Azure App Registration

Question

There is a company that uses Azure as their cloud service provider. I created an app registration from my Azure account and shared it with them. They granted permissions for Directory.Read.All and Application.Read.All and other permissions necessary to readt the enterprise applications and App Registrations . I'm able to read all the service principals (enterprise applications) and enterprise applications, except for some service principals (enterprise applications) and app registrations. Why is that?

Answer 1

Hello Yaswanth , Welcome to MS Q&A

The reason you may not be able to read some service principals and app registrations even with Directory.Read.All and Application.Read.All permissions is that these permissions only grant access to read all properties of single-tenant and multi-tenant applications outside of properties that cannot be read in any situation like credentials. To read other properties, you need to include the appropriate read permissions for the specific properties you want to access. For example, if you want to read the owners property on single-tenant and multi-tenant applications, you need the microsoft.directory/applications/owners/read permission.

---

References:

• Application registration permissions for custom roles in Microsoft Entra ID - Read
• Application and service principal objects in Microsoft Entra ID - Relationship between application objects and service principals

Kindly check and let us know if any further questions

Thanks
Deepanshu