Hide an Enterprise application
Learn how to hide enterprise applications in Microsoft Entra ID. When an application is hidden, users still have permissions to the application.
Prerequisites
To hide an application from the My Apps portal and Microsoft 365 launcher, you need:
- An Azure account with an active subscription. Create an account for free.
- One of the following roles: Cloud Application Administrator, Application Administrator.
- Global Administrator is required to hide all Microsoft 365 applications.
Hide an application from the end user
Use the following steps to hide an application from My Apps portal and Microsoft 365 application launcher.
- Sign in to the Microsoft Entra admin center as at least a cloud application administrator.
- Browse to Identity > Applications > Enterprise applications > All applications.
- Search for the application you want to hide, and select the application.
- In the left navigation pane, select Properties.
- Select No for the Visible to users? question.
- Select Save.
Note
These instructions apply only to Enterprise applications.
To hide an application from the My Apps portal, using Azure AD PowerShell, you need to connect to Azure AD PowerShell and sign in as at least a Cloud Application Administrator. You can manually add the HideApp tag to the service principal for the application. Run the following Azure AD PowerShell commands to set the application's Visible to Users? property to No.
Connect-AzureAD
$objectId = "<objectId>"
$servicePrincipal = Get-AzureADServicePrincipal -ObjectId $objectId
$tags = $servicePrincipal.tags
$tags += "HideApp"
Set-AzureADServicePrincipal -ObjectId $objectId -Tags $tags
To hide an application from the My Apps portal, using Microsoft Graph PowerShell, you need to connect to Microsoft Graph PowerShell and sign in as at least a Cloud Application Administrator. You can manually add the HideApp tag to the service principal for the application. Run the following Microsoft Graph PowerShell commands to set the application's Visible to Users? property to No.
Connect-MgGraph
$servicePrincipal = Get-MgServicePrincipal -ServicePrincipalId $objectId
$tags = $servicePrincipal.tags
$tags += "HideApp"
Update-MgServicePrincipal -ServicePrincipalID $objectId -Tags $tags
To hide an enterprise application using Graph Explorer, you need to sign in as at least a Cloud Application Administrator.
Run the following queries.
Get the application you want to hide.
GET https://graph.microsoft.com/v1.0/servicePrincipals/00001111-aaaa-2222-bbbb-3333cccc4444
Update the application to hide it from users.
PATCH https://graph.microsoft.com/v1.0/servicePrincipals/00001111-aaaa-2222-bbbb-3333cccc4444/
Supply the following request body.
{ "tags": [ "HideApp" ] }
Warning
If the application has other tags, you must include them in the request body. Otherwise, the query will overwrite them.
Hide Microsoft 365 applications from the My Apps portal
Tip
Steps in this article might vary slightly based on the portal you start from.
Use the following steps to hide all Microsoft 365 applications from the My Apps portal. The applications are still visible in the Office 365 portal.
- Sign in to the Microsoft Entra admin center as a Global Administrator.
Important
Microsoft recommends that you use roles with the fewest permissions. This helps improve security for your organization. Global Administrator is a highly privileged role that should be limited to emergency scenarios when you can't use an existing role.
- Browse to Identity > Applications > Enterprise applications.
- Select App launchers under Manage menu items.
- Select Settings.
- Enable the option of Users can only see Microsoft 365 apps in the Microsoft 365 portal.
- Select Save.