application resource type

Namespace: microsoft.graph

Important

APIs under the /beta version in Microsoft Graph are subject to change. Use of these APIs in production applications is not supported. To determine whether an API is available in v1.0, use the Version selector.

Represents an application. Any application that outsources authentication to Azure Active Directory (Azure AD) must be registered in a directory. Application registration involves telling Azure AD about your application, including the URL where it's located, the URL to send replies after authentication, the URI to identify your application, and more. For more information, see Basics of Registering an Application in Azure AD. Inherits from directoryObject.

This resource is an open type that allows other properties to be passed in.

Note

Changes to the application resource type are currently in development. For more information, see Known issues with Microsoft Graph.

This resource supports:

• Adding your own data to custom properties as extensions.
• Using delta query to track incremental additions, deletions, and updates, by providing a delta function.
• Alternate key syntax. The appId property is a supported alternate key. For more information, see Get application.

Methods

Method	Return Type	Description
List applications	application collection	Retrieve the list of applications in the organization.
Create application	application	Creates (registers) a new application.
Get application	application	Read properties and relationships of application object.
Update application	None	Update application object.
Delete application	None	Delete application object.
List deleted applications	directoryObject collection	Retrieve a list of recently deleted applications.
List deleted applications owned by user	directoryObject collection	Retrieve the applications deleted in the tenant in the last 30 days and that are owned by a user.
Get deleted application	directoryObject	Retrieve the properties of a recently deleted application.
Permanently delete application	None	Permanently delete an applications.
Restore deleted application	directoryObject	Restore a recently deleted application.
delta	application collection	Get incremental changes for applications.
Create call	call	Create a new call by posting to the calls collection.
Create online meeting	onlineMeeting	Create a new online meeting by posting to the onlineMeetings collection.
Certificates and secrets
Add password	passwordCredential	Add a strong password or secret to an application.
Remove password	passwordCredential	Remove a password or secret from an application.
Add key	keyCredential	Add a key credential to an application.
Remove key	None	Remove a key credential from an application.
Extensions
List extensionProperties	extensionProperty collection	List extension properties on an application object.
Create extensionProperties	extensionProperty	Create an extension property on an application object.
Get extensionProperty	None	Get an extension property from an application object.
Delete extensionProperty	None	Delete an extension property from an application object.
Federated identity credentials
List federatedIdentityCredential	federatedIdentityCredential collection	List federated identity credentials on an application object.
Create federatedIdentityCredential	federatedIdentityCredential	Create a federated identity credential on an application object.
Get federatedIdentityCredential	federatedIdentityCredential	Retrieve the properties of a federated identity credential.
Update federatedIdentityCredential	None	Update a federated identity credential of an application object.
Delete federatedIdentityCredential	None	Delete a federated identity credential from an application object.
Owners
List owners	directoryObject collection	Get the owners of an application.
Add owner	directoryObject	Assign an owner to an application. Application owners can be users or service principals.
Remove owner	None	Remove an owner from an application. As a recommended best practice, apps should have at least two owners.
Policies
Assign tokenIssuancePolicy	tokenIssuancePolicy collection	Assign a tokenIssuancePolicy to this object.
List tokenIssuancePolicies	tokenIssuancePolicy collection	Get all tokenIssuancePolicies assigned to this object.
Remove tokenIssuancePolicy	tokenIssuancePolicy collection	Remove a tokenIssuancePolicy from this object.
Assign tokenLifetimePolicy	tokenLifetimePolicy collection	Assign a tokenLifetimePolicy to this object.
List tokenLifetimePolicies	tokenLifetimePolicy collection	Get all tokenLifetimePolicies assigned to this object.
Remove tokenLifetimePolicy	tokenLifetimePolicy collection	Remove a tokenLifetimePolicy from this object.
Verified publisher
Set verified publisher	None	Set the verified publisher of an application.
Unset verified publisher	None	Unset the verified publisher of an application.

Properties

Important

Specific usage of $filter and the $search query parameter is supported only when you use the ConsistencyLevel header set to eventual and $count. For more information, see Advanced query capabilities on Azure AD directory objects.

