A WireMock simulation of Microsoft Entra's REST API — covering tenant-scoped OIDC discovery, authorization, token grants, and the device-code flow.
A shared instance of this template runs on a public endpoint — call it right now from curl, an SDK, or an AI agent. Responses are fixed examples and behavior can't be changed; rate limits apply.
Jump to the endpoints ↓Run this template as a mock API in WireMock Cloud for a private instance you control — edit stubs, add stateful scenarios, use dynamic response templating, and inspect requests in the log.
Open in WireMock Cloud (free) →Live sandbox · no signup, no API key
A running WireMock Cloud instance of this template, callable right now from a terminal, a script, or an AI agent.
Endpoints
GET Landing page
curl -s -X GET 'https://w2d21.wiremockapi.cloud/'GET OpenID Configuration
curl -s -X GET 'https://w2d21.wiremockapi.cloud/your-tenant/v2.0/.well-known/openid-configuration'GET Login page (Authorize endpoint)
curl -s -X GET 'https://w2d21.wiremockapi.cloud/your-tenant/oauth2/v2.0/authorize'Spec catalog — Microsoft Entra ID (Azure AD) OAuth 2.0 API (2.0.0) · 7 endpoints
| Method | Path | Summary |
|---|---|---|
| GET | /{tenant}/discovery/v2.0/keys | JSON Web Key Set (JWKS) |
| GET | /{tenant}/oauth2/v2.0/authorize | Authorization Endpoint |
| POST | /{tenant}/oauth2/v2.0/devicecode | Device Authorization Endpoint |
| GET | /{tenant}/oauth2/v2.0/logout | End Session Endpoint |
| POST | /{tenant}/oauth2/v2.0/token | Token Endpoint |
| GET | /{tenant}/v2.0/.well-known/openid-configuration | OpenID Connect Discovery |
| GET | /oidc/userinfo | UserInfo Endpoint |
Unauthenticated WireMock Cloud demo sandbox for Microsoft Entra — not an official Microsoft Entra sandbox, and it returns simulated example data only.
Entra ID's defining quirk — every URL is scoped by a {tenant} path segment — is preserved throughout the template: use a GUID, or common, and discovery, authorization, and token routes all resolve under it. The discovery document is the anchor: request /{tenant}/v2.0/.well-known/openid-configuration and the stub returns tenant-scoped endpoint URLs pointing back into the mock, which is precisely what OIDC clients need to bootstrap themselves against it.
Anything Entra itself would accept — common, organizations, or a directory GUID — since the mock matches the segment as a wildcard. Multi-tenant code that builds URLs per customer tenant can therefore run its real URL-construction logic unmodified.
An authorization-code exchange completes with placeholder credentials — no app registration, no secret, no admin consent. It's the inversion of real Entra setup, where a directory, a registered application, and granted permissions all precede the first successful token call.
No — policy enforcement is a directory-side behavior, and the mock has no directory. Flows resolve as if every policy passed. To rehearse blocked sign-ins or claims challenges, add stubs returning Entra's error contracts (interaction_required, for instance) in a WireMock Cloud copy.
The v2.0 endpoints cover the interactive authorization-code path with PKCE parameters accepted, refresh exchanges, and device-code sign-in. That spans the sign-in journeys of web apps, native clients, and input-constrained devices against one consistent tenant-scoped URL layout.
Vendor names identify APIs represented by WireMock template sources. This page does not imply vendor endorsement, certification, partnership, or official integration status.