Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
When registering an application with the Microsoft identity platform for developers, you're asked to select which account types your application supports. You can refer to the Help me choose link under Supported account types during the registration process. The value you select for this property has implications on other app object properties.
After the application has been registered, you can check or change the account type that the application supports at any time. Under the Manage pane of your application, search for Manifest and find the signInAudience value. The different account types, and the corresponding signInAudience are shown in the following table:
| Supported account types (Register an application) | signInAudience (Manifest) |
|---|---|
| Accounts in this organizational directory only (Single tenant) | AzureADMyOrg |
| Accounts in any organizational directory (Any Microsoft Entra directory - Multitenant) | AzureADMultipleOrgs |
If you change this property you may need to change other properties first.
Validation differences
See the following table for the validation differences of various properties for different supported account types.
| Property | AzureADMyOrg |
AzureADMultipleOrgs |
|
|---|---|---|---|
Application ID URI (identifierURIs) |
Must be unique in the tenant urn:// schemes are supported Wildcards aren't supported Query strings and fragments are supported Maximum length of 255 characters No limit* on number of identifierURIs |
Must be globally unique urn:// schemes are supported Wildcards aren't supported Query strings and fragments are supported Maximum length of 255 characters No limit* on number of identifierURIs |
|
| National clouds | Supported | Supported | |
Certificates (keyCredentials) |
Symmetric signing key | Symmetric signing key | |
Client secrets (passwordCredentials) |
No limit* | No limit* | |
Redirect URIs (replyURLs) |
See Redirect URI/reply URL restrictions and limitations for more info. | ||
API permissions (requiredResourceAccess) |
No more than 50 total APIs (resource apps), with no more than 10 APIs from other tenants. No more than 400 permissions total across all APIs. | No more than 50 total APIs (resource apps), with no more than 10 APIs from other tenants. No more than 400 permissions total across all APIs. | |
Scopes defined by this API (oauth2Permissions) |
Maximum scope name length of 120 characters Default limit of 700 permission definitions, shared with app roles. See App role limits. |
Maximum scope name length of 120 characters Default limit of 700 permission definitions, shared with app roles. See App role limits. |
|
Authorized client applications (preAuthorizedApplications) |
No set limit* | No set limit* | |
| appRoles | Supported Default limit of 700 permission definitions, shared with exposed delegated permission scopes. See App role limits. |
Supported Default limit of 700 permission definitions, shared with exposed delegated permission scopes. See App role limits. |
|
| Front-channel logout URL | https://localhost is allowed http scheme isn't allowed Maximum length of 255 characters |
https://localhost is allowed http scheme isn't allowed Maximum length of 255 characters |
|
| Display name | Maximum length of 120 characters | Maximum length of 120 characters |
* There's an aggregate limit of 1,200 entries across the collection properties in the application manifest. Individual collection limits also apply. See Manifest limits.
Next steps
For more information about application registrations and their JSON manifest, see: