Microsoft Entra ID
DeveloperPrerequisites to validate and publish your app
In brief
The article now covers prerequisites for validating and publishing apps, with updated wording and links. Detailed portal submission, request tracking, implementation, and update/removal instructions were removed.
What Entra admins need to know
Administrators supporting app publishers should use the revised page for prerequisite guidance; no action is required.
This editorial summary was generated by AI from the documentation changes. Verify important details in the full Microsoft Learn article.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
Submit a requestPrerequisites to validate and publish your application in Microsoft Entra application galleryapp
You can publish applications you develop in the Microsoft Entra application gallery, which is a catalog of thousands of apps. When you publish your applications, they're made publicly available for users to add to their tenants. For more information, see Overview of the Microsoft Entra application gallery.
To publish your application in the Microsoft Entra application gallery, you need to complete the following tasks:prerequisites.
Make sure that you complete the prerequisites.Create and publish documentation.Submit your application.Join the Microsoft partner network.
Prerequisites
Implement support for single sign-on (SSO). To learn more about supported options, see Plan a single sign-on deployment.
- We won't be onboarding any Password single sign-on applications anymore. Your application should support any of the Federation Protocols as mentioned in the following point.
- For federated applications (SAML/WS-Fed), the application should preferably support software-as-a-service (SaaS) model but it isn't mandatory and it can be an on-premises application as well. Enterprise gallery applications must support multiple user configurations and not any specific user.
- For OpenID Connect, most applications work well as a multitenant application implementing the Microsoft Entra consent framework.
Refer to this link toTo convert the applicationinto multitenant.to multitenant, see Convert a single-tenant app to multitenant. If your application requires extra per-instance configuration, such as customers needing to control their own secrets and certificates or instance configuration then you can publish a single-tenant Open ID Connect application. This type of application publishing is also supported in the Microsoft Entra app gallery now. But the recommended option is to have a multitenant application in a true SaaS model.
Provisioning is optional yet highly recommended. To learn more about Microsoft Entra SCIM, see build a SCIM endpoint and configure user provisioning with Microsoft Entra ID
To implement support of SCIM 2.0 Provisioning follow this tutorial: build a SCIM endpoint and configure user provisioning with Microsoft Entra ID
- If you already support SCIM 2.0 in your application, then you must support client credentials flow for authentication in SCIM. We aren't onboarding applications that use basic authentication, long lived bearer tokens or using code grants for authentication.
We recommend you use Client Credentials flow as articulatedUse the OAuth 2.0 client credentials grant flow. - Additionally you also need to test the provisioning implementation using the non-gallery application in Microsoft Entra ID. You can also test the Client Credentials flow using non-gallery application template. You can learn more about it from here: Test user provisioning with a non-gallery application
- If you already support SCIM 2.0 in your application, then you must support client credentials flow for authentication in SCIM. We aren't onboarding applications that use basic authentication, long lived bearer tokens or using code grants for authentication.
You can sign up for a free, test Development account. It's free for 90 days and you get all of the premium Microsoft Entra features with it. You can also extend the account if you use it for development work: Join the Microsoft 365 Developer Program.
For Open ID Connect applications, there's no application specific documentation. We have only the generic tutorial for all the OpenID Connect applications.
SubmitPublish your application
After you've tested that your application works with Microsoft Entra ID, submit your application request in the Microsoft Application Network portal.
If you see a "Request Access" page, then fill in the business justification and select Request Access.
After your account is added, you can sign in to the Microsoft Application Network portal and submit the request by selecting the Submit Request (ISV) tile on the home page. If you see the "Your sign-in was blocked" error while logging in, see Troubleshoot sign-in to the Microsoft Application Network portal.
Implementation-specific options
On the application Registration form, select the feature that you want to enable. Select OpenID Connect & OAuth 2.0 or SAML 2.0/WS-Fed depending on the feature that your application supports.
If you're implementing a SCIM 2.0 endpoint for user provisioning, select User Provisioning (SCIM 2.0). Download the schema to provide in the onboarding request. For more information, see Export provisioning configuration and roll back to a known good state. The schema that you configured is used when testing the non-gallery application to build the gallery application.
If you wish to register a Microsoft Device Management (MDM) application in the Microsoft Entra application gallery, select Register an MDM app.
You can track application requests by customer name at the Microsoft Application Network portal. For more information, see Application requests by Customers.
Update or Remove the application from the Gallery
You can submit your application update request in the Microsoft Application Network portal.
If you see a "Request Access" page, then fill in the business justification and select Request Access.
