Entra Authentication Events for .NET
Customize Entra ID authentication flows with Azure Functions.
The document covers input validation, managed identity, error handling, and permission guidance, with no apparent malware or gross overreach; however, the external-API example uses an unauthenticated hard-coded URL, the OTP example handles plaintext codes and logs phone numbers, and it lacks data-flow disclosure, sensitive-data protections, confirmation, timeout, rollback, and dependency-security guidance, so points are deducted.
The document presents several event paths and some exception handling, but provides no skill-specific committed tests or reproducible build evidence; snippets omit some using directives and compatibility/deployment prerequisites, while external-data failures, empty responses, timeouts, and serialization errors are incompletely handled, warranting only limited static reliability.
The audience, SDK, event types, and trigger terms are reasonably clear, covering token, attribute-collection, and OTP scenarios; however, non-fit boundaries, runtime-model differences, input/output contracts, regional reachability, and Chinese-language usage are not sufficiently documented, so trigger precision and environment-fit evidence remain limited.
The SKILL.md has clear sections for installation, workflows, type reference, configuration, practices, error handling, related SDKs, licensing, and version metadata; however, metadata says 1.0.0 while the body calls package version 1.1.0 current, and there is no changelog, explicit maintenance owner, compatibility matrix, FAQ, complete dependency note, or known-limitations section, so points are deducted.
The examples cover the main authentication events and provide usable scaffolding for common code-generation tasks; however, OTP delivery is an empty stub, the external-data API is a placeholder, and there are no real tests, complete project files, deployment validation, or detailed configuration boundaries, leaving substantial manual review and therefore a deduction within the static cap.
The document lists NuGet, Microsoft Learn, and GitHub references, while the repository context shows general CI, evaluation workflows, and harness tests; nevertheless, there is no skill-specific acceptance-criteria file, test suite, or third-party execution evidence, so key API and configuration claims cannot be independently reproduced from the supplied files and the static ceiling applies.
- Do not copy the external-API example directly; add authentication, authorization, TLS, timeouts, retries, response validation, and secret management.
- Avoid logging phone numbers, OTPs, or other sensitive authentication data, and define OTP lifetime, replay protection, rate limits, and failure recovery.
- Before release, verify package version 1.1.0 against the selected Azure Functions .NET hosting model, type names, and Entra configuration requirements.
- Replace the placeholder SendSmsAsync implementation, example.com endpoint, Graph permission, and API URI with validated implementations and least-privilege settings.
What it does & when to use it
This skill is for .NET developers handling Microsoft Entra ID custom authentication events with Azure Functions. It covers token issuance, attribute collection, and custom one-time-password delivery. The included C# examples show event triggers, response actions, error handling, logging, and Function App configuration. It fits projects that need token enrichment or customized sign-up and verification flows, but it does not deploy or configure the complete Azure solution for you.
Shows how to install the Microsoft.Azure.WebJobs.Extensions.AuthenticationEvents NuGet package and create Azure Functions triggered by WebJobsAuthenticationEventsTriggerAttribute. It covers OnTokenIssuanceStart, OnAttributeCollectionStart, OnAttributeCollectionSubmit, and OnOtpSend; reads user IDs, correlation IDs, submitted attributes, and OTP context; and produces claims, prefill values, block pages, validation errors, modified attributes, or OTP success/failure responses. It also demonstrates fetching claims from an external API, configuring Program.cs, host.json, and local.settings.json, and registering an API, custom authentication extension, and user-flow link in Entra ID.
- A .NET developer for an Entra ID sign-in flow needs to add department, role, or employee-number claims to issued tokens.
- A team building an external-identity sign-up flow needs to prefill, validate, or modify collected user attributes.
- A developer needs to reject registrations from selected email domains during attribute submission.
- A team needs to deliver one-time passwords through an SMS, email, or push-notification provider.
- An engineer maintaining an Azure Functions authentication extension needs examples for error handling, correlation logging, and Application Insights monitoring.
Pros & cons
- Covers four core authentication event types with concrete C# examples.
- Includes token enrichment, attribute validation, attribute modification, and custom OTP workflows.
- Documents Entra ID setup, error handling, correlation logging, and performance practices.
- The repository and skill are MIT licensed, and the skill metadata identifies Microsoft as author.
- Requires .NET, Azure Functions, and Entra ID configuration; it is not a standalone deployment solution.
- External API access and OTP delivery providers in the examples must be implemented by the adopter.
- The source provides no skill-specific test scenarios or platform compatibility results.
- The stated current version is v1.1.0, but the source does not specify supported .NET target frameworks or numeric timeout limits.
How to install
Install the collection with npx skills add microsoft/skills, then select this skill in the wizard; skills are installed in the selected agent directory, such as .github/skills/ for GitHub Copilot. Alternatively, clone the repository and copy .github/plugins/azure-sdk-dotnet/skills/microsoft-azure-webjobs-extensions-authentication-events-dotnet/. Install the SDK in a .NET project with dotnet add package Microsoft.Azure.WebJobs.Extensions.AuthenticationEvents.
How to use
Place the skill folder in your agent's skills directory and use a targeted request such as: Create an Azure Functions OnTokenIssuanceStart handler that adds department and employeeId claims to Entra ID tokens. Request the attribute-collection or OTP event pattern when needed. After deploying the Function App, register the API, create the Custom Authentication Extension, and link it to a User Flow in Entra ID. The source does not provide deployment commands.
Compared to similar skills
Microsoft.Identity.Web is described as a web-app authentication SDK, while Azure.Identity is for Azure authentication. This skill focuses on custom Entra ID authentication events hosted in Azure Functions.