Dataverse Managed Identity

Claude Code skills for building Dataverse plugins that call Azure services using Power Platform Managed Identity. No secrets, no certificates in config, no credentials to rotate.

What this does

You describe what Azure service you want to call. The skill walks you through every phase: Azure resource setup, plugin project, code, signing, registration, FIC configuration, and verification. It guides one step at a time and waits for you to confirm before moving on.

The plugin acquires a Bearer token at runtime using IManagedIdentityService. Dataverse proves the plugin's identity to Entra ID through a signed assertion. If the assertion matches a Federated Identity Credential on a User-Assigned Managed Identity, Entra ID issues a token. No secret is ever stored or transmitted.

Prerequisites

• Claude Code (CLI, desktop app, or IDE extension)
• Visual Studio with .NET Framework 4.6.2 targeting pack
• Plugin Registration Tool (from NuGet: Microsoft.CrmSdk.XrmTooling.PluginRegistrationTool)
• Azure subscription with permissions to create Managed Identities and App Registrations
• A Dataverse environment with admin access
• PowerShell 7+ with the Az module (Install-Module Az)
• Windows SDK or Visual Studio with signtool.exe

Quick start

git clone https://github.com/Shayanrs31/dataverse-managed-identity.git
cd dataverse-managed-identity
claude

Then type:

/dataverse-managed-identity

Tell it what Azure service you want to call (API Management, Key Vault, Storage, Function App, etc.) and follow the phases.

What's included

.claude/
  skills/
    dataverse-managed-identity/
      SKILL.md          -- the main skill (11 phases, Azure to verification)
      reference.md      -- plugin code template and quick reference
  agents/
    dv-plugin-plan.md   -- plans plugin type, config, Azure resources
    dv-plugin-build.md  -- implements plugin code with MI token pattern
    dv-plugin-deploy.md -- build, sign, register, link MI, verify
  scripts/
    new-signing-cert.ps1          -- generate a dev Authenticode certificate
    sign-dll.ps1                  -- build + sign + verify in one step
    Register-ManagedIdentity.ps1  -- link UAMI to plugin assembly in Dataverse

Skill

/dataverse-managed-identity is the entry point. It covers:

1. Azure resource creation (UAMI, App Registration)
2. FIC subject computation from signing certificate (v2 format)
3. Visual Studio project setup (.NET Framework 4.6.2, SNK, NuGet)
4. Plugin code with environment variable configuration
5. Strong-name and Authenticode signing
6. Plugin Registration Tool deployment
7. Managed Identity linking
8. End-to-end verification

Agents

Agent	Use for
@dv-plugin-plan	Decide plugin type, messages, entities, Azure resources
@dv-plugin-build	Write plugin code using the MI token pattern
@dv-plugin-deploy	Build, sign, register, link, configure FIC, verify

Scripts

Script	What it does
new-signing-cert.ps1	Creates a self-signed Authenticode certificate for dev
sign-dll.ps1	Builds the project, signs with signtool, verifies the signature
Register-ManagedIdentity.ps1	Creates a v2 MI record in Dataverse and links it to the assembly

Things to know

• Two types of signing are required. SNK (automatic on build) gives the assembly identity. Authenticode (manual after every build) produces the certificate hash used in the v2 FIC subject.
• Code changes do not invalidate the FIC (v2). The FIC subject is derived from the signing certificate's hash, not the DLL hash. Rebuild and re-sign with the same certificate, update in PRT, and the FIC stays valid. Only a certificate or SNK change requires a new FIC. Configuration changes via environment variables do not require a rebuild at all.
• Custom API plugins have no step in PRT. The plugin class is associated via the Custom API record in make.powerapps.com.
• App Registration is not always needed. First-party Azure services (Key Vault, Storage, Service Bus) have built-in audiences. You assign an RBAC role directly on the resource instead.

Further reading

Managed Identity for Dataverse Plugins -- explains the concepts from first principles before you start building.