Quick Start

Generate your first Entra ID access token in just a few minutes!

Step 1: Install the Tool 

1

dotnet tool install -g EntraTokenCli

See all installation options →

Step 2: Create Your First Profile

Run the interactive profile creation:

1

entratool config create

You’ll be prompted for:

  • Profile name: myprofile (or any name you choose)
  • Tenant ID: Your Azure tenant ID (e.g., contoso.onmicrosoft.com or GUID)
  • Client ID: Your app registration client ID
  • Scopes: https://graph.microsoft.com/.default (default for Microsoft Graph)
  • Auth method: Choose ClientSecret for this quick start
  • Client secret: Your app’s client secret (securely stored)

Example:

Profile name: myprofile
Tenant ID: contoso.onmicrosoft.com
Client ID: 12345678-1234-1234-1234-123456789abc
Scopes (comma-separated): https://graph.microsoft.com/.default
Authentication method: ClientSecret
Client secret: ****

💡 Tip: Don’t have an app registration? See the Complete Tutorial for step-by-step setup.

Step 3: Generate a Token 

1

entratool get-token -p myprofile

The tool will:

  1. Authenticate using your profile credentials
  2. Request a token from Entra ID
  3. Display the token details
  4. Copy the token to your clipboard (if available)

Expected output:

✓ Token retrieved successfully
  Expires: 2025-12-26 15:30:00 UTC (59 minutes)
  Scopes: https://graph.microsoft.com/.default
  Token copied to clipboard!

Step 4: Use Your Token

The token is now in your clipboard. Use it to call APIs:

1
2
3

# Example: Get current user info from Microsoft Graph
curl -H "Authorization: Bearer YOUR_TOKEN_HERE" \
  https://graph.microsoft.com/v1.0/me

Or read from the token file in headless environments:

1
2
3

TOKEN=$(cat ~/.config/entratool/last-token.txt)
curl -H "Authorization: Bearer $TOKEN" \
  https://graph.microsoft.com/v1.0/me

Step 5: Inspect the Token (Optional)

Want to see what’s inside your token?

1

entratool inspect $(cat ~/.config/entratool/last-token.txt)

This decodes the JWT and displays claims like:

  • Audience (aud)
  • Issuer (iss)
  • Subject (sub)
  • Expiration (exp)
  • Scopes (scp/roles)

What’s Next?

Learn the basics:

Explore features:

Try recipes:

Troubleshooting

Token generation fails?

  • Verify your client ID and secret are correct
  • Check app registration permissions in Azure
  • Ensure tenant ID is correct

Token not copied to clipboard?

  • In headless environments, use the file output
  • Use --no-clipboard flag to suppress clipboard operations

See full troubleshooting guide →