application resource type

Namespace: microsoft.graph

Represents an application. Any application that outsources authentication to Azure Active Directory (Azure AD) must be registered in a directory. Application registration involves telling Azure AD about your application, including the URL where it's located, the URL to send replies after authentication, the URI to identify your application, and more. For more information, see Basics of Registering an Application in Azure AD. Inherits from directoryObject.

This resource supports using delta query to track incremental additions, deletions, and updates, by providing a delta function.


Method Return Type Description
List applications application collection Retrieve the list of applications in the organization.
Create application application Creates (registers) a new application.
Get application application Read properties and relationships of application object.
Update application application Update application object.
Delete application None Delete application object.
Get delta application Get newly created, updated, or deleted applications without performing a full read of the entire resource collection.
List deleted applications directoryObject collection Retrieve a list of recently deleted applications.
Get deleted application directoryObject Retrieve the properties of a recently deleted application.
Permanently delete application None Permanently delete an applications.
Restore deleted application directoryObject Restore a recently deleted application.
Certificates and secrets
Add password passwordCredential Add a strong password to an application.
Remove password passwordCredential Remove a password from an application.
Add key keyCredential Add a key credential to an application.
Remove key None Remove a key credential from an application.
List extensions extensionProperty collection List extension properties on an application object.
Create extension extensionProperty Create an extension property on an application object.
Delete extension None Delete an extension property from an application object.
Get available extension properties extensionProperty collection Get all or a filtered list of the directory extension properties that have been registered in a directory.
List owners directoryObject collection Get an owner object collection.
Add owner directoryObject Add an owner by posting to the owners collection.
Remove owner None Remove an owner from an application.
Assign tokenIssuancePolicy tokenIssuancePolicy collection Assign a tokenIssuancePolicy to this object.
List tokenIssuancePolicies tokenIssuancePolicy collection Get all tokenIssuancePolicies assigned to this object.
Remove tokenIssuancePolicy tokenIssuancePolicy collection Remove a tokenIssuancePolicy from this object.
Assign tokenLifetimePolicy tokenLifetimePolicy collection Assign a tokenLifetimePolicy to this object.
List tokenLifetimePolicies tokenLifetimePolicy collection Get all tokenLifetimePolicies assigned to this object.
Remove tokenLifetimePolicy tokenLifetimePolicy collection Remove a tokenLifetimePolicy from this object.
Verified publisher
Set verified publisher None Set the verified publisher of an application.
Unset verified publisher None Unset the verified publisher of an application.


Property Type Description
addIns addIn collection Defines custom behavior that a consuming service can use to call an app in specific contexts. For example, applications that can render file streams may set the addIns property for its "FileHandler" functionality. This will let services like Microsoft 365 call the application in the context of a document the user is working on.
api apiApplication Specifies settings for an application that implements a web API.
appId String The unique identifier for the application that is assigned to an application by Azure AD. Not nullable. Read-only.
appRoles appRole collection The collection of roles the application declares. With app role assignments, these roles can be assigned to users, groups, or other applications' service principals. Not nullable.
createdDateTime DateTimeOffset The date and time the application was registered. Read-only.
deletedDateTime DateTimeOffset The date and time the application was deleted. Read-only.
displayName String The display name for the application.
groupMembershipClaims String Configures the groups claim issued in a user or OAuth 2.0 access token that the application expects. To set this attribute, use one of the following valid string values:
  • None
  • SecurityGroup: For security groups and Azure AD roles
  • All: This will get all of the security groups, distribution groups, and Azure AD directory roles that the signed-in user is a member of
id String The unique identifier for the application. Inherited from directoryObject. Key. Not nullable. Read-only.
identifierUris String collection The URIs that identify the application within its Azure AD tenant, or within a verified custom domain