Property	Type	Description
addIns	addIn collection	Defines custom behavior that a consuming service can use to call an app in specific contexts. For example, applications that can render file streams may set the addIns property for its "FileHandler" functionality. This will let services like Office 365 call the application in the context of a document the user is working on.
api	apiApplication	Specifies settings for an application that implements a web API.
appId	String	The unique identifier for the application that is assigned by Azure AD. Not nullable. Read-only. Supports $filter (eq).
applicationTemplateId	String	Unique identifier of the applicationTemplate. Supports $filter (eq, not, ne).
appRoles	appRole collection	The collection of roles defined for the application. With app role assignments, these roles can be assigned to users, groups, or service principals associated with other applications. Not nullable.
certification	certification	Specifies the certification status of the application.
createdDateTime	DateTimeOffset	The date and time the application was registered. The DateTimeOffset type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z. Read-only. Supports $filter (eq, ne, not, ge, le, in, and eq on null values) and $orderBy.
defaultRedirectUri	String	The default redirect URI. If specified and there is no explicit redirect URI in the sign-in request for SAML and OIDC flows, Azure AD sends the token to this redirect URI. Azure AD also sends the token to this default URI in SAML IdP-initiated single sign-on. The value must match one of the configured redirect URIs for the application.
deletedDateTime	DateTimeOffset	The date and time the application was deleted. The DateTimeOffset type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z. Read-only.
description	String	Free text field to provide a description of the application object to end users. The maximum allowed size is 1024 characters. Returned by default. Supports $filter (eq, ne, not, ge, le, startsWith) and $search.
disabledByMicrosoftStatus	String	Specifies whether Microsoft has disabled the registered application. Possible values are: null (default value), NotDisabled, and DisabledDueToViolationOfServicesAgreement (reasons may include suspicious, abusive, or malicious activity, or a violation of the Microsoft Services Agreement). Supports $filter (eq, ne, not).
displayName	String	The display name for the application. Supports $filter (eq, ne, not, ge, le, in, startsWith, and eq on null values), $search, and $orderBy.
groupMembershipClaims	String	Configures the groups claim issued in a user or OAuth 2.0 access token that the application expects. To set this attribute, use one of the following string values: None, SecurityGroup (for security groups and Azure AD roles), All (this gets all security groups, distribution groups, and Azure AD directory roles that the signed-in user is a member of).
id	String	Unique identifier for the application object. This property is referred to as Object ID in the Azure portal. Inherited from directoryObject. Key. Not nullable. Read-only. Supports $filter (eq, ne, not, in).
identifierUris	String collection	Also known as App ID URI, this value is set when an application is used as a resource app. The identifierUris acts as the prefix for the scopes you'll reference in your API's code, and it must be globally unique. You can use the default value provided, which is in the form api://<application-client-id>, or specify a more readable URI like https://contoso.com/api. For more information on valid identifierUris patterns and best practices, see Azure AD application registration security best practices. Not nullable. Supports $filter (eq, ne, ge, le, startsWith).
info	informationalUrl	Basic profile information of the application, such as it's marketing, support, terms of service, and privacy statement URLs. The terms of service and privacy statement are surfaced to users through the user consent experience. For more information, see How to: Add Terms of service and privacy statement for registered Azure AD apps. Supports $filter (eq, ne, not, ge, le, and eq on null values).
isDeviceOnlyAuthSupported	Boolean	Specifies whether this application supports device authentication without a user. The default is false.
isFallbackPublicClient	Boolean	Specifies the fallback application type as public client, such as an installed application running on a mobile device. The default value is false which means the fallback application type is confidential client such as a web app. There are certain scenarios where Azure AD cannot determine the client application type. For example, the ROPC flow where the application is configured without specifying a redirect URI. In those cases Azure AD interprets the application type based on the value of this property.
