title: How do I register my application locally created with one I created in Azure Active Directory?
body: <p>I am following directions here for learning the AzureKeyVault config settings</p>
  
  <blockquote>
    <h1>Key Vault Configuration Provider sample application (ASP.NET Core 2.x)</h1>
    
    <p>This sample illustrates the use of the Azure Key Vault Configuration
    Provider for ASP.NET Core 2.x. For the ASP.NET Core 1.x sample, see
    <a href="https://github.com/aspnet/Docs/tree/master/aspnetcore/security/key-vault-configuration/samples/basic-sample/1.x" rel="nofollow noreferrer">Key Vault Configuration Provider sample application (ASP.NET Core
    1.x)</a>.</p>
    
    <p>For more information on how the sample works, see the Azure Key Vault
    configuration provider topic.</p>
    
    <h2>Using the sample</h2>
    
    <ol>
    <li><p>Create a key vault and set up Azure Active Directory (Azure AD) for the application following the guidance in <a href="https://azure.microsoft.com/documentation/articles/key-vault-get-started/" rel="nofollow noreferrer">Get started with Azure Key
    Vault</a>.</p>
    
    <ul>
    <li>Add secrets to the key vault using the <a href="/powershell/module/azurerm.keyvault">AzureRM Key Vault PowerShell Module</a> available from the
    <a href="https://www.powershellgallery.com/packages/AzureRM.KeyVault" rel="nofollow noreferrer">PowerShell
    Gallery</a>,
    the <a href="/rest/api/keyvault/">Azure Key Vault REST API</a>, or the <a href="https://portal.azure.com/" rel="nofollow noreferrer">Azure
    Portal</a>. Secrets are created as either
    <em>Manual</em> or <em>Certificate</em> secrets. <em>Certificate</em> secrets are certificates for use by apps and services but are not supported by the
    configuration provider. You should use the <em>Manual</em> option to create
    name-value pair secrets for use with the configuration provider.
    
    <ul>
    <li>Simple secrets are created as name-value pairs. Azure Key Vault secret names are limited to alphanumeric characters and dashes.</li>
    <li>Hierarchical values (configuration sections) use <code>--</code> (two dashes) as a separator in the sample. Colons, which are normally used
    to delimit a section from a subkey in ASP.NET Core
    configuration, aren't allowed
    in secret names. Therefore, two dashes are used and swapped for a
    colon when the secrets are loaded into the app's configuration.</li>
    <li>Create two <em>Manual</em> secrets with the following name-value pairs. The first secret is a simple name and value, and the second
    secret creates a secret value with a section and subkey in the secret
    name:
    
    <ul>
    <li><code>SecretName</code>: <code>secret_value_1</code></li>
    <li><code>Section--SecretName</code>: <code>secret_value_2</code>    </li>
    </ul></li>
    </ul></li>
    <li><strong>Register the sample app with Azure Active Directory.</strong>    </li>
    <li><strong>Authorize the app to
    access the key vault. When you use the
    <code>Set-AzureRmKeyVaultAccessPolicy</code> PowerShell cmdlet to authorize the
    app to access the key vault, provide <code>List</code> and <code>Get</code> access to
    secrets with <code>-PermissionsToSecrets list,get</code>.</strong></li>
    </ul></li>
    <li><p>Update the app's <em>appsettings.json</em> file with the values of <code>Vault</code>, <code>ClientId</code>, and <code>ClientSecret</code>.</p></li>
    <li>Run the sample app, which obtains its configuration values from <code>IConfigurationRoot</code> with the same name as the secret name.    *
    Non-hierarchical values: The value for <code>SecretName</code> is obtained with
    <code>config["SecretName"]</code>.    * Hierarchical values (sections): Use <code>:</code>
    (colon) notation or the <code>GetSection</code> extension method. Use either of
    these approaches to obtain the configuration value:
    
    <ul>
    <li><code>config["Section:SecretName"]</code></li>
    <li><code>config.GetSection("Section")["SecretName"]</code></li>
    </ul></li>
    </ol>
  </blockquote>
  
  <p>Okay so I have copied the name of my application into Azure Active Directory as an 'Enterprise Application'.  And I have added 'Access policies' for 'get' and 'list' in Azure for my ADD object I just created.  Yet I get this error in the program when attempting to start the application:</p>
  
  <pre><code>Exception: {"error":"unauthorized_client","error_description":"AADSTS70001: 
  Application with identifier '(guid)' was not found in the directory ...(continues)
  </code></pre>
  
  <p><strong>Update 8-4-18</strong>
  Okay I found out that Azure uses the 'ClientId' and 'ClientSecret' in the local appsettings.json to connect to what Azure registers in this tutorial: <a href="https://docs.microsoft.com/en-us/azure/azure-resource-manager/resource-group-create-service-principal-portal#log-in-as-the-application" rel="nofollow noreferrer">https://docs.microsoft.com/en-us/azure/azure-resource-manager/resource-group-create-service-principal-portal#log-in-as-the-application</a></p>
  
  <ol>
  <li>I get the clientId in appsettings.json from the applicationId on ADD I create with ADD>App Registrations>New</li>
  <li>I click settings in ADD on the app I just created and create a key with an expiration to store as ClientSecret in appsettings.json. </li>
  <li>I change my 'Vault' in appsettings to my named vault. </li>
  <li>I run the powershell above to give access or else do it in ADD. </li>
  </ol>
  
  <p>So now I am getting a simpler error: </p>
  
  <pre><code>'Microsoft.Azure.KeyVault.Models.KeyVaultErrorException: 'Access denied''
  </code></pre>
  
  <p>I have tried running as Administrator in Visual Studio.  I went under Subscriptions in Azure>Access Control>(IAM)>set my new apps to Reader.  </p>