Create identityProvider

Namespace: microsoft.graph

Create an identity provider object that is of the type specified in the request body.

Among the types of providers derived from identityProviderBase, you can currently create a socialIdentityProvider resource in Microsoft Entra ID. In Azure AD B2C, this operation can currently create a socialIdentityProvider, or an appleManagedIdentityProvider resource.

This API is available in the following national cloud deployments.

Global service US Government L4 US Government L5 (DOD) China operated by 21Vianet

Permissions

Choose the permission or permissions marked as least privileged for this API. Use a higher privileged permission or permissions only if your app requires it. For details about delegated and application permissions, see Permission types. To learn more about these permissions, see the permissions reference.

Permission type Least privileged permissions Higher privileged permissions
Delegated (work or school account) IdentityProvider.ReadWrite.All Not available.
Delegated (personal Microsoft account) Not supported. Not supported.
Application IdentityProvider.ReadWrite.All Not available.

The work or school account needs to belong to one of the following roles:

  • Global Administrator
  • External Identity Provider Administrator

HTTP request

POST /identity/identityProviders

Request headers

Name Description
Authorization Bearer {token}. Required. Learn more about authentication and authorization.
Content-Type application/json. Required.

Request body

In the request body, provide a JSON representation of socialIdentityProvider object in Microsoft Entra ID.

In Azure AD B2C provide a JSON representation of socialIdentityProvider, or an appleManagedIdentityProvider object.

socialIdentityProvider object

Property Type Description
clientId String The client identifier for the application obtained when registering the application with the identity provider.
clientSecret String The client secret for the application that is obtained when the application is registered with the identity provider. This is write-only. A read operation returns ****.
displayName String The display name of the identity provider.
identityProviderType String For a B2B scenario, possible values: Google, Facebook. For a B2C scenario, possible values: Microsoft, Google, Amazon, LinkedIn, Facebook, GitHub, Twitter, Weibo, QQ, WeChat.
scope String Scope defines the information and permissions you are looking to gather from your custom identity provider.

appleIdentityProvider object

Property Type Description
displayName String The display name of the identity provider.
developerId String The Apple developer identifier.
serviceId String The Apple service identifier.
keyId String The Apple key identifier.
certificateData String The certificate data which is a long string of text from the certificate, can be null.

Response

If successful, this method returns a 201 Created response code and a JSON representation of a socialIdentityProvider object in the response body for a Microsoft Entra tenant.

For an Azure AD B2C tenant, this method returns a 201 Created response code and a JSON representation of a socialIdentityProvider, or an appleManagedIdentityProvider object in the response body.

If unsuccessful, a 4xx error will be returned with specific details.

Examples

Example 1: Create a specific social identity provider (Microsoft Entra ID and Azure AD B2C)

Request

The following example shows a request.

POST https://graph.microsoft.com/v1.0/identity/identityProviders
Content-type: application/json

{
  "@odata.type": "microsoft.graph.socialIdentityProvider",
  "displayName": "Login with Amazon",
  "identityProviderType": "Amazon",
  "clientId": "56433757-cadd-4135-8431-2c9e3fd68ae8",
  "clientSecret": "000000000000"
}

Response

The following example shows the response.

Note: The response object shown here might be shortened for readability.

HTTP/1.1 201 Created
Content-type: application/json

{
    "@odata.type": "microsoft.graph.socialIdentityProvider",
    "id": "Amazon-OAUTH",
    "displayName": "Login with Amazon",
    "identityProviderType": "Amazon",
    "clientId": "56433757-cadd-4135-8431-2c9e3fd68ae8",
    "clientSecret": "000000000000"
}

Example 2: Retrieves Apple identity provider (only for Azure AD B2C)

Request

The following example shows a request.

POST https://graph.microsoft.com/v1.0/identity/identityProviders
Content-type: application/json

{
  "@odata.type": "microsoft.graph.appleManagedIdentityProvider",
  "displayName": "Sign in with Apple",
  "developerId": "UBF8T346G9",
  "serviceId": "com.microsoft.rts.b2c.test.client",
  "keyId": "99P6D879C4",
  "certificateData": "******"
}

Response

The following example shows the response.

Note: The response object shown here might be shortened for readability.

HTTP/1.1 201 Created
Content-type: application/json

{
  "@odata.type": "microsoft.graph.appleManagedIdentityProvider",
  "id": "Apple-Managed-OIDC",
  "displayName": "Sign in with Apple",
  "developerId": "UBF8T346G9",
  "serviceId": "com.microsoft.rts.b2c.test.client",
  "keyId": "99P6D879C4",
  "certificateData": "******"
}