Verwalten einer Azure AD-Anwendung mit Microsoft Graph

Artikel
03/09/2023
16 Minuten Lesedauer

Ihre App muss in Azure AD registriert werden, bevor die Microsoft Identity Platform sie für den Zugriff auf Daten autorisieren kann, die in Azure Active Directory (Azure AD) oder Microsoft 365-Mandanten gespeichert sind. Diese Bedingung gilt für Apps, die Sie selbst entwickeln, die sich im Besitz Ihrer Organisation befinden oder auf die Sie über ein aktives Abonnement zugreifen.

Viele Einstellungen für Apps werden als Objekte aufgezeichnet, auf die mit Microsoft Graph zugegriffen, aktualisiert oder gelöscht werden kann. In diesem Artikel erfahren Sie, wie Sie Microsoft Graph verwenden, um App- und Dienstprinzipalobjekte zu verwalten, einschließlich der Eigenschaften, Berechtigungen und Rollenzuweisungen.

Voraussetzungen

Für dieses Tutorial benötigen Sie die folgenden Ressourcen und Berechtigungen:

Ein funktionierender Azure AD-Mandant.
Melden Sie sich beim Graph-Explorer als Benutzer mit einer Anwendungsadministratorrolle oder als Benutzer an, der zum Erstellen und Verwalten von Anwendungen im Mandanten berechtigt ist.

Registrieren einer Anwendung bei Azure AD

Anforderung

Delegierte Berechtigung mit den geringsten Rechten: Application.ReadWrite.All

POST https://graph.microsoft.com/v1.0/applications
Content-type: application/json

{
  "displayName": "My application"
}


var graphClient = new GraphServiceClient(requestAdapter);

var requestBody = new Application
{
	DisplayName = "My application",
};
var result = await graphClient.Applications.PostAsync(requestBody);


const options = {
	authProvider,
};

const client = Client.init(options);

const application = {
  displayName: 'My application'
};

await client.api('/applications')
	.post(application);


GraphServiceClient graphClient = GraphServiceClient.builder().authenticationProvider( authProvider ).buildClient();

Application application = new Application();
application.displayName = "My application";

graphClient.applications()
	.buildRequest()
	.post(application);


//THE GO SDK IS IN PREVIEW. NON-PRODUCTION USE ONLY
graphClient := msgraphsdk.NewGraphServiceClientWithCredentials(cred, scopes)

requestBody := graphmodels.NewApplication()
displayName := "My application"
requestBody.SetDisplayName(&displayName) 

result, err := graphClient.Applications().Post(context.Background(), requestBody, nil)


Import-Module Microsoft.Graph.Applications

$params = @{
	DisplayName = "My application"
}

New-MgApplication -BodyParameter $params


<?php

// THIS SNIPPET IS A PREVIEW FOR THE KIOTA BASED SDK. NON-PRODUCTION USE ONLY
$graphServiceClient = new GraphServiceClient($requestAdapter);

$requestBody = new Application();
$requestBody->setDisplayName('My application');



$requestResult = $graphServiceClient->applications()->post($requestBody);

Antwort

Der folgende Code ist ein Beispiel für die Standardantwort, die alle standardmäßig zurückgegebenen Eigenschaften enthält. Der Anwendung wird eine ID zugewiesen, die im Azure AD-Ökosystem global eindeutig ist.

HTTP/1.1 201 Created
Content-type: application/json

{
    "@odata.context": "https://graph.microsoft.com/v1.0/$metadata#applications/$entity",
    "id": "0d0021e2-eaab-4b9f-a5ad-38c55337d63e",
    "deletedDateTime": null,
    "appId": "5f0f8757-988d-474c-9f85-74a6bc70dfd0",
    "applicationTemplateId": null,
    "disabledByMicrosoftStatus": null,
    "createdDateTime": "2022-02-08T08:58:36.7669085Z",
    "displayName": "My application",
    "description": null,
    "groupMembershipClaims": null,
    "identifierUris": [],
    "isDeviceOnlyAuthSupported": null,
    "isFallbackPublicClient": null,
    "notes": null,
    "publisherDomain": "M365x010717.onmicrosoft.com",
    "serviceManagementReference": null,
    "signInAudience": "AzureADandPersonalMicrosoftAccount",
    "tags": [],
    "tokenEncryptionKeyId": null,
    "defaultRedirectUri": null,
    "certification": null,
    "optionalClaims": null,
    "addIns": [],
    "api": {
        "acceptMappedClaims": null,
        "knownClientApplications": [],
        "requestedAccessTokenVersion": 2,
        "oauth2PermissionScopes": [],
        "preAuthorizedApplications": []
    },
    "appRoles": [],
    "info": {
        "logoUrl": null,
        "marketingUrl": null,
        "privacyStatementUrl": null,
        "supportUrl": null,
        "termsOfServiceUrl": null
    },
    "keyCredentials": [],
    "parentalControlSettings": {
        "countriesBlockedForMinors": [],
        "legalAgeGroupRule": "Allow"
    },
    "passwordCredentials": [],
    "publicClient": {
        "redirectUris": []
    },
    "requiredResourceAccess": [],
    "verifiedPublisher": {
        "displayName": null,
        "verifiedPublisherId": null,
        "addedDateTime": null
    },
    "web": {
        "homePageUrl": null,
        "logoutUrl": null,
        "redirectUris": [],
        "implicitGrantSettings": {
            "enableAccessTokenIssuance": false,
            "enableIdTokenIssuance": false
        }
    },
    "spa": {
        "redirectUris": []
    }
}

Der signInAudience-Eigenschaft wird der Standardwert AzureADandPersonalMicrosoftAccountzugewiesen. Diese Konfiguration ermöglicht es allen Benutzern, die mit einem beliebigen Kontotyp angemeldet sind, einschließlich Azure AD-Konten, persönlichen Microsoft-Konten und Anmeldeinformationen für soziale Medien, Ihre App zu verwenden. Sie können signInAudience in einen anderen Bereich ändern.

Wenn Sie die Anwendung als Benutzer mit Administratorrechten erstellt haben, wurde Ihnen automatisch der Besitz der Anwendung zugewiesen. Sie können den Besitz bestätigen, indem Sie die Besitzer-Navigationseigenschaft über GET https://graph.microsoft.com/v1.0/applications/0d0021e2-eaab-4b9f-a5ad-38c55337d63e/ownersabrufen. Sie können der Anwendung auch den Besitz eines anderen Benutzers oder einer Anderen App zuweisen.

Konfigurieren anderer grundlegender Eigenschaften für Ihre App

Delegierte Berechtigung mit den geringsten Rechten: Application.ReadWrite.All

Sie konfigurieren die folgenden grundlegenden Eigenschaften für die App.

Fügen Sie Tags für die Kategorisierung in der Organisation hinzu. Verwenden Sie außerdem das HideApp -Tag, um die App vor Meine Apps und dem Microsoft 365-Startprogramm auszublenden.
Fügen Sie grundlegende Informationen hinzu, einschließlich des Logos, der Nutzungsbedingungen und der Datenschutzerklärung.
Speichern von Kontaktinformationen zur Anwendung

PATCH https://graph.microsoft.com/v1.0/applications/0d0021e2-eaab-4b9f-a5ad-38c55337d63e/
Content-type: application/json

{
    "tags": [
        "HR",
        "Payroll",
        "HideApp"
    ],
    "info": {
        "logoUrl": "https://cdn.pixabay.com/photo/2016/03/21/23/25/link-1271843_1280.png",
        "marketingUrl": "https://www.contoso.com/app/marketing",
        "privacyStatementUrl": "https://www.contoso.com/app/privacy",
        "supportUrl": "https://www.contoso.com/app/support",
        "termsOfServiceUrl": "https://www.contoso.com/app/termsofservice"
    },
    "web": {
        "homePageUrl": "https://www.contoso.com/",
        "logoutUrl": "https://www.contoso.com/frontchannel_logout",
        "redirectUris": [
            "https://localhost"
        ]
    },
    "serviceManagementReference": "Owners aliases: Finance @ contosofinance@contoso.com; The Phone Company HR consulting @ hronsite@thephone-company.com;"
}


var graphClient = new GraphServiceClient(requestAdapter);

var requestBody = new Application
{
	Tags = new List<string>
	{
		"HR",
		"Payroll",
		"HideApp",
	},
	Info = new InformationalUrl
	{
		LogoUrl = "https://cdn.pixabay.com/photo/2016/03/21/23/25/link-1271843_1280.png",
		MarketingUrl = "https://www.contoso.com/app/marketing",
		PrivacyStatementUrl = "https://www.contoso.com/app/privacy",
		SupportUrl = "https://www.contoso.com/app/support",
		TermsOfServiceUrl = "https://www.contoso.com/app/termsofservice",
	},
	Web = new WebApplication
	{
		HomePageUrl = "https://www.contoso.com/",
		LogoutUrl = "https://www.contoso.com/frontchannel_logout",
		RedirectUris = new List<string>
		{
			"https://localhost",
		},
	},
	ServiceManagementReference = "Owners aliases: Finance @ contosofinance@contoso.com; The Phone Company HR consulting @ hronsite@thephone-company.com;",
};
var result = await graphClient.Applications["{application-id}"].PatchAsync(requestBody);


const options = {
	authProvider,
};

const client = Client.init(options);

const application = {
    tags: [
        'HR',
        'Payroll',
        'HideApp'
    ],
    info: {
        logoUrl: 'https://cdn.pixabay.com/photo/2016/03/21/23/25/link-1271843_1280.png',
        marketingUrl: 'https://www.contoso.com/app/marketing',
        privacyStatementUrl: 'https://www.contoso.com/app/privacy',
        supportUrl: 'https://www.contoso.com/app/support',
        termsOfServiceUrl: 'https://www.contoso.com/app/termsofservice'
    },
    web: {
        homePageUrl: 'https://www.contoso.com/',
        logoutUrl: 'https://www.contoso.com/frontchannel_logout',
        redirectUris: [
            'https://localhost'
        ]
    },
    serviceManagementReference: 'Owners aliases: Finance @ contosofinance@contoso.com; The Phone Company HR consulting @ hronsite@thephone-company.com;'
};

await client.api('/applications/0d0021e2-eaab-4b9f-a5ad-38c55337d63e/')
	.update(application);


GraphServiceClient graphClient = GraphServiceClient.builder().authenticationProvider( authProvider ).buildClient();

Application application = new Application();
LinkedList<String> tagsList = new LinkedList<String>();
tagsList.add("HR");
tagsList.add("Payroll");
tagsList.add("HideApp");
application.tags = tagsList;
InformationalUrl info = new InformationalUrl();
info.logoUrl = "https://cdn.pixabay.com/photo/2016/03/21/23/25/link-1271843_1280.png";
info.marketingUrl = "https://www.contoso.com/app/marketing";
info.privacyStatementUrl = "https://www.contoso.com/app/privacy";
info.supportUrl = "https://www.contoso.com/app/support";
info.termsOfServiceUrl = "https://www.contoso.com/app/termsofservice";
application.info = info;
WebApplication web = new WebApplication();
web.homePageUrl = "https://www.contoso.com/";
web.logoutUrl = "https://www.contoso.com/frontchannel_logout";
LinkedList<String> redirectUrisList = new LinkedList<String>();
redirectUrisList.add("https://localhost");
web.redirectUris = redirectUrisList;
application.web = web;
application.serviceManagementReference = "Owners aliases: Finance @ contosofinance@contoso.com; The Phone Company HR consulting @ hronsite@thephone-company.com;";

graphClient.applications("0d0021e2-eaab-4b9f-a5ad-38c55337d63e")
	.buildRequest()
	.patch(application);


//THE GO SDK IS IN PREVIEW. NON-PRODUCTION USE ONLY
graphClient := msgraphsdk.NewGraphServiceClientWithCredentials(cred, scopes)

requestBody := graphmodels.NewApplication()
tags := []string {
	"HR",
	"Payroll",
	"HideApp",

}
requestBody.SetTags(tags)
info := graphmodels.NewInformationalUrl()
logoUrl := "https://cdn.pixabay.com/photo/2016/03/21/23/25/link-1271843_1280.png"
info.SetLogoUrl(&logoUrl) 
marketingUrl := "https://www.contoso.com/app/marketing"
info.SetMarketingUrl(&marketingUrl) 
privacyStatementUrl := "https://www.contoso.com/app/privacy"
info.SetPrivacyStatementUrl(&privacyStatementUrl) 
supportUrl := "https://www.contoso.com/app/support"
info.SetSupportUrl(&supportUrl) 
termsOfServiceUrl := "https://www.contoso.com/app/termsofservice"
info.SetTermsOfServiceUrl(&termsOfServiceUrl) 
requestBody.SetInfo(info)
web := graphmodels.NewWebApplication()
homePageUrl := "https://www.contoso.com/"
web.SetHomePageUrl(&homePageUrl) 
logoutUrl := "https://www.contoso.com/frontchannel_logout"
web.SetLogoutUrl(&logoutUrl) 
redirectUris := []string {
	"https://localhost",

}
web.SetRedirectUris(redirectUris)
requestBody.SetWeb(web)
serviceManagementReference := "Owners aliases: Finance @ contosofinance@contoso.com; The Phone Company HR consulting @ hronsite@thephone-company.com;"
requestBody.SetServiceManagementReference(&serviceManagementReference) 

result, err := graphClient.ApplicationsById("application-id").Patch(context.Background(), requestBody, nil)


Import-Module Microsoft.Graph.Applications

$params = @{
	Tags = @(
		"HR"
		"Payroll"
		"HideApp"
	)
	Info = @{
		LogoUrl = "https://cdn.pixabay.com/photo/2016/03/21/23/25/link-1271843_1280.png"
		MarketingUrl = "https://www.contoso.com/app/marketing"
		PrivacyStatementUrl = "https://www.contoso.com/app/privacy"
		SupportUrl = "https://www.contoso.com/app/support"
		TermsOfServiceUrl = "https://www.contoso.com/app/termsofservice"
	}
	Web = @{
		HomePageUrl = "https://www.contoso.com/"
		LogoutUrl = "https://www.contoso.com/frontchannel_logout"
		RedirectUris = @(
			"https://localhost"
		)
	}
	ServiceManagementReference = "Owners aliases: Finance @ contosofinance@contoso.com; The Phone Company HR consulting @ hronsite@thephone-company.com;"
}

Update-MgApplication -ApplicationId $applicationId -BodyParameter $params


<?php

// THIS SNIPPET IS A PREVIEW FOR THE KIOTA BASED SDK. NON-PRODUCTION USE ONLY
$graphServiceClient = new GraphServiceClient($requestAdapter);

$requestBody = new Application();
$requestBody->setTags(['HR', 'Payroll', 'HideApp', ]);

$info = new InformationalUrl();
$info->setLogoUrl('https://cdn.pixabay.com/photo/2016/03/21/23/25/link-1271843_1280.png');

$info->setMarketingUrl('https://www.contoso.com/app/marketing');

$info->setPrivacyStatementUrl('https://www.contoso.com/app/privacy');

$info->setSupportUrl('https://www.contoso.com/app/support');

$info->setTermsOfServiceUrl('https://www.contoso.com/app/termsofservice');


$requestBody->setInfo($info);
$web = new WebApplication();
$web->setHomePageUrl('https://www.contoso.com/');

$web->setLogoutUrl('https://www.contoso.com/frontchannel_logout');

$web->setRedirectUris(['https://localhost', ]);


$requestBody->setWeb($web);
$requestBody->setServiceManagementReference('Owners aliases: Finance @ contosofinance@contoso.com; The Phone Company HR consulting @ hronsite@thephone-company.com;');



$requestResult = $graphServiceClient->applicationsById('application-id')->patch($requestBody);

Delegierte Berechtigung mit den geringsten Rechten: Application.ReadWrite.All

PATCH https://graph.microsoft.com/v1.0/servicePrincipals/89473e09-0737-41a1-a0c3-1418d6908bcd

{
    "appRoleAssignmentRequired": true
}


var graphClient = new GraphServiceClient(requestAdapter);

var requestBody = new ServicePrincipal
{
	AppRoleAssignmentRequired = true,
};
var result = await graphClient.ServicePrincipals["{servicePrincipal-id}"].PatchAsync(requestBody);


const options = {
	authProvider,
};

const client = Client.init(options);

const servicePrincipal = {
    appRoleAssignmentRequired: true
};

await client.api('/servicePrincipals/89473e09-0737-41a1-a0c3-1418d6908bcd')
	.update(servicePrincipal);


GraphServiceClient graphClient = GraphServiceClient.builder().authenticationProvider( authProvider ).buildClient();

ServicePrincipal servicePrincipal = new ServicePrincipal();
servicePrincipal.appRoleAssignmentRequired = true;

graphClient.servicePrincipals("89473e09-0737-41a1-a0c3-1418d6908bcd")
	.buildRequest()
	.patch(servicePrincipal);


//THE GO SDK IS IN PREVIEW. NON-PRODUCTION USE ONLY
graphClient := msgraphsdk.NewGraphServiceClientWithCredentials(cred, scopes)

requestBody := graphmodels.NewServicePrincipal()
appRoleAssignmentRequired := true
requestBody.SetAppRoleAssignmentRequired(&appRoleAssignmentRequired) 

result, err := graphClient.ServicePrincipalsById("servicePrincipal-id").Patch(context.Background(), requestBody, nil)

Snippet not available


<?php

// THIS SNIPPET IS A PREVIEW FOR THE KIOTA BASED SDK. NON-PRODUCTION USE ONLY
$graphServiceClient = new GraphServiceClient($requestAdapter);

$requestBody = new ServicePrincipal();
$requestBody->setAppRoleAssignmentRequired(true);



$requestResult = $graphServiceClient->servicePrincipalsById('servicePrincipal-id')->patch($requestBody);

Zuweisen von Berechtigungen zu einer App

Sie können einer App zwar Über die Azure-Portal Berechtigungen zuweisen, aber Sie weisen Berechtigungen auch über Microsoft Graph zu, indem Sie die requiredResourceAccess-Eigenschaft des App-Objekts aktualisieren. Sie müssen sowohl vorhandene als auch neue Berechtigungen übergeben. Die Übergabe nur neuer Berechtigungen überschreibt und entfernt die vorhandenen Berechtigungen, denen noch keine Zustimmung erteilt wurde.

Durch das Zuweisen von Berechtigungen werden diese nicht automatisch für die App gewährt. Sie müssen weiterhin die Administratoreinwilligung mithilfe der Azure-Portal erteilen. Informationen zum Erteilen von Berechtigungen ohne interaktive Zustimmung finden Sie unter Programmgesteuertes Gewähren oder Widerrufen von API-Berechtigungen.

Delegierte Berechtigung mit den geringsten Rechten: Application.ReadWrite.All

PATCH https://graph.microsoft.com/v1.0/applications/581088ba-83c5-4975-b8af-11d2d7a76e98
Content-Type: application/json

{
    "requiredResourceAccess": [
        {
            "resourceAppId": "00000002-0000-0000-c000-000000000000",
            "resourceAccess": [
                {
                    "id": "311a71cc-e848-46a1-bdf8-97ff7156d8e6",
                    "type": "Scope"
                },
                {
                    "id": "3afa6a7d-9b1a-42eb-948e-1650a849e176",
                    "type": "Role"
                }
            ]
        }
    ]
}


var graphClient = new GraphServiceClient(requestAdapter);

var requestBody = new Application
{
	RequiredResourceAccess = new List<RequiredResourceAccess>
	{
		new RequiredResourceAccess
		{
			ResourceAppId = "00000002-0000-0000-c000-000000000000",
			ResourceAccess = new List<ResourceAccess>
			{
				new ResourceAccess
				{
					Id = Guid.Parse("311a71cc-e848-46a1-bdf8-97ff7156d8e6"),
					Type = "Scope",
				},
				new ResourceAccess
				{
					Id = Guid.Parse("3afa6a7d-9b1a-42eb-948e-1650a849e176"),
					Type = "Role",
				},
			},
		},
	},
};
var result = await graphClient.Applications["{application-id}"].PatchAsync(requestBody);


const options = {
	authProvider,
};

const client = Client.init(options);

const application = {
    requiredResourceAccess: [
        {
            resourceAppId: '00000002-0000-0000-c000-000000000000',
            resourceAccess: [
                {
                    id: '311a71cc-e848-46a1-bdf8-97ff7156d8e6',
                    type: 'Scope'
                },
                {
                    id: '3afa6a7d-9b1a-42eb-948e-1650a849e176',
                    type: 'Role'
                }
            ]
        }
    ]
};

await client.api('/applications/581088ba-83c5-4975-b8af-11d2d7a76e98')
	.update(application);


GraphServiceClient graphClient = GraphServiceClient.builder().authenticationProvider( authProvider ).buildClient();

Application application = new Application();
LinkedList<RequiredResourceAccess> requiredResourceAccessList = new LinkedList<RequiredResourceAccess>();
RequiredResourceAccess requiredResourceAccess = new RequiredResourceAccess();
requiredResourceAccess.resourceAppId = "00000002-0000-0000-c000-000000000000";
LinkedList<ResourceAccess> resourceAccessList = new LinkedList<ResourceAccess>();
ResourceAccess resourceAccess = new ResourceAccess();
resourceAccess.id = UUID.fromString("311a71cc-e848-46a1-bdf8-97ff7156d8e6");
resourceAccess.type = "Scope";
resourceAccessList.add(resourceAccess);
ResourceAccess resourceAccess1 = new ResourceAccess();
resourceAccess1.id = UUID.fromString("3afa6a7d-9b1a-42eb-948e-1650a849e176");
resourceAccess1.type = "Role";
resourceAccessList.add(resourceAccess1);
requiredResourceAccess.resourceAccess = resourceAccessList;
requiredResourceAccessList.add(requiredResourceAccess);
application.requiredResourceAccess = requiredResourceAccessList;

graphClient.applications("581088ba-83c5-4975-b8af-11d2d7a76e98")
	.buildRequest()
	.patch(application);


//THE GO SDK IS IN PREVIEW. NON-PRODUCTION USE ONLY
graphClient := msgraphsdk.NewGraphServiceClientWithCredentials(cred, scopes)

requestBody := graphmodels.NewApplication()


requiredResourceAccess := graphmodels.NewRequiredResourceAccess()
resourceAppId := "00000002-0000-0000-c000-000000000000"
requiredResourceAccess.SetResourceAppId(&resourceAppId) 


resourceAccess := graphmodels.NewResourceAccess()
id := uuid.MustParse("311a71cc-e848-46a1-bdf8-97ff7156d8e6")
resourceAccess.SetId(&id) 
type := "Scope"
resourceAccess.SetType(&type) 
resourceAccess1 := graphmodels.NewResourceAccess()
id := uuid.MustParse("3afa6a7d-9b1a-42eb-948e-1650a849e176")
resourceAccess1.SetId(&id) 
type := "Role"
resourceAccess1.SetType(&type) 

resourceAccess := []graphmodels.ResourceAccessable {
	resourceAccess,
	resourceAccess1,

}
requiredResourceAccess.SetResourceAccess(resourceAccess)

requiredResourceAccess := []graphmodels.RequiredResourceAccessable {
	requiredResourceAccess,

}
requestBody.SetRequiredResourceAccess(requiredResourceAccess)

result, err := graphClient.ApplicationsById("application-id").Patch(context.Background(), requestBody, nil)


Import-Module Microsoft.Graph.Applications

$params = @{
	RequiredResourceAccess = @(
		@{
			ResourceAppId = "00000002-0000-0000-c000-000000000000"
			ResourceAccess = @(
				@{
					Id = "311a71cc-e848-46a1-bdf8-97ff7156d8e6"
					Type = "Scope"
				}
				@{
					Id = "3afa6a7d-9b1a-42eb-948e-1650a849e176"
					Type = "Role"
				}
			)
		}
	)
}

Update-MgApplication -ApplicationId $applicationId -BodyParameter $params

Snippet not available

Erstellen von App-Rollen

Erstellen von App-Rollen für ein Anwendungsobjekt

PATCH https://graph.microsoft.com/v1.0/applications/bbd46130-e957-4c38-a116-d4d02afd1057
Content-Type: application/json

{
    "appRoles": [
        {
            "allowedMemberTypes": [
                "User",
                "Application"
            ],
            "description": "Survey.Read",
            "displayName": "Survey.Read",
            "id": "7a9ddfc4-cc8a-48ea-8275-8ecbffffd5a0",
            "isEnabled": false,
            "origin": "Application",
            "value": "Survey.Read"
        }
    ]
}


var graphClient = new GraphServiceClient(requestAdapter);

var requestBody = new Application
{
	AppRoles = new List<AppRole>
	{
		new AppRole
		{
			AllowedMemberTypes = new List<string>
			{
				"User",
				"Application",
			},
			Description = "Survey.Read",
			DisplayName = "Survey.Read",
			Id = Guid.Parse("7a9ddfc4-cc8a-48ea-8275-8ecbffffd5a0"),
			IsEnabled = false,
			Origin = "Application",
			Value = "Survey.Read",
		},
	},
};
var result = await graphClient.Applications["{application-id}"].PatchAsync(requestBody);


const options = {
	authProvider,
};

const client = Client.init(options);

const application = {
    appRoles: [
        {
            allowedMemberTypes: [
                'User',
                'Application'
            ],
            description: 'Survey.Read',
            displayName: 'Survey.Read',
            id: '7a9ddfc4-cc8a-48ea-8275-8ecbffffd5a0',
            isEnabled: false,
            origin: 'Application',
            value: 'Survey.Read'
        }
    ]
};

await client.api('/applications/bbd46130-e957-4c38-a116-d4d02afd1057')
	.update(application);


GraphServiceClient graphClient = GraphServiceClient.builder().authenticationProvider( authProvider ).buildClient();

Application application = new Application();
LinkedList<AppRole> appRolesList = new LinkedList<AppRole>();
AppRole appRoles = new AppRole();
LinkedList<String> allowedMemberTypesList = new LinkedList<String>();
allowedMemberTypesList.add("User");
allowedMemberTypesList.add("Application");
appRoles.allowedMemberTypes = allowedMemberTypesList;
appRoles.description = "Survey.Read";
appRoles.displayName = "Survey.Read";
appRoles.id = UUID.fromString("7a9ddfc4-cc8a-48ea-8275-8ecbffffd5a0");
appRoles.isEnabled = false;
appRoles.origin = "Application";
appRoles.value = "Survey.Read";
appRolesList.add(appRoles);
application.appRoles = appRolesList;

graphClient.applications("bbd46130-e957-4c38-a116-d4d02afd1057")
	.buildRequest()
	.patch(application);


//THE GO SDK IS IN PREVIEW. NON-PRODUCTION USE ONLY
graphClient := msgraphsdk.NewGraphServiceClientWithCredentials(cred, scopes)

requestBody := graphmodels.NewApplication()


appRole := graphmodels.NewAppRole()
allowedMemberTypes := []string {
	"User",
	"Application",

}
appRole.SetAllowedMemberTypes(allowedMemberTypes)
description := "Survey.Read"
appRole.SetDescription(&description) 
displayName := "Survey.Read"
appRole.SetDisplayName(&displayName) 
id := uuid.MustParse("7a9ddfc4-cc8a-48ea-8275-8ecbffffd5a0")
appRole.SetId(&id) 
isEnabled := false
appRole.SetIsEnabled(&isEnabled) 
origin := "Application"
appRole.SetOrigin(&origin) 
value := "Survey.Read"
appRole.SetValue(&value) 

appRoles := []graphmodels.AppRoleable {
	appRole,

}
requestBody.SetAppRoles(appRoles)

result, err := graphClient.ApplicationsById("application-id").Patch(context.Background(), requestBody, nil)


Import-Module Microsoft.Graph.Applications

$params = @{
	AppRoles = @(
		@{
			AllowedMemberTypes = @(
				"User"
				"Application"
			)
			Description = "Survey.Read"
			DisplayName = "Survey.Read"
			Id = "7a9ddfc4-cc8a-48ea-8275-8ecbffffd5a0"
			IsEnabled = $false
			Origin = "Application"
			Value = "Survey.Read"
		}
	)
}

Update-MgApplication -ApplicationId $applicationId -BodyParameter $params

Snippet not available

Verwalten von Besitzern

Identifizieren von besitzerlosen Dienstprinzipalen und Dienstprinzipalen mit einem Besitzer

Delegierte Berechtigung mit den geringsten Rechten: Application.ReadWrite.All

Für diese Anforderung muss die Kopfzeile ConsistencyLevel auf eventual festgelegt werden, da $count in der Anforderung enthalten ist. Weitere Informationen zur Verwendung von ConsistencyLevel und $count finden Sie unter Erweiterte Abfragefunktionen für Azure AD-Verzeichnisobjekte.

Diese Anforderung gibt auch die Anzahl der Apps zurück, die der Filterbedingung entsprechen.

GET https://graph.microsoft.com/v1.0/servicePrincipals?$filter=owners/$count eq 0 or owners/$count eq 1&$count=true
ConsistencyLevel: eventual


var graphClient = new GraphServiceClient(requestAdapter);

var result = await graphClient.ServicePrincipals.GetAsync((requestConfiguration) =>
{
	requestConfiguration.QueryParameters.Filter = "owners/$count eq 0 or owners/$count eq 1";
	requestConfiguration.QueryParameters.Count = true;
	requestConfiguration.Headers.Add("ConsistencyLevel", "eventual");
});


const options = {
	authProvider,
};

const client = Client.init(options);

let servicePrincipals = await client.api('/servicePrincipals')
	.header('ConsistencyLevel','eventual')
	.filter('owners/$count eq 0 or owners/$count eq 1')
	.get();


GraphServiceClient graphClient = GraphServiceClient.builder().authenticationProvider( authProvider ).buildClient();

LinkedList<Option> requestOptions = new LinkedList<Option>();
requestOptions.add(new HeaderOption("ConsistencyLevel", "eventual"));

ServicePrincipalCollectionPage servicePrincipals = graphClient.servicePrincipals()
	.buildRequest( requestOptions )
	.filter("owners/$count eq 0 or owners/$count eq 1")
	.get();


//THE GO SDK IS IN PREVIEW. NON-PRODUCTION USE ONLY
graphClient := msgraphsdk.NewGraphServiceClientWithCredentials(cred, scopes)

headers := abstractions.NewRequestHeaders()
headers.Add("ConsistencyLevel", "eventual")


requestFilter := "owners/$count eq 0 or owners/$count eq 1"
requestCount := true

requestParameters := &graphconfig.ServicePrincipalsRequestBuilderGetQueryParameters{
	Filter: &requestFilter,
	Count: &requestCount,
}
configuration := &graphconfig.ServicePrincipalsRequestBuilderGetRequestConfiguration{
	Headers: headers,
	QueryParameters: requestParameters,
}

result, err := graphClient.ServicePrincipals().Get(context.Background(), configuration)


Import-Module Microsoft.Graph.Applications

Get-MgServicePrincipal -Filter "owners/`$count eq 0 or owners/`$count eq 1" -CountVariable CountVar -ConsistencyLevel eventual


<?php

// THIS SNIPPET IS A PREVIEW FOR THE KIOTA BASED SDK. NON-PRODUCTION USE ONLY
$graphServiceClient = new GraphServiceClient($requestAdapter);

$requestConfiguration = new ServicePrincipalsRequestBuilderGetRequestConfiguration();

$queryParameters = new ServicePrincipalsRequestBuilderGetQueryParameters();
$queryParameters->filter = "owners/$count eq 0 or owners/$count eq 1";
$queryParameters->count = true;

$headers = [
'ConsistencyLevel' => 'eventual',
];

$requestConfiguration->queryParameters = $queryParameters;
$requestConfiguration->headers = $headers;


$requestResult = $graphServiceClient->servicePrincipals()->get($requestConfiguration);

Zuweisen eines Besitzers zu einer App

Delegierte Berechtigung mit den geringsten Rechten: Application.ReadWrite.All

In der folgenden Anforderung 8afc02cb-4d62-4dba-b536-9f6d73e9be26 ist die Objekt-ID für einen Benutzer oder Dienstprinzipal.

POST https://graph.microsoft.com/v1.0/applications/7b45cf6d-9083-4eb2-92c4-a7e090f1fc40/owners/$ref
Content-Type: application/json

{
    "@odata.id": "https://graph.microsoft.com/v1.0/directoryObjects/8afc02cb-4d62-4dba-b536-9f6d73e9be26"
}


var graphClient = new GraphServiceClient(requestAdapter);

var requestBody = new Microsoft.Graph.Models.ReferenceCreate
{
	OdataId = "https://graph.microsoft.com/v1.0/directoryObjects/8afc02cb-4d62-4dba-b536-9f6d73e9be26",
};
await graphClient.Applications["{application-id}"].Owners.Ref.PostAsync(requestBody);


const options = {
	authProvider,
};

const client = Client.init(options);

const directoryObject = {
    '@odata.id': 'https://graph.microsoft.com/v1.0/directoryObjects/8afc02cb-4d62-4dba-b536-9f6d73e9be26'
};

await client.api('/applications/7b45cf6d-9083-4eb2-92c4-a7e090f1fc40/owners/$ref')
	.post(directoryObject);


GraphServiceClient graphClient = GraphServiceClient.builder().authenticationProvider( authProvider ).buildClient();

DirectoryObject directoryObject = new DirectoryObject();
directoryObject.id = "8afc02cb-4d62-4dba-b536-9f6d73e9be26";

graphClient.applications("7b45cf6d-9083-4eb2-92c4-a7e090f1fc40").owners().references()
	.buildRequest()
	.post(directoryObject);


//THE GO SDK IS IN PREVIEW. NON-PRODUCTION USE ONLY
graphClient := msgraphsdk.NewGraphServiceClientWithCredentials(cred, scopes)

requestBody := graphmodels.NewReferenceCreate()
odataId := "https://graph.microsoft.com/v1.0/directoryObjects/8afc02cb-4d62-4dba-b536-9f6d73e9be26"
requestBody.SetOdataId(&odataId) 

graphClient.ApplicationsById("application-id").Owners().Ref().Post(context.Background(), requestBody, nil)


Import-Module Microsoft.Graph.Applications

$params = @{
	"@odata.id" = "https://graph.microsoft.com/v1.0/directoryObjects/8afc02cb-4d62-4dba-b536-9f6d73e9be26"
}

New-MgApplicationOwnerByRef -ApplicationId $applicationId -BodyParameter $params


<?php

// THIS SNIPPET IS A PREVIEW FOR THE KIOTA BASED SDK. NON-PRODUCTION USE ONLY
$graphServiceClient = new GraphServiceClient($requestAdapter);

$requestBody = new ReferenceCreate();
$requestBody->set@odataid('https://graph.microsoft.com/v1.0/directoryObjects/8afc02cb-4d62-4dba-b536-9f6d73e9be26');



$graphServiceClient->applicationsById('application-id')->owners()->ref()->post($requestBody);

Zuweisen eines Besitzers zu einem Dienstprinzipal

Delegierte Berechtigung mit den geringsten Rechten: Application.ReadWrite.All

Die folgende Anforderung verweist mithilfe seiner appId auf den Dienstprinzipal. 8afc02cb-4d62-4dba-b536-9f6d73e9be26 ist die Objekt-ID für einen Benutzer oder Dienstprinzipal.

POST https://graph.microsoft.com/v1.0/servicePrincipals(appId='46e6adf4-a9cf-4b60-9390-0ba6fb00bf6b')/owners/$ref
Content-Type: application/json

{
    "@odata.id": "https://graph.microsoft.com/v1.0/directoryObjects/8afc02cb-4d62-4dba-b536-9f6d73e9be26"
}

Verwalten einer Azure AD-Anwendung mit Microsoft Graph

Voraussetzungen

Registrieren einer Anwendung bei Azure AD

Anforderung

Antwort

Konfigurieren anderer grundlegender Eigenschaften für Ihre App

Zuweisen von Berechtigungen zu einer App

Erstellen von App-Rollen

Erstellen von App-Rollen für ein Anwendungsobjekt

Verwalten von Besitzern

Identifizieren von besitzerlosen Dienstprinzipalen und Dienstprinzipalen mit einem Besitzer

Zuweisen eines Besitzers zu einer App

Zuweisen eines Besitzers zu einem Dienstprinzipal

Siehe auch

Zusätzliche Ressourcen

Zusätzliche Ressourcen

Verwalten einer Azure AD-Anwendung mit Microsoft Graph

Voraussetzungen

Registrieren einer Anwendung bei Azure AD

Anforderung

Antwort

Konfigurieren anderer grundlegender Eigenschaften für Ihre App

Beschränken der App-Anmeldung auf nur zugewiesene Identitäten

Zuweisen von Berechtigungen zu einer App

Erstellen von App-Rollen

Erstellen von App-Rollen für ein Anwendungsobjekt

Verwalten von Besitzern

Identifizieren von besitzerlosen Dienstprinzipalen und Dienstprinzipalen mit einem Besitzer

Zuweisen eines Besitzers zu einer App

Zuweisen eines Besitzers zu einem Dienstprinzipal

Siehe auch

Zusätzliche Ressourcen

Zusätzliche Ressourcen