Installation

Entra Auth Cli can be installed as a .NET global tool or downloaded as a self-contained executable for your platform.

Prerequisites: .NET Runtime 10.0 or later

Install 

  dotnet tool install -g EntraAuthCli

Update 

  dotnet tool update -g EntraAuthCli

Uninstall 

  dotnet tool uninstall -g EntraAuthCli

Verify Installation 

  entra-auth-cli --version

Option 2: Self-Contained Executables

Download the latest release for your platform from the Releases page.

Windows

  1. Download entra-auth-cli-win-x64.exe
  2. Place in a directory in your PATH (e.g., C:\Tools\)
  3. Run from command prompt:
  entra-auth-cli --version

macOS (Apple Silicon)

  1. Download entra-auth-cli-osx-arm64
  2. Make executable and move to PATH:
  chmod +x entra-auth-cli-osx-arm64
sudo mv entra-auth-cli-osx-arm64 /usr/local/bin/entra-auth-cli
  1. Verify:
  entra-auth-cli --version

macOS (Intel)

  1. Download entra-auth-cli-osx-x64
  2. Make executable and move to PATH:
  chmod +x entra-auth-cli-osx-x64
sudo mv entra-auth-cli-osx-x64 /usr/local/bin/entra-auth-cli
  1. Verify:
  entra-auth-cli --version

Linux

  1. Download entra-auth-cli-linux-x64
  2. Make executable and move to PATH:
  chmod +x entra-auth-cli-linux-x64
sudo mv entra-auth-cli-linux-x64 /usr/local/bin/entra-auth-cli
  1. Verify:
  entra-auth-cli --version

⚠️ Linux Security Note: Linux uses XOR obfuscation for secret storage, not cryptographic encryption. Suitable for development only. See Platform-Specific Guides for production alternatives.

Microsoft Graph API Permissions

Some features require Microsoft Graph API permissions (delegated). The tool will prompt you to sign in and consent when needed.

PermissionPurposeRequired For
Application.Read.AllSearch and list app registrations in your tenantdiscover command
Directory.Read.AllResolve service principals and resource app informationdiscover command
Application.ReadWrite.AllCreate client secrets in app registrationsClient secret creation in config create, config edit, discover

πŸ’‘ Note: Basic token generation (get-token, config create with existing secrets) does not require any Graph API permissions. These permissions are only needed for advanced discovery and secret creation features.

Permissions by Feature

FeatureCommandsPermissions Needed
Generate tokensget-tokenNone
Manage profilesconfig create, config edit, config listNone
App discoverydiscoverApplication.Read.All, Directory.Read.All
API permissions lookupdiscover (when selecting scope)Application.Read.All, Directory.Read.All
Create client secretsconfig create, config edit, discoverApplication.ReadWrite.All

Platform Requirements

Windows

  • Windows 10+ (build 1607+)
  • Secure storage via DPAPI

macOS

  • macOS 10.15+ (Catalina or later)
  • Secure storage via Keychain

Linux

  • Ubuntu 20.04+, Fedora 35+, or compatible distributions
  • XOR obfuscation (not cryptographically secure)

Next Steps