDP) mode or both (Required)
- Application should validate the SAML token for certificate key, certificate validity, Issuer, Audience and other user claims as needed. (Required)
- Test your SAML integration with Microsoft Entra ID using a non-gallery application. (Required).
- Applications should support SAML Single Logout functionality. (Recommended)
- Application should fetch the IDP SAML federation metadata from Microsoft Entra ID using the link that Microsoft provides. This helps reduce the configuration overload for customers and certificate rotation. See the guidance here. (Recommended).
- Application should fetch the IDP SAML federation metadata from Microsoft Entra ID using the link that Microsoft provides. This helps reduce the configuration overload for customers and certificate rotation. See the certificate rotation guidance. (Recommended).
- Application should provide the user interface and APIs for customers to configure the single sign-on for their instance of the application. (Recommended)
- Application should provide an ability to enforce the SSO functionality to the entire tenant so that all the users must use single sign-on. For administrators, and to support break glass scenarios, you can support other authentication options or bypass mechanisms as needed. (Recommended).
ISV Specific Requirements:
As an independent software vendor (ISV), your application must also meet these requirements:
- Application should be published in SaaS application model in cloud or distributed to customers for their installation (IaaS) so that the application can be owned and configured by customers as needed. (Required)
- Establish an engineering and support point of contact to support customers during App Gallery onboarding and post onboarding (Required)
- Document your SAML SSO configuration publicly (Required)
- Meet the various compliance requirements for listing your application in those clouds like Public, USGov, China, Germany, France, Singapore etc. This is only required if you plan to publish your application in those clouds. (Required)
Multi-tenant OIDC application requirements:
Multitenant OIDC SSO requirements
These requirements apply to multitenant OpenID Connect (OIDC) SSO applications.
Authentication Requirements:
- Application should support OpenID Connect protocol for authentication as per the guidance provided here by Microsoft. We recommend using the OAuth 2.0 Auth Code Grant flow. Microsoft recommends you do not use OAuth 2.0 Resource owner Password Credentials flow. Similarly, OAuth 2.0 device authorization grant flow should not be used unless explicitly needed. (Required)
- If you are developing a cloud application, then Microsoft recommends setting the application as a multi-tenant application. Please see the guidance here. (either single tenant or multi-tenant model is required)
Your application must meet the following authentication requirements:
- Application should support OpenID Connect protocol for authentication as per the guidance Microsoft provides. We recommend using the OAuth 2.0 Auth Code Grant flow. Microsoft recommends you do not use OAuth 2.0 Resource owner Password Credentials flow. Similarly, OAuth 2.0 device authorization grant flow should not be used unless explicitly needed. (Required)
- If you are developing a cloud application, then Microsoft recommends setting the application as a multitenant application. Please see the guidance on converting your app to multitenant. (either single tenant or multitenant model is required)
- If the cloud application is set up for every customer using IaaS or PaaS architecture then the single tenant application model is acceptable.
- Use Microsoft Entra ID V2 endpoint for authentication (Required)
- Application should be using least privileged permissions for their scenarios. Please refer to our MS Graph API documentation to find the least privileged permission for the APIs. (Required)
- Application should not be using secrets if the application wants to use client credentials flow, then the certificate should be used instead of secrets for retrieving the access token. (Required)
- SPA applications shouldn't use the OAuth 2.0 Implicit Grant Flow for security reasons and they should use authorization code flow instead. (Recommended).
ISV specific requirements
As an ISV, your application must also meet these requirements:
- Application should be published in SaaS application model whether in cloud or distributed to customers for their installation so that the application can be owned and configured by customers as needed. (Required)
- Sign-in page should have a Sign in with Microsoft button and follow the branding guidelines here. (Recommended).
- Application should be publisher verified by using your MPN ID. Please follow the guidance published here. (Required)
- Sign-in page should have a Sign in with Microsoft button and follow the branding guidelines. (Recommended).
- Application should be publisher verified by using your MPN ID. Please follow the guidance Microsoft publishes. (Required)
- Establish an engineering and support point of contact to support customers post gallery onboarding (Required)
- Document your OIDC OAuth SSO configuration publicly (Required)
- Meet the various compliance requirements for listing your application in different clouds like Public, USGov, China, Germany, France, Singapore etc. This is only required if you plan to publish your application in those clouds. (Required)
- Microsoft Entra App Gallery doesn't onboard public client applications.
Checklist for SCIM Provisioning Apps
Here's the quick checklist for you before you submit the application request to list your application in Microsoft Entra App Gallery.
Checklist for SCIM provisioning apps
Review this checklist before you submit a request to list your SCIM provisioning application in the Microsoft Entra application gallery.
SCIM API requirements
SCIM API Requirements:
- Support a SCIM 2.0 user and group endpoint (Only User Provisioning is required but User and Group Provisioning both are recommended).
- Support at least 25 requests per second per tenant to ensure that users and groups are provisioned and deprovisioned without delay (Required).
- Validate and test your SCIM User and/or Group Provisioning integration with SCIM Validator and non-gallery application template (Required).
- Support updating multiple group memberships with a single PATCH (Recommended).
- Support for SCIM bulk APIs, which can improve the connector performance (Recommended).
SCIM Authentication Requirements:
SCIM authentication requirements
Support OAuth 2.0 Client Credentials flow in SCIM Provisioning authentication (Required). We aren't onboarding any SCIM Provisioning application with long lived bearer tokens, basic authentication, or Code Auth Grant flow.
- OAuth 2.0 Client Credentials Flow (Required)
- Provide the ability to rotate client secrets regularly. ISVs should enable smooth rotation by allowing multiple active secrets and supporting deletion of old secrets. Alternatively, customers can create new client_id and client_secret.
- Access Token should be only valid for 60 minutes (1 hour) to 6 hours but not less than 60 minutes (Required)
ISV Specific Requirements
ISV requirements for SCIM apps
- Establish an engineering and support point of contact to support customers post Microsoft Entra App Gallery onboarding and for Microsoft to reach out in future (Required)
- Document your SCIM endpoint publicly and share the link (Required)
- Deploy your SCIM Provisioning to at least 100 mutual customers using the Microsoft Entra non-gallery approach to qualify for the Microsoft Entra App Gallery listing.
- Share at least five customer Microsoft Entra tenant IDs so that they can participate in a private preview program once the connector is ready for testing.
- If applicable, meet the various compliance requirements for listing your application in different clouds like USGov, China, Germany, France, Singapore, etc. (Required)
Known Limitation on SCIM based user Provisioning
See this article for full list of known limitations in the Microsoft Entra SCIM outbound provisioning.
Known limitations for SCIM-based user provisioning
See Known issues for app provisioning for the full list of known limitations in the Microsoft Entra SCIM outbound provisioning.
Create and publish documentation
Before you submit your application, prepare the documentation your customers and Microsoft need. The following sections describe what to publish on your own site and what to provide to Microsoft.
Provide app documentation for your site
Ease of adoption is an important factor for those people that make decisions about enterprise software. Documentation that's clear and easy to follow helps your users adopt technology and it reduces support costs.
Ease of adoption is an important factor for those people that make decisions about enterprise software. Documentation that's clear and easy to follow helps your users adopt technology and it reduces support costs.
Create documentation that includes the following information at minimum:
diff --git a/docs/identity/enterprise-apps/v2-howto-app-gallery-listing.md b/docs/identity/enterprise-apps/v2-howto-app-gallery-listing.md
index f700dbfbb34..403ac8f7cf0 100644
--- a/docs/identity/enterprise-apps/v2-howto-app-gallery-listing.md
+++ b/docs/identity/enterprise-apps/v2-howto-app-gallery-listing.md
@@ -3,9 +3,10 @@ title: Submit a request to publish your application
description: Learn how to publish your application in Microsoft Entra application gallery.
ms.topic: how-to
-ms.date: 10/09/2024
+ms.date: 06/22/2026
ms.reviewer: jeedes
ms.custom: kr2b-contr-experiment, enterprise-apps-article
+ai-usage: ai-assisted
#customer intent: As a developer, I want to learn about the requirement for submitting my application to the Microsoft Entra application gallery, so that it can be publicly available for users to add to their tenants.
---
@@ -43,33 +44,39 @@ To publish your application in the gallery, you must first read and agree to spe
You can sign up for a free, test Development account. It's free for 90 days and you get all of the premium Microsoft Entra features with it. You can also extend the account if you use it for development work: [Join the Microsoft 365 Developer Program](/office/developer-program/microsoft-365-developer-program).
-### Checklist for applications supporting SSO
-Here's the quick checklist for you before you submit the application request to list your application in Microsoft Entra App Gallery.
+## Checklist for applications that support SSO
-#### SAML single sign-on application requirements
+Review this checklist before you submit a request to list your application in the Microsoft Entra application gallery.
-The following requirements apply to SAML-based SSO applications.
+### SAML SSO requirements
+
+These requirements apply to SAML-based single sign-on (SSO) applications.
+
+Your application must meet the following authentication requirements:
-#### Authentication requirements
- Application should support SAML 2.0 Protocol either in Service Provider initiated mode or Identity Provider Initiated (IDP) mode or both (Required)
- Application should validate the SAML token for certificate key, certificate validity, Issuer, Audience and other user claims as needed. (Required)
- Test your SAML integration with Microsoft Entra ID using a non-gallery application. (Required).
- Applications should support [SAML Single Logout](~/identity-platform/single-sign-out-saml-protocol.md) functionality. (Recommended)
-- Application should fetch the IDP SAML federation metadata from Microsoft Entra ID using the link that Microsoft provides. This helps reduce the configuration overload for customers and certificate rotation. See the [guidance here](~/identity/enterprise-apps/tutorial-manage-certificates-for-federated-single-sign-on.md#guidance-and-best-practices-for-isvs-on-rotating-certificates). (Recommended).
+- Application should fetch the IDP SAML federation metadata from Microsoft Entra ID using the link that Microsoft provides. This helps reduce the configuration overload for customers and certificate rotation. See the [certificate rotation guidance](~/identity/enterprise-apps/tutorial-manage-certificates-for-federated-single-sign-on.md#guidance-and-best-practices-for-isvs-on-rotating-certificates). (Recommended).
- Application should provide the user interface and APIs for customers to configure the single sign-on for their instance of the application. (Recommended)
- Application should provide an ability to enforce the SSO functionality to the entire tenant so that all the users must use single sign-on. For administrators, and to support break glass scenarios, you can support other authentication options or bypass mechanisms as needed. (Recommended).
-#### ISV Specific Requirements:
+As an independent software vendor (ISV), your application must also meet these requirements:
+
- Application should be published in SaaS application model in cloud or distributed to customers for their installation (IaaS) so that the application can be owned and configured by customers as needed. (Required)
- Establish an engineering and support point of contact to support customers during App Gallery onboarding and post onboarding (Required)
- Document your SAML SSO configuration publicly (Required)
- Meet the various compliance requirements for listing your application in those clouds like Public, USGov, China, Germany, France, Singapore etc. This is only required if you plan to publish your application in those clouds. (Required)
-#### Multi-tenant OIDC application requirements:
+### Multitenant OIDC SSO requirements
+
+These requirements apply to multitenant OpenID Connect (OIDC) SSO applications.
-#### Authentication Requirements:
-- Application should support OpenID Connect protocol for authentication as per the guidance provided here by Microsoft. We recommend using the [OAuth 2.0 Auth Code Grant flow](~/identity-platform/v2-oauth2-auth-code-flow.md). Microsoft recommends you do not use [OAuth 2.0 Resource owner Password Credentials flow](~/identity-platform/v2-oauth-ropc.md). Similarly, [OAuth 2.0 device authorization grant flow](~/identity-platform/v2-oauth2-device-code.md) should not be used unless explicitly needed. (Required)
-- If you are developing a cloud application, then Microsoft recommends setting the application as a multi-tenant application. Please see the [guidance here](~/identity-platform/howto-convert-app-to-be-multi-tenant.md). (either single tenant or multi-tenant model is required)
+Your application must meet the following authentication requirements:
+
+- Application should support OpenID Connect protocol for authentication as per the guidance Microsoft provides. We recommend using the [OAuth 2.0 Auth Code Grant flow](~/identity-platform/v2-oauth2-auth-code-flow.md). Microsoft recommends you do not use [OAuth 2.0 Resource owner Password Credentials flow](~/identity-platform/v2-oauth-ropc.md). Similarly, [OAuth 2.0 device authorization grant flow](~/identity-platform/v2-oauth2-device-code.md) should not be used unless explicitly needed. (Required)
+- If you are developing a cloud application, then Microsoft recommends setting the application as a multitenant application. Please see the [guidance on converting your app to multitenant](~/identity-platform/howto-convert-app-to-be-multi-tenant.md). (either single tenant or multitenant model is required)
- If the cloud application is set up for every customer using IaaS or PaaS architecture then the [single tenant application model](~/identity-platform/single-and-multi-tenant-apps.md) is acceptable.
- Use Microsoft Entra ID V2 endpoint for authentication (Required)
- Application should be using [least privileged permissions](/graph/permissions-overview?tabs=http#best-practices-for-using-microsoft-graph-permissions) for their scenarios. Please refer to our MS Graph API documentation to find the least privileged permission for the APIs. (Required)
@@ -77,19 +84,22 @@ The following requirements apply to SAML-based SSO applications.
- Application should not be using secrets if the application wants to use client credentials flow, then the certificate should be used instead of secrets for retrieving the access token. (Required)
- SPA applications shouldn't use the OAuth 2.0 Implicit Grant Flow for [security reasons](~/identity-platform/v2-oauth2-implicit-grant-flow.md#security-concerns-with-implicit-grant-flow) and they should use authorization code flow instead. (Recommended).
-#### ISV specific requirements
+As an ISV, your application must also meet these requirements:
+
- Application should be published in SaaS application model whether in cloud or distributed to customers for their installation so that the application can be owned and configured by customers as needed. (Required)
-- Sign-in page should have a **Sign in with Microsoft** button and follow the [branding guidelines here](~/identity-platform/howto-add-branding-in-apps.md). (Recommended).
-- Application should be publisher verified by using your MPN ID. Please follow the guidance published here. (Required)
+- Sign-in page should have a **Sign in with Microsoft** button and follow the [branding guidelines](~/identity-platform/howto-add-branding-in-apps.md). (Recommended).
+- Application should be publisher verified by using your MPN ID. Please follow the guidance Microsoft publishes. (Required)
- Establish an engineering and support point of contact to support customers post gallery onboarding (Required)
- Document your OIDC OAuth SSO configuration publicly (Required)
- Meet the various compliance requirements for listing your application in different clouds like Public, USGov, China, Germany, France, Singapore etc. This is only required if you plan to publish your application in those clouds. (Required)
- Microsoft Entra App Gallery doesn't onboard public client applications.
-### Checklist for SCIM Provisioning Apps
-Here's the quick checklist for you before you submit the application request to list your application in Microsoft Entra App Gallery.
+## Checklist for SCIM provisioning apps
+
+Review this checklist before you submit a request to list your SCIM provisioning application in the Microsoft Entra application gallery.
+
+### SCIM API requirements
-#### SCIM API Requirements:
- Support a SCIM 2.0 user and group endpoint (Only User Provisioning is required but User and Group Provisioning both are recommended).
- Support at least 25 requests per second per tenant to ensure that users and groups are provisioned and deprovisioned without delay (Required).
- Validate and test your SCIM User and/or Group Provisioning integration with [SCIM Validator](~/identity/app-provisioning/scim-validator-tutorial.md) and [non-gallery application](~/identity/app-provisioning/use-scim-to-provision-users-and-groups.md#getting-started) template (Required).
@@ -100,7 +110,8 @@ Here's the quick checklist for you before you submit the application request to
- Support updating multiple group memberships with a single PATCH (Recommended).
- Support for SCIM bulk APIs, which can improve the connector performance (Recommended).
-#### SCIM Authentication Requirements:
+### SCIM authentication requirements
+
Support OAuth 2.0 Client Credentials flow in SCIM Provisioning authentication (Required). We aren't onboarding any SCIM Provisioning application with long lived bearer tokens, basic authentication, or Code Auth Grant flow.
- OAuth 2.0 Client Credentials Flow (Required)
@@ -110,21 +121,23 @@ Support OAuth 2.0 Client Credentials flow in SCIM Provisioning authentication (R
- Provide the ability to rotate client secrets regularly. ISVs should enable smooth rotation by allowing multiple active secrets and supporting deletion of old secrets. Alternatively, customers can create new client_id and client_secret.
- Access Token should be only valid for 60 minutes (1 hour) to 6 hours but not less than 60 minutes (Required)
-#### ISV Specific Requirements
+### ISV requirements for SCIM apps
+
- Establish an engineering and support point of contact to support customers post Microsoft Entra App Gallery onboarding and for Microsoft to reach out in future (Required)
- Document your SCIM endpoint publicly and share the link (Required)
- Deploy your SCIM Provisioning to at least 100 mutual customers using the Microsoft Entra non-gallery approach to qualify for the Microsoft Entra App Gallery listing.
-- Share at least five customer Microsoft Entra tenant IDs so that they can participate in a private preview program once the connector is ready for testing.
- If applicable, meet the various compliance requirements for listing your application in different clouds like USGov, China, Germany, France, Singapore, etc. (Required)
-#### Known Limitation on SCIM based user Provisioning
-See this [article](~/identity/app-provisioning/known-issues.md?pivots=app-provisioning) for full list of known limitations in the Microsoft Entra SCIM outbound provisioning.
+### Known limitations for SCIM-based user provisioning
+
+See [Known issues for app provisioning](~/identity/app-provisioning/known-issues.md?pivots=app-provisioning) for the full list of known limitations in the Microsoft Entra SCIM outbound provisioning.
## Create and publish documentation
+Before you submit your application, prepare the documentation your customers and Microsoft need. The following sections describe what to publish on your own site and what to provide to Microsoft.
+
### Provide app documentation for your site
-Ease of adoption is an important factor for those people that make decisions about enterprise software. Documentation that's clear and easy to follow helps your users adopt technology and it reduces support costs.
Ease of adoption is an important factor for those people that make decisions about enterprise software. Documentation that's clear and easy to follow helps your users adopt technology and it reduces support costs.
Create documentation that includes the following information at minimum: