shaposhnikoff

Secure Azure App Registration and Service Principal Patterns for Python Automation

Executive summary

For Python automation against Azure or Microsoft Graph, the secure baseline is: create an App Registration as the application definition, use its Application (client) ID as the stable identifier in code, let Microsoft Entra create or associate a service principal as the tenant-local security principal, grant only the minimum Azure RBAC roles or Graph application permissions needed at the narrowest possible scope, obtain tokens with a supported library such as MSAL or Azure Identity, and let the target resource enforce authorization using the token’s app identity plus the assigned roles and permissions. In Microsoft Entra, the application object and service principal are distinct objects: the app object defines the application globally in its home tenant, while the service principal is the concrete instance used in a tenant. Microsoft documents that when you register a new

shaposhnikoff

Optional: Add GitHub MCP Server

You can also add the official GitHub MCP Server.

The recommended local setup uses Docker:

ghcr.io/github/github-mcp-server

shaposhnikoff

Claude Code Resource Bible

Every tool, repo, and tutorial worth knowing. Nothing left out.

---

Official Anthropic

#	Name	Description	Link
01	Official Docs	Complete CC documentation	code.claude.com/docs

shaposhnikoff

shaposhnikoff

AGENTS.md

Language Policy

• All chat responses and explanations: Russian only
• All git commit messages: English only
• All code comments, docstrings, variable names: English only
• All PR descriptions, issue comments, CI/CD messages: English only
• All file names, function names, class names: English only
• All review to Jira: English only
• When explaining what you did after a commit or file change — explain in Russian,

shaposhnikoff

MikroTik VLAN Trunk: RB5009 ↔ CRS326-24G-2S+ via SFP+ DAC

Trunk link: sfp-sfpplus1 on RB5009 ↔ sfp-sfpplus1 on CRS326
Link speed: 10G (DAC cable)
VLANs: 10 VLANs (IDs 10–100)

shaposhnikoff

[build-system]
requires = ["setuptools>=68"]
build-backend = "setuptools.build_meta"

[project]
name = "kvpass"
version = "0.1.0"
requires-python = ">=3.11"
dependencies = [
  "azure-identity>=1.16.0",

shaposhnikoff

from math import log
import requests
import json
import logging


from requests.exceptions import (
    ConnectionError,
    Timeout,
    RequestException,

shaposhnikoff

gh api repos/username/repo_name/branches/main/protection \
  --method PUT \
  --input - <<'JSON'
{
  "required_status_checks": null,
  "enforce_admins": true,
  "required_pull_request_reviews": {
    "dismiss_stale_reviews": false,
 "require_code_owner_reviews": true,

shaposhnikoff

#!/bin/bash

SERVER="192.168.10.211"
TMPFILE=$(mktemp)

showmount -e $SERVER > "$TMPFILE"

echo "# ==============================="
echo "# NFS mounts for $SERVER"
echo "# ==============================="