After the account is added, you can sign in to the Microsoft Application Network portal and submit the request by selecting the Submit Request (ISV) tile on the home page and select Update my application’s listing in the gallery and select one of the following options as per your choice -
If you want to update an application's SSO feature, selectUpdate my application’s Federated SSO feature.If you want to update Password SSO feature, selectUpdate my application’s Password SSO feature.If you want to upgrade your listing from Password SSO to Federated SSO, selectUpgrade my application from Password SSO to Federated SSO.If you want to update an MDM listing, selectUpdate my MDM app.If you want to update an existing User Provisioning integration, selectImprove my application’s User Provisioning feature.If you want to remove the application from Microsoft Entra application gallery, selectRemove my application listing from the gallery.
If you see the Your sign-in was blocked error while logging in, see Troubleshoot sign-in to the Microsoft Application Network portalPublish your app to Microsoft Entra App Gallery.
Join the Microsoft partner network
@@ -1,29 +1,20 @@ ----title: Submit a request to publish your application-description: Learn how to publish your application in Microsoft Entra application gallery.+title: Prerequisites to validate and publish your app+description: Learn about the prerequisites and requirements to validate and publish your application in the Microsoft Entra application gallery. ms.topic: how-to- ms.date: 06/22/2026 ms.reviewer: jeedes ms.custom: kr2b-contr-experiment, enterprise-apps-article ai-usage: ai-assisted -#customer intent: As a developer, I want to learn about the requirement for submitting my application to the Microsoft Entra application gallery, so that it can be publicly available for users to add to their tenants.+#customer intent: As a developer, I want to learn about the prerequisites for submitting my application to the Microsoft Entra application gallery, so that it can be publicly available for users to add to their tenants. --- -# Submit a request to publish your application in Microsoft Entra application gallery+# Prerequisites to validate and publish your app You can publish applications you develop in the Microsoft Entra application gallery, which is a catalog of thousands of apps. When you publish your applications, they're made publicly available for users to add to their tenants. For more information, see [Overview of the Microsoft Entra application gallery](overview-application-gallery.md). -To publish your application in the Microsoft Entra application gallery, you need to complete the following tasks:--- Make sure that you complete the prerequisites.-- Create and publish documentation.-- Submit your application.-- Join the Microsoft partner network.--> [!NOTE]-> We're currently not accepting new SSO or provisioning requests while we focus on the [Secure Future Initiative](https://www.microsoft.com/security/blog/topic/secure-future-initiative/). Update requests for SSO are processed on a case-by-case basis. We aren't updating any System for Cross-domain Identity Management (SCIM) based User Provisioning applications for now. Enabling SCIM based user provisioning for the existing gallery application is also treated as a new application request.+To publish your application in the Microsoft Entra application gallery, you need to complete the following prerequisites. ## Prerequisites@@ -31,14 +22,14 @@ To publish your application in the gallery, you must first read and agree to spe - Implement support for *single sign-on (SSO)*. To learn more about supported options, see [Plan a single sign-on deployment](plan-sso-deployment.md). - We won't be onboarding any Password single sign-on applications anymore. Your application should support any of the Federation Protocols as mentioned in the following point. - For federated applications (SAML/WS-Fed), the application should preferably support [software-as-a-service (SaaS) model](https://azure.microsoft.com/overview/what-is-saas/) but it isn't mandatory and it can be an on-premises application as well. Enterprise gallery applications must support multiple user configurations and not any specific user.- - For OpenID Connect, most applications work well as a multitenant application implementing the [Microsoft Entra consent framework](~/identity-platform/application-consent-experience.md). Refer to [this](~/identity-platform/howto-convert-app-to-be-multi-tenant.md) link to convert the application into multitenant. If your application requires extra per-instance configuration, such as customers needing to control their own secrets and certificates or instance configuration then you can publish a single-tenant Open ID Connect application. This type of application publishing is also supported in the Microsoft Entra app gallery now. But the recommended option is to have a multitenant application in a true SaaS model.+ - For OpenID Connect, most applications work well as a multitenant application implementing the [Microsoft Entra consent framework](~/identity-platform/application-consent-experience.md). To convert the application to multitenant, see [Convert a single-tenant app to multitenant](~/identity-platform/howto-convert-app-to-be-multi-tenant.md). If your application requires extra per-instance configuration, such as customers needing to control their own secrets and certificates or instance configuration then you can publish a single-tenant Open ID Connect application. This type of application publishing is also supported in the Microsoft Entra app gallery now. But the recommended option is to have a multitenant application in a true SaaS model. - Provisioning is optional yet highly recommended. To learn more about Microsoft Entra SCIM, see [build a SCIM endpoint and configure user provisioning with Microsoft Entra ID](~/identity/app-provisioning/use-scim-to-provision-users-and-groups.md) - To implement support of SCIM 2.0 Provisioning follow this tutorial: [build a SCIM endpoint and configure user provisioning with Microsoft Entra ID](~/identity/app-provisioning/use-scim-to-provision-users-and-groups.md) - - If you already support SCIM 2.0 in your application, then you must support client credentials flow for authentication in SCIM. We aren't onboarding applications that use basic authentication, long lived bearer tokens or using code grants for authentication. We recommend you use Client Credentials flow as articulated [here](~/identity/app-provisioning/use-scim-to-provision-users-and-groups.md#oauth-20-client-credentials-grant-flow)+ - If you already support SCIM 2.0 in your application, then you must support client credentials flow for authentication in SCIM. We aren't onboarding applications that use basic authentication, long lived bearer tokens or using code grants for authentication. Use the [OAuth 2.0 client credentials grant flow](~/identity/app-provisioning/use-scim-to-provision-users-and-groups.md#oauth-20-client-credentials-grant-flow). - Additionally you also need to test the provisioning implementation using the non-gallery application in Microsoft Entra ID. You can also test the Client Credentials flow using non-gallery application template. You can learn more about it from here: [Test user provisioning with a non-gallery application](~/identity/app-provisioning/use-scim-to-provision-users-and-groups.md#getting-started) You can sign up for a free, test Development account. It's free for 90 days and you get all of the premium Microsoft Entra features with it. You can also extend the account if you use it for development work: [Join the Microsoft 365 Developer Program](/office/developer-program/microsoft-365-developer-program).@@ -166,45 +157,9 @@ When your SAML application is added to the gallery, documentation is created tha For Open ID Connect applications, there's no application specific documentation. We have only the generic [tutorial](~/identity-platform/v2-protocols-oidc.md) for all the OpenID Connect applications. -## Submit your application--After you've tested that your application works with Microsoft Entra ID, submit your application request in the [Microsoft Application Network portal](https://microsoft.sharepoint.com/teams/apponboarding/Apps).--If you see a "Request Access" page, then fill in the business justification and select **Request Access**.--After your account is added, you can sign in to the Microsoft Application Network portal and submit the request by selecting the **Submit Request (ISV)** tile on the home page. If you see the "Your sign-in was blocked" error while logging in, see [Troubleshoot sign-in to the Microsoft Application Network portal](troubleshoot-app-publishing.md).--### Implementation-specific options--On the application **Registration** form, select the feature that you want to enable. Select **OpenID Connect & OAuth 2.0** or **SAML 2.0/WS-Fed** depending on the feature that your application supports.--If you're implementing a [SCIM](~/identity/app-provisioning/use-scim-to-provision-users-and-groups.md) 2.0 endpoint for user provisioning, select **User Provisioning (SCIM 2.0)**. Download the schema to provide in the onboarding request. For more information, see [Export provisioning configuration and roll back to a known good state](~/identity/app-provisioning/export-import-provisioning-configuration.md). The schema that you configured is used when testing the non-gallery application to build the gallery application.--If you wish to register a Microsoft Device Management (MDM) application in the Microsoft Entra application gallery, select **Register an MDM app**.--You can track application requests by customer name at the Microsoft Application Network portal. For more information, see [Application requests by Customers](https://microsoft.sharepoint.com/teams/apponboarding/Apps/SitePages/AppRequestsByCustomers.aspx).--## Update or Remove the application from the Gallery--You can submit your application update request in the [Microsoft Application Network portal](https://microsoft.sharepoint.com/teams/apponboarding/Apps).--If you see a "Request Access" page, then fill in the business justification and select **Request Access**.--After the account is added, you can sign in to the Microsoft Application Network portal and submit the request by selecting the **Submit Request (ISV)** tile on the home page and select **Update my application’s listing in the gallery** and select one of the following options as per your choice ---* If you want to update an application's SSO feature, select **Update my application’s Federated SSO feature**.--* If you want to update Password SSO feature, select **Update my application’s Password SSO feature**.--* If you want to upgrade your listing from Password SSO to Federated SSO, select **Upgrade my application from Password SSO to Federated SSO**.--* If you want to update an MDM listing, select **Update my MDM app**.--* If you want to update an existing User Provisioning integration, select **Improve my application’s User Provisioning feature**.--* If you want to remove the application from Microsoft Entra application gallery, select **Remove my application listing from the gallery**.+## Publish your application -If you see the **Your sign-in was blocked** error while logging in, see [Troubleshoot sign-in to the Microsoft Application Network portal](troubleshoot-app-publishing.md).+After you've tested that your application works with Microsoft Entra ID, see [Publish your app to Microsoft Entra App Gallery](publish-app-gallery.md). ## Join the Microsoft partner network