@@ -173,6 +173,7 @@
     "manageengine_sdp",
     "mem0",
     "memory",
+    "microsoft-app-credentials",
     "microsoft_ad",
     "microsoft_dataverse",
     "microsoft_dynamics_365",
 
@@ -0,0 +1,72 @@
+---
+title: Microsoft app credentials
+description: Run Microsoft Entra ID, SharePoint, Dataverse, and Dynamics 365 blocks as an app registration with a client secret, a certificate, or a keyless federated credential that trusts Sim
+---
+
+import { Callout } from '@/components/ui/callout'
+import { Step, Steps } from '@/components/ui/steps'
+
+A Microsoft app credential signs in as a Microsoft Entra app registration instead of a person (the OAuth 2.0 client credentials flow). One credential works for the **Azure AD** (Microsoft Entra ID), **SharePoint**, **Microsoft Dataverse**, and **Dynamics 365** blocks. Connecting a Microsoft account through OAuth keeps working exactly as before; the app credential is an additional option in the same account picker.
+
+<Callout type="info">
+Outlook, OneDrive, Excel, Word, Planner, and Teams act on behalf of a signed-in person and don't accept an app credential. The Azure AD **Reset password** operation also needs a signed-in admin, because Microsoft Graph doesn't support application permissions for it.
+</Callout>
+
+## Choose how the app signs in
+
+| Option | What Sim stores | When to use it |
+| --- | --- | --- |
+| **Federated credential (keyless, via Sim OIDC)** | Nothing secret: the tenant ID, client ID, and this credential's subject | Recommended. No secret to rotate, expire, or leak. |
+| **Client secret** | The tenant ID, client ID, and client secret | Quick setup. Secrets expire, so plan to rotate them. |
+| **Certificate** | The tenant ID, client ID, the certificate, and its private key | When your organization requires certificate credentials. Sim signs each token request with the key. |
+
+Every option resolves on Sim's servers at run time, and tokens never appear in block outputs, logs, or anything a model sees. Azure AD and SharePoint blocks get a Microsoft Graph token; Dataverse and Dynamics 365 blocks get a token for the credential's own environment.
+
+## Register the app and grant permissions
+
+<Steps>
+  <Step>
+    In the [Microsoft Entra admin center](https://entra.microsoft.com), go to **App registrations** → **New registration**. A single-tenant app is fine. Copy the **Application (client) ID** and **Directory (tenant) ID** from its Overview page.
+  </Step>
+  <Step>
+    Under **API permissions** → **Add a permission** → **Microsoft Graph** → **Application permissions**, add what your workflows need, then select **Grant admin consent**. Application permissions always need admin consent. For example:
+    - Azure AD: `User.Read.All` or `User.ReadWrite.All`, `Group.ReadWrite.All`, `GroupMember.ReadWrite.All`, `AuditLog.Read.All` for sign-in and audit logs, `Policy.Read.All` for conditional access, `UserAuthenticationMethod.Read.All` for authentication methods, `User.RevokeSessions.All` to revoke sessions. Setting a password needs `User-PasswordProfile.ReadWrite.All` **and** the app assigned at least the User Administrator role.
+    - SharePoint: `Sites.Read.All` or `Sites.ReadWrite.All`. Creating and editing pages needs `Sites.ReadWrite.All`. `Sites.Selected` limits the app to sites you grant it, but searching for sites doesn't work with it, so enter site IDs directly.
+  </Step>
+  <Step>
+    Dataverse and Dynamics 365 don't use API permissions. Instead, in the [Power Platform admin center](https://admin.powerplatform.microsoft.com), open the environment → **Settings** → **Users + permissions** → **Application users** → **New app user**, add this app, pick a business unit, and assign a security role. Then enter the environment URL (like `https://contoso.crm.dynamics.com`) on the credential.
+  </Step>
+</Steps>
+
+## Set up a keyless federated credential [#keyless-federated-credential]
+
+<Steps>
+  <Step>
+    In Sim, add a **Microsoft app credential**, choose **Federated credential (keyless, via Sim OIDC)**, and enter the tenant ID and client ID. The dialog shows an **Issuer**, **Audience**, and **Subject**.
+  </Step>
+  <Step>
+    In the app registration, go to **Certificates & secrets** → **Federated credentials** → **Add credential** → **Other issuer**. Paste the **Issuer** and the **Subject identifier** exactly as shown, set the audience to `api://AzureADTokenExchange` (the dialog's value), and give it a name. Matching is case-sensitive.
+  </Step>
+  <Step>
+    Save in Sim. Sim requests a token as the app and reads the app's own service principal from Microsoft Graph, which needs no extra permission. It also checks that the app refuses a subject no credential holds, so only this credential can use the app. A new federated credential can take a few minutes to take effect; if saving fails with a matching error right after you add it, wait and try again.
+  </Step>
+</Steps>
+
+An app can have up to 20 federated credentials. Each Sim credential has its own subject, and reconnecting keeps the subject by default so the federated credential keeps working. Keyless credentials are available for workspace credentials, not organization credentials.
+
+## Use a client secret or certificate
+
+- **Client secret:** under **Certificates & secrets** → **Client secrets** → **New client secret**, copy the secret's **Value** (not the Secret ID).
+- **Certificate:** upload the certificate's public part (`.cer`, `.pem`, or `.crt`) under **Certificates & secrets** → **Certificates**, then paste the certificate and its unencrypted PEM RSA private key (2048 to 4096 bits) into Sim. Sim checks the key belongs to the certificate before saving, and signs a PS256 assertion with the certificate's SHA-256 thumbprint.
+
+## Self-hosted deployments
+
+Keyless credentials need `WORKLOAD_IDENTITY_SIGNING_KEY` set and an `https` issuer Microsoft Entra can reach over the public internet. See [AWS credentials](/integrations/aws-credentials#self-hosted-deployments) for the same settings and for rotating the signing key. App credentials use the global Microsoft Entra endpoint (`login.microsoftonline.com`) and public-cloud Dataverse environments.
+
+## Troubleshooting
+
+- **"No federated credential on this app matches…":** the federated credential's issuer, subject, or audience differs from the dialog (check case and trailing slashes), it's on a different app than the client ID, or it was added moments ago.
+- **"Microsoft Entra rejected the client secret":** you pasted the Secret ID, or the secret was deleted. **"This client secret has expired":** create a new one and reconnect.
+- **"…could not verify the signed assertion":** the certificate in Sim isn't the one uploaded to the app registration.
+- **"…the Dataverse environment did not accept it":** add the app as an application user of the environment with a security role.
+- **A block fails with 403 "Insufficient privileges":** the app is missing an application permission for that operation, or admin consent wasn't granted after adding it.
@@ -13,6 +13,8 @@ import { ReferenceDetails } from "@/components/ui/reference-details"
 Use [Microsoft Entra ID](https://entra.microsoft.com), formerly Azure Active Directory, to manage directory users, groups, memberships, licenses, passwords, sign-in sessions, app roles, and directory roles. Read sign-in and audit logs, registered devices, and conditional access policies; device writes are excluded.
 
 Use OData filters to query directory records. Grant the connection the permissions and administrative roles required by each operation before using it for onboarding, offboarding, or access review. Microsoft 365 groups have a 30-day recovery window. Cloud security-group recovery is a [public-cloud preview with tenant restrictions](https://learn.microsoft.com/en-us/entra/identity/users/groups-restore-deleted); confirm eligibility before deleting a group.
+
+To run as an app registration instead of a signed-in admin, use a [Microsoft app credential](/integrations/microsoft-app-credentials).
 {/* MANUAL-CONTENT-END */}
 
 ## OAuth scopes [#oauth-scopes]
 
@@ -11,6 +11,8 @@ import { ReferenceDetails } from "@/components/ui/reference-details"
 
 {/* MANUAL-CONTENT-START:intro */}
 Use [Microsoft Dataverse](https://learn.microsoft.com/en-us/power-apps/maker/data-platform/data-platform-intro) to manage records and relationships in Dynamics 365, Power Platform, or custom environments. The block also supports queries, bulk operations, file transfer, metadata lookup, and Dataverse actions and functions.
+
+To run as an application user instead of a signed-in person, use a [Microsoft app credential](/integrations/microsoft-app-credentials).
 {/* MANUAL-CONTENT-END */}
 
 ## OAuth scopes [#oauth-scopes]
 
@@ -18,6 +18,8 @@ Two block operations intentionally reuse the new CRM tools under a simpler CRM l
 - **Assign Record** updates the selected record's `ownerid@odata.bind` to an explicitly chosen user or team.
 
 Connect one credential per Dynamics environment. The credential is bound to that environment during Microsoft OAuth, and CRM requests refuse a different environment. This release supports public-cloud Dataverse hosts only.
+
+To run as an application user instead of a signed-in person, use a [Microsoft app credential](/integrations/microsoft-app-credentials).
 {/* MANUAL-CONTENT-END */}
 
 ## OAuth scopes [#oauth-scopes]
 
@@ -11,6 +11,8 @@ import { ReferenceDetails } from "@/components/ui/reference-details"
 
 {/* MANUAL-CONTENT-START:intro */}
 Use [SharePoint](https://www.microsoft.com/en-us/microsoft-365/sharepoint/collaboration) in Sim to list sites, manage pages and lists, update list items, and upload or download files. Connect a Microsoft account through OAuth, then choose the target site or resource for each operation.
+
+To run as an app registration instead of a signed-in person, use a [Microsoft app credential](/integrations/microsoft-app-credentials).
 {/* MANUAL-CONTENT-END */}
 
 ## OAuth scopes [#oauth-scopes]
 
@@ -57,6 +57,9 @@
       "integration": "linear",
       "title": "API keys"
     },
+    "microsoft-app-credentials": {
+      "title": "Microsoft app credentials"
+    },
     "monday-service-account": {
       "integration": "monday",
       "title": "API tokens"
 
@@ -37,13 +37,15 @@ import {
   AWS_SERVICE_ACCOUNT_PROVIDER_ID,
   DATABRICKS_SERVICE_ACCOUNT_PROVIDER_ID,
   GOOGLE_SERVICE_ACCOUNT_PROVIDER_ID,
+  MICROSOFT_APP_SERVICE_ACCOUNT_PROVIDER_ID,
   OCI_API_KEY_SERVICE_ACCOUNT_PROVIDER_ID,
   ORACLE_DATABASE_SERVICE_ACCOUNT_PROVIDER_ID,
   SLACK_CUSTOM_BOT_PROVIDER_ID,
 } from '@/lib/oauth/types'
 import { AwsAccountModal } from '@/app/workspace/[workspaceId]/integrations/components/connect-service-account-modal/aws-account-modal'
 import { ClientCredentialAccountModal } from '@/app/workspace/[workspaceId]/integrations/components/connect-service-account-modal/client-credential-account-modal'
 import { DatabricksAccountModal } from '@/app/workspace/[workspaceId]/integrations/components/connect-service-account-modal/databricks-account-modal'
+import { MicrosoftAppAccountModal } from '@/app/workspace/[workspaceId]/integrations/components/connect-service-account-modal/microsoft-app-account-modal'
 import { OracleDatabaseAccountModal } from '@/app/workspace/[workspaceId]/integrations/components/connect-service-account-modal/oracle-database-account-modal'
 import { SnowflakeAccountModal } from '@/app/workspace/[workspaceId]/integrations/components/connect-service-account-modal/snowflake-account-modal'
 import { TokenServiceAccountModal } from '@/app/workspace/[workspaceId]/integrations/components/connect-service-account-modal/token-service-account-modal'
@@ -64,6 +66,7 @@ export type ServiceAccountProviderId =
   | typeof ORACLE_DATABASE_SERVICE_ACCOUNT_PROVIDER_ID
   | typeof AWS_SERVICE_ACCOUNT_PROVIDER_ID
   | typeof DATABRICKS_SERVICE_ACCOUNT_PROVIDER_ID
+  | typeof MICROSOFT_APP_SERVICE_ACCOUNT_PROVIDER_ID
   | TokenServiceAccountProviderId
   | ClientCredentialAccountProviderId
 
@@ -200,6 +203,21 @@ export function ConnectServiceAccountModal({
       />
     )
   }
+  if (serviceAccountProviderId === MICROSOFT_APP_SERVICE_ACCOUNT_PROVIDER_ID) {
+    return (
+      <MicrosoftAppAccountModal
+        open={open}
+        onOpenChange={onOpenChange}
+        workspaceId={workspaceId}
+        organizationId={organizationId}
+        serviceIcon={serviceIcon}
+        credentialId={credentialId}
+        initialDisplayName={credentialDisplayName}
+        initialDescription={credentialDescription}
+        onCreated={onCreated}
+      />
+    )
+  }
   if (serviceAccountProviderId === AWS_SERVICE_ACCOUNT_PROVIDER_ID) {
     return (
       <AwsAccountModal