# Microsoft Store: credentials

The platform submits Windows apps through an Entra app registration with the Partner Center Manager role, whose values you store together with the Seller ID.

> Source: https://www.application-platform.com/en/docs/microsoft-store-credentials/

For the Microsoft Store, the pipeline signs in to the Store submission API with an **app registration** from Microsoft Entra ID. The app registration needs the Manager role in Partner Center, and the platform needs the Seller ID of your account in addition to the tenant ID, client ID, and secret. You need a [developer account in Partner Center]({{< relref "microsoft-store-developer-account" >}}) with an associated Entra tenant and administrator access to both.

## Create the app registration in Entra ID

1. Open the [Azure portal](https://portal.azure.com/) → **Microsoft Entra ID** → **App registrations** → **New registration**.
2. Give it a descriptive name such as `application-platform-microsoft-store`.
3. Under **Overview**, note the **Directory (tenant) ID** and the **Application (client) ID**.
4. Under **Certificates & secrets** → **New client secret**, create a secret and copy the value directly after creating it. Azure shows it only once.

## Authorize the app registration in Partner Center

1. In Partner Center, open **Account settings** → **User management** → **Microsoft Entra applications**.
2. Add the app registration.
3. Assign it the **Manager** role. The submission API and the store CLI `msstore` require this role.

Microsoft describes the step under [Manage Entra apps in Partner Center](https://learn.microsoft.com/windows/apps/publish/partner-center/manage-azure-ad-applications-in-partner-center).

## Look up the Seller ID

You find the **Seller ID** in Partner Center under **Account settings** → **Legal info** or **Identifiers**.

## Create the entry in the platform

Open **Store accounts**, click **Add access**, and choose the Microsoft Store account:

| Platform field | Source |
|---|---|
| Tenant ID | Directory (tenant) ID of the app registration |
| Client ID | Application (client) ID of the app registration |
| Client Secret | value of the client secret |
| Seller ID | Seller ID from Partner Center |

Click **Verify credentials** first; the entry can only be saved after a successful check. The pipeline later signs in with these client credentials; no refresh token or user login is needed. If you renew the secret in Entra ID or replace it because of suspected exposure, enter the new value in the entry.

## Assign the store account to the Windows project

1. Select the Microsoft Store account on the Windows project.
2. Enter the **Microsoft Store Product ID** from Partner Center.
3. Additionally assign an entry for [Azure Artifact Signing]({{< relref "azure-artifact-signing-credentials" >}}). The store only accepts signed builds, which is why signing is mandatory for publishing to the store.