diff --git a/packages/frontend-app-api/src/wiring/createApp.tsx b/packages/frontend-app-api/src/wiring/createApp.tsx
index 1a6f58b71c..83afc2b7a9 100644
--- a/packages/frontend-app-api/src/wiring/createApp.tsx
+++ b/packages/frontend-app-api/src/wiring/createApp.tsx
@@ -34,10 +34,7 @@ import {
   createApiFactory,
   routeResolutionApiRef,
 } from '@backstage/frontend-plugin-api';
-import { App } from '@backstage/plugin-app/src/extensions/App';
-import { AppRoutes } from '@backstage/plugin-app/src/extensions/AppRoutes';
-import { AppLayout } from '@backstage/plugin-app/src/extensions/AppLayout';
-import { AppNav } from '@backstage/plugin-app/src/extensions/AppNav';
+
 import {
   AnyApiFactory,
   ApiHolder,
@@ -69,42 +66,20 @@ import { defaultConfigLoaderSync } from '../../../core-app-api/src/app/defaultCo
 import { overrideBaseUrlConfigs } from '../../../core-app-api/src/app/overrideBaseUrlConfigs';
 // eslint-disable-next-line @backstage/no-relative-monorepo-imports
 import { resolveExtensionDefinition } from '../../../frontend-plugin-api/src/wiring/resolveExtensionDefinition';
-// eslint-disable-next-line @backstage/no-relative-monorepo-imports
-import { apis as defaultApis } from '../../../app-defaults/src/defaults';
 
-import {
-  oauthRequestDialogAppRootElement,
-  alertDisplayAppRootElement,
-} from '@backstage/plugin-app/src/extensions/elements';
 import { extractRouteInfoFromAppNode } from '../routing/extractRouteInfoFromAppNode';
 
 import { CreateAppRouteBinder } from '../routing';
 import { RouteResolver } from '../routing/RouteResolver';
 import { resolveRouteBindings } from '../routing/resolveRouteBindings';
 import { collectRouteIds } from '../routing/collectRouteIds';
-import {
-  DefaultProgressComponent,
-  DefaultErrorBoundaryComponent,
-  DefaultNotFoundErrorPageComponent,
-} from '@backstage/plugin-app/src/extensions/components';
 import { InternalAppContext } from './InternalAppContext';
-import { AppRoot } from '@backstage/plugin-app/src/extensions/AppRoot';
 // eslint-disable-next-line @backstage/no-relative-monorepo-imports
 import { toInternalBackstagePlugin } from '../../../frontend-plugin-api/src/wiring/createFrontendPlugin';
 // eslint-disable-next-line @backstage/no-relative-monorepo-imports
 import { toInternalExtensionOverrides } from '../../../frontend-plugin-api/src/wiring/createExtensionOverrides';
 import { stringifyError } from '@backstage/errors';
 import { getBasePath } from '../routing/getBasePath';
-import {
-  AppThemeApi,
-  DarkTheme,
-  LightTheme,
-} from '@backstage/plugin-app/src/extensions/AppThemeApi';
-import { IconsApi } from '@backstage/plugin-app/src/extensions/IconsApi';
-import { TranslationsApi } from '@backstage/plugin-app/src/extensions/TranslationsApi';
-import { ComponentsApi } from '@backstage/plugin-app/src/extensions/ComponentsApi';
-import { AppLanguageApi } from '@backstage/plugin-app/src/extensions/AppLanguageApi';
-import { FeatureFlagsApi } from '@backstage/plugin-app/src/extensions/FeatureFlagsApi';
 import { Root } from '../extensions/Root';
 import { resolveAppTree } from '../tree/resolveAppTree';
 import { resolveAppNodeSpecs } from '../tree/resolveAppNodeSpecs';
@@ -113,35 +88,6 @@ import { instantiateAppNodeTree } from '../tree/instantiateAppNodeTree';
 // eslint-disable-next-line @backstage/no-relative-monorepo-imports
 import { ApiRegistry } from '../../../core-app-api/src/apis/system/ApiRegistry';
 
-const DefaultApis = defaultApis.map(factory =>
-  ApiBlueprint.make({ namespace: factory.api.id, params: { factory } }),
-);
-
-export const builtinExtensions = (
-  [
-    Root,
-    App,
-    AppRoot,
-    AppRoutes,
-    AppNav,
-    AppLayout,
-    DefaultProgressComponent,
-    DefaultErrorBoundaryComponent,
-    DefaultNotFoundErrorPageComponent,
-    LightTheme,
-    DarkTheme,
-    oauthRequestDialogAppRootElement,
-    alertDisplayAppRootElement,
-    AppThemeApi,
-    AppLanguageApi,
-    IconsApi,
-    TranslationsApi,
-    ComponentsApi,
-    FeatureFlagsApi,
-    ...DefaultApis,
-  ] as ExtensionDefinition[]
-).map(def => resolveExtensionDefinition(def));
-
 function deduplicateFeatures(
   allFeatures: FrontendFeature[],
 ): FrontendFeature[] {
@@ -338,7 +284,7 @@ export function createSpecializedApp(options?: {
     'root',
     resolveAppNodeSpecs({
       features,
-      builtinExtensions,
+      builtinExtensions: [resolveExtensionDefinition(Root)],
       parameters: readAppExtensionsConfig(config),
       forbidden: new Set(['root']),
     }),
diff --git a/plugins/app/package.json b/plugins/app/package.json
index 48db45714d..5c5f631c54 100644
--- a/plugins/app/package.json
+++ b/plugins/app/package.json
@@ -37,6 +37,7 @@
     "@backstage/core-components": "workspace:^",
     "@backstage/core-plugin-api": "workspace:^",
     "@backstage/frontend-plugin-api": "workspace:^",
+    "@backstage/plugin-permission-react": "workspace:^",
     "@backstage/theme": "workspace:^",
     "@material-ui/core": "^4.9.13",
     "@material-ui/icons": "^4.9.1",
diff --git a/plugins/app/src/defaultApis.ts b/plugins/app/src/defaultApis.ts
new file mode 100644
index 0000000000..fd46ecf596
--- /dev/null
+++ b/plugins/app/src/defaultApis.ts
@@ -0,0 +1,382 @@
+/*
+ * Copyright 2020 The Backstage Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+// eslint-disable-next-line @backstage/no-relative-monorepo-imports
+import {
+  AlertApiForwarder,
+  NoOpAnalyticsApi,
+  ErrorApiForwarder,
+  ErrorAlerter,
+  GoogleAuth,
+  GithubAuth,
+  OktaAuth,
+  GitlabAuth,
+  MicrosoftAuth,
+  BitbucketAuth,
+  BitbucketServerAuth,
+  OAuthRequestManager,
+  WebStorage,
+  UrlPatternDiscovery,
+  OneLoginAuth,
+  UnhandledErrorForwarder,
+  AtlassianAuth,
+  createFetchApi,
+  FetchMiddlewares,
+  VMwareCloudAuth,
+} from '../../../packages/core-app-api/src/apis/implementations';
+
+import {
+  createApiFactory,
+  alertApiRef,
+  analyticsApiRef,
+  errorApiRef,
+  discoveryApiRef,
+  fetchApiRef,
+  identityApiRef,
+  oauthRequestApiRef,
+  googleAuthApiRef,
+  githubAuthApiRef,
+  oktaAuthApiRef,
+  gitlabAuthApiRef,
+  microsoftAuthApiRef,
+  storageApiRef,
+  configApiRef,
+  oneloginAuthApiRef,
+  bitbucketAuthApiRef,
+  bitbucketServerAuthApiRef,
+  atlassianAuthApiRef,
+  vmwareCloudAuthApiRef,
+} from '@backstage/core-plugin-api';
+import { ApiBlueprint } from '@backstage/frontend-plugin-api';
+import {
+  permissionApiRef,
+  IdentityPermissionApi,
+} from '@backstage/plugin-permission-react';
+
+export const apis = [
+  ApiBlueprint.make({
+    name: 'discovery',
+    params: {
+      factory: createApiFactory({
+        api: discoveryApiRef,
+        deps: { configApi: configApiRef },
+        factory: ({ configApi }) =>
+          UrlPatternDiscovery.compile(
+            `${configApi.getString('backend.baseUrl')}/api/{{ pluginId }}`,
+          ),
+      }),
+    },
+  }),
+  ApiBlueprint.make({
+    name: 'alert',
+    params: {
+      factory: createApiFactory({
+        api: alertApiRef,
+        deps: {},
+        factory: () => new AlertApiForwarder(),
+      }),
+    },
+  }),
+  ApiBlueprint.make({
+    name: 'analytics',
+    params: {
+      factory: createApiFactory({
+        api: analyticsApiRef,
+        deps: {},
+        factory: () => new NoOpAnalyticsApi(),
+      }),
+    },
+  }),
+  ApiBlueprint.make({
+    name: 'error',
+    params: {
+      factory: createApiFactory({
+        api: errorApiRef,
+        deps: { alertApi: alertApiRef },
+        factory: ({ alertApi }) => {
+          const errorApi = new ErrorAlerter(alertApi, new ErrorApiForwarder());
+          UnhandledErrorForwarder.forward(errorApi, { hidden: false });
+          return errorApi;
+        },
+      }),
+    },
+  }),
+  ApiBlueprint.make({
+    name: 'storage',
+    params: {
+      factory: createApiFactory({
+        api: storageApiRef,
+        deps: { errorApi: errorApiRef },
+        factory: ({ errorApi }) => WebStorage.create({ errorApi }),
+      }),
+    },
+  }),
+  ApiBlueprint.make({
+    name: 'fetch',
+    params: {
+      factory: createApiFactory({
+        api: fetchApiRef,
+        deps: {
+          configApi: configApiRef,
+          identityApi: identityApiRef,
+          discoveryApi: discoveryApiRef,
+        },
+        factory: ({ configApi, identityApi, discoveryApi }) => {
+          return createFetchApi({
+            middleware: [
+              FetchMiddlewares.resolvePluginProtocol({
+                discoveryApi,
+              }),
+              FetchMiddlewares.injectIdentityAuth({
+                identityApi,
+                config: configApi,
+              }),
+            ],
+          });
+        },
+      }),
+    },
+  }),
+  ApiBlueprint.make({
+    name: 'oauth-request',
+    params: {
+      factory: createApiFactory({
+        api: oauthRequestApiRef,
+        deps: {},
+        factory: () => new OAuthRequestManager(),
+      }),
+    },
+  }),
+  ApiBlueprint.make({
+    name: 'google-auth',
+    params: {
+      factory: createApiFactory({
+        api: googleAuthApiRef,
+        deps: {
+          discoveryApi: discoveryApiRef,
+          oauthRequestApi: oauthRequestApiRef,
+          configApi: configApiRef,
+        },
+        factory: ({ discoveryApi, oauthRequestApi, configApi }) =>
+          GoogleAuth.create({
+            configApi,
+            discoveryApi,
+            oauthRequestApi,
+            environment: configApi.getOptionalString('auth.environment'),
+          }),
+      }),
+    },
+  }),
+  ApiBlueprint.make({
+    name: 'microsoft-auth',
+    params: {
+      factory: createApiFactory({
+        api: microsoftAuthApiRef,
+        deps: {
+          discoveryApi: discoveryApiRef,
+          oauthRequestApi: oauthRequestApiRef,
+          configApi: configApiRef,
+        },
+        factory: ({ discoveryApi, oauthRequestApi, configApi }) =>
+          MicrosoftAuth.create({
+            configApi,
+            discoveryApi,
+            oauthRequestApi,
+            environment: configApi.getOptionalString('auth.environment'),
+          }),
+      }),
+    },
+  }),
+  ApiBlueprint.make({
+    name: 'github-auth',
+    params: {
+      factory: createApiFactory({
+        api: githubAuthApiRef,
+        deps: {
+          discoveryApi: discoveryApiRef,
+          oauthRequestApi: oauthRequestApiRef,
+          configApi: configApiRef,
+        },
+        factory: ({ discoveryApi, oauthRequestApi, configApi }) =>
+          GithubAuth.create({
+            configApi,
+            discoveryApi,
+            oauthRequestApi,
+            defaultScopes: ['read:user'],
+            environment: configApi.getOptionalString('auth.environment'),
+          }),
+      }),
+    },
+  }),
+  ApiBlueprint.make({
+    name: 'okta-auth',
+    params: {
+      factory: createApiFactory({
+        api: oktaAuthApiRef,
+        deps: {
+          discoveryApi: discoveryApiRef,
+          oauthRequestApi: oauthRequestApiRef,
+          configApi: configApiRef,
+        },
+        factory: ({ discoveryApi, oauthRequestApi, configApi }) =>
+          OktaAuth.create({
+            configApi,
+            discoveryApi,
+            oauthRequestApi,
+            environment: configApi.getOptionalString('auth.environment'),
+          }),
+      }),
+    },
+  }),
+  ApiBlueprint.make({
+    name: 'gitlab-auth',
+    params: {
+      factory: createApiFactory({
+        api: gitlabAuthApiRef,
+        deps: {
+          discoveryApi: discoveryApiRef,
+          oauthRequestApi: oauthRequestApiRef,
+          configApi: configApiRef,
+        },
+        factory: ({ discoveryApi, oauthRequestApi, configApi }) =>
+          GitlabAuth.create({
+            configApi,
+            discoveryApi,
+            oauthRequestApi,
+            environment: configApi.getOptionalString('auth.environment'),
+          }),
+      }),
+    },
+  }),
+  ApiBlueprint.make({
+    name: 'onelogin-auth',
+    params: {
+      factory: createApiFactory({
+        api: oneloginAuthApiRef,
+        deps: {
+          discoveryApi: discoveryApiRef,
+          oauthRequestApi: oauthRequestApiRef,
+          configApi: configApiRef,
+        },
+        factory: ({ discoveryApi, oauthRequestApi, configApi }) =>
+          OneLoginAuth.create({
+            configApi,
+            discoveryApi,
+            oauthRequestApi,
+            environment: configApi.getOptionalString('auth.environment'),
+          }),
+      }),
+    },
+  }),
+  ApiBlueprint.make({
+    name: 'bitbucket-auth',
+    params: {
+      factory: createApiFactory({
+        api: bitbucketAuthApiRef,
+        deps: {
+          discoveryApi: discoveryApiRef,
+          oauthRequestApi: oauthRequestApiRef,
+          configApi: configApiRef,
+        },
+        factory: ({ discoveryApi, oauthRequestApi, configApi }) =>
+          BitbucketAuth.create({
+            configApi,
+            discoveryApi,
+            oauthRequestApi,
+            defaultScopes: ['account'],
+            environment: configApi.getOptionalString('auth.environment'),
+          }),
+      }),
+    },
+  }),
+  ApiBlueprint.make({
+    name: 'bitbucket-server-auth',
+    params: {
+      factory: createApiFactory({
+        api: bitbucketServerAuthApiRef,
+        deps: {
+          discoveryApi: discoveryApiRef,
+          oauthRequestApi: oauthRequestApiRef,
+          configApi: configApiRef,
+        },
+        factory: ({ discoveryApi, oauthRequestApi, configApi }) =>
+          BitbucketServerAuth.create({
+            configApi,
+            discoveryApi,
+            oauthRequestApi,
+            defaultScopes: ['REPO_READ'],
+          }),
+      }),
+    },
+  }),
+  ApiBlueprint.make({
+    name: 'atlassian-auth',
+    params: {
+      factory: createApiFactory({
+        api: atlassianAuthApiRef,
+        deps: {
+          discoveryApi: discoveryApiRef,
+          oauthRequestApi: oauthRequestApiRef,
+          configApi: configApiRef,
+        },
+        factory: ({ discoveryApi, oauthRequestApi, configApi }) => {
+          return AtlassianAuth.create({
+            configApi,
+            discoveryApi,
+            oauthRequestApi,
+            environment: configApi.getOptionalString('auth.environment'),
+          });
+        },
+      }),
+    },
+  }),
+  ApiBlueprint.make({
+    name: 'vmware-cloud-auth',
+    params: {
+      factory: createApiFactory({
+        api: vmwareCloudAuthApiRef,
+        deps: {
+          discoveryApi: discoveryApiRef,
+          oauthRequestApi: oauthRequestApiRef,
+          configApi: configApiRef,
+        },
+        factory: ({ discoveryApi, oauthRequestApi, configApi }) => {
+          return VMwareCloudAuth.create({
+            configApi,
+            discoveryApi,
+            oauthRequestApi,
+            environment: configApi.getOptionalString('auth.environment'),
+          });
+        },
+      }),
+    },
+  }),
+  ApiBlueprint.make({
+    name: 'permission',
+    params: {
+      factory: createApiFactory({
+        api: permissionApiRef,
+        deps: {
+          discovery: discoveryApiRef,
+          identity: identityApiRef,
+          config: configApiRef,
+        },
+        factory: ({ config, discovery, identity }) =>
+          IdentityPermissionApi.create({ config, discovery, identity }),
+      }),
+    },
+  }),
+] as const;
diff --git a/yarn.lock b/yarn.lock
index f1ed9a0f9c..07c9b607b7 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -4694,6 +4694,7 @@ __metadata:
     "@backstage/dev-utils": "workspace:^"
     "@backstage/frontend-plugin-api": "workspace:^"
     "@backstage/frontend-test-utils": "workspace:^"
+    "@backstage/plugin-permission-react": "workspace:^"
     "@backstage/theme": "workspace:^"
     "@material-ui/core": ^4.9.13
     "@material-ui/icons": ^4.9.1