keyCredentials	keyCredential collection	The collection of key credentials associated with the application. Not nullable. Supports $filter (eq, not, ge, le).
logo	Stream	The main logo for the application. Not nullable.
notes	String	Notes relevant for the management of the application.
oauth2RequiredPostResponse	Boolean	Specifies whether, as part of OAuth 2.0 token requests, Azure AD allows POST requests, as opposed to GET requests. The default is false, which specifies that only GET requests are allowed.
onPremisesPublishing	onPremisesPublishing	Represents the set of properties required for configuring Application Proxy for this application. Configuring these properties allows you to publish your on-premises application for secure remote access.
optionalClaims	optionalClaims	Application developers can configure optional claims in their Azure AD applications to specify the claims that are sent to their application by the Microsoft security token service. For more information, see How to: Provide optional claims to your app.
parentalControlSettings	parentalControlSettings	Specifies parental control settings for an application.
passwordCredentials	passwordCredential collection	The collection of password credentials associated with the application. Not nullable.
publicClient	publicClientApplication	Specifies settings for installed clients such as desktop or mobile devices.
publisherDomain	String	The verified publisher domain for the application. Read-only. Supports $filter (eq, ne, ge, le, startsWith).
requestSignatureVerification	requestSignatureVerification	Specifies whether this application requires Azure AD to verify the signed authentication requests.
requiredResourceAccess	requiredResourceAccess collection	Specifies the resources that the application needs to access. This property also specifies the set of delegated permissions and application roles that it needs for each of those resources. This configuration of access to the required resources drives the consent experience. No more than 50 resource services (APIs) can be configured. Beginning mid-October 2021, the total number of required permissions must not exceed 400. For more information, see Limits on requested permissions per app. Not nullable. Supports $filter (eq, not, ge, le).
samlMetadataUrl	String	The URL where the service exposes SAML metadata for federation. This property is valid only for single-tenant applications. Nullable.
serviceManagementReference	String	References application or service contact information from a Service or Asset Management database. Nullable.
signInAudience	String	Specifies the Microsoft accounts that are supported for the current application. The possible values are: AzureADMyOrg, AzureADMultipleOrgs, AzureADandPersonalMicrosoftAccount (default), and PersonalMicrosoftAccount. See more in the table. The value of this object also limits the number of permissions an app can request. For more information, see Limits on requested permissions per app. The value for this property has implications on other app object properties. As a result, if you change this property, you may need to change other properties first. For more information, see Validation differences for signInAudience. Supports $filter (eq, ne, not).
servicePrincipalLockConfiguration	servicePrincipalLockConfiguration	Specifies whether sensitive properties of a multi-tenant application should be locked for editing after the application is provisioned in a tenant. Nullable. null by default.
spa	spaApplication	Specifies settings for a single-page application, including sign out URLs and redirect URIs for authorization codes and access tokens.
tags	String collection	Custom strings that can be used to categorize and identify the application. Not nullable. Strings added here will also appear in the tags property of any associated service principals. Supports $filter (eq, not, ge, le, startsWith) and $search.
tokenEncryptionKeyId	Guid	Specifies the keyId of a public key from the keyCredentials collection. When configured, Azure AD encrypts all the tokens it emits by using the key this property points to. The application code that receives the encrypted token must use the matching private key to decrypt the token before it can be used for the signed-in user.
verifiedPublisher	verifiedPublisher	Specifies the verified publisher of the application. For more information about how publisher verification helps support application security, trustworthiness, and compliance, see Publisher verification.
uniqueName	String	The unique identifier that can be assigned to an application as an alternative identifier. Immutable. Read-only.
web	webApplication	Specifies settings for a web application.
windows	windowsApplication	Specifies settings for apps running Microsoft Windows and published in the Microsoft Store or Xbox games store.

signInAudience values

Value	Description
AzureADMyOrg	Users with a Microsoft work or school account in my organization’s Azure AD tenant (single-tenant).
AzureADMultipleOrgs	Users with a Microsoft work or school account in any organization’s Azure AD tenant (multi-tenant).
AzureADandPersonalMicrosoftAccount	Users with a personal Microsoft account, or a work or school account in any organization’s Azure AD tenant. For authenticating users with Azure AD B2C user flows, use AzureADandPersonalMicrosoftAccount. This value allows for the widest set of user identities including local accounts and user identities from Microsoft, Facebook, Google, Twitter, or any OpenID Connect provider. This is the default value for the signInAudience property.
PersonalMicrosoftAccount	Users with a personal Microsoft account only.

Limits on requested permissions per app

Azure AD limits the number of permissions that can be requested and consented by a client app. These limits depend on the signInAudience value for an app, shown in the app's manifest.

signInAudience	Allowed users	Maximum permissions the app can request	Maximum Microsoft Graph permissions the app can request	Maximum permissions that can be consented in a single request
AzureADMyOrg	Users from the organization where the app is registered	400	400	About 155 delegated permissions and about 300 application permissions
AzureADMultipleOrgs	Users from any Azure AD organization	400	400	About 155 delegated permissions and about 300 application permissions
PersonalMicrosoftAccount	Consumer users (such as Outlook.com or Live.com accounts)	30	30	30
AzureADandPersonalMicrosoftAccount	Consumer users and users from any Azure AD organization	30	30	30

Relationships

Important

Specific usage of the $filter query parameter is supported only when you use the ConsistencyLevel header set to eventual and $count. For more information, see Advanced query capabilities on Azure AD directory objects.

Relationship	Type	Description
appManagementPolicies	appManagementPolicy collection	The appManagementPolicy applied to this application.
calls	call collection	Read-only. Nullable.
connectorGroup	connectorGroup	The connectorGroup the application is using with Azure AD Application Proxy. Nullable.
createdOnBehalfOf	directoryObject	Supports $filter (/$count eq 0, /$count ne 0). Read-only.
extensionProperties	extensionProperty collection	Read-only. Nullable. Supports $expand and $filter (/$count eq 0, /$count ne 0).
federatedIdentityCredentials	federatedIdentityCredential collection	Federated identities for applications. Supports $expand and $filter (startsWith, /$count eq 0, /$count ne 0).
onlineMeetings	onlineMeeting collection	Read-only. Nullable.
owners	directoryObject collection	Directory objects that are owners of the application. Read-only. Nullable. Supports $expand and $filter (/$count eq 0, /$count ne 0, /$count eq 1, /$count ne 1).
synchronization	synchronization	Represents the capability for Azure Active Directory (Azure AD) identity synchronization through the Microsoft Graph API.
tokenLifetimePolicies	tokenLifetimePolicy collection	The tokenLifetimePolicies assigned to this application. Supports $expand.

JSON representation

The following is a JSON representation of the resource.

{
  "addIns": [{"@odata.type": "microsoft.graph.addIn"}],
  "api": {"@odata.type": "microsoft.graph.apiApplication"},
  "appId": "String",
  "applicationTemplateId": "String",
  "appRoles": [{"@odata.type": "microsoft.graph.appRole"}],
  "certification": {"@odata.type": "microsoft.graph.certification"},
  "createdDateTime": "String (timestamp)",
  "deletedDateTime": "String (timestamp)",
  "disabledByMicrosoftStatus": "String",
  "displayName": "String",
  "groupMembershipClaims": "String",
  "id": "String (identifier)",
  "identifierUris": ["String"],
  "info": {"@odata.type": "microsoft.graph.informationalUrl"},
  "isDeviceOnlyAuthSupported": false,
  "isFallbackPublicClient": false,
  "keyCredentials": [{"@odata.type": "microsoft.graph.keyCredential"}],
  "logo": "Stream",
  "notes": "String",
  "oauth2RequiredPostResponse": false,
  "optionalClaims": {"@odata.type": "microsoft.graph.optionalClaims"},
  "parentalControlSettings": {"@odata.type": "microsoft.graph.parentalControlSettings"},
  "passwordCredentials": [{"@odata.type": "microsoft.graph.passwordCredential"}],
  "publicClient": {"@odata.type": "microsoft.graph.publicClientApplication"},
  "publisherDomain": "String",  
  "requestSignatureVerification": {"@odata.type": "microsoft.graph.requestSignatureVerification"},
  "requiredResourceAccess": [{"@odata.type": "microsoft.graph.requiredResourceAccess"}],
  "servicePrincipalLockConfiguration": {"@odata.type": "microsoft.graph.servicePrincipalLockConfiguration"},
  "serviceManagementReference": "String",
  "signInAudience": "String",
  "spa": {"@odata.type": "microsoft.graph.spaApplication"},
  "tags": ["String"],
  "tokenEncryptionKeyId": "String",
  "uniqueName": "String",
  "verifiedPublisher": {"@odata.type": "microsoft.graph.verifiedPublisher"},
  "web": {"@odata.type": "microsoft.graph.webApplication"},
  "windows": {"@odata.type": "microsoft.graph.windowsApplication"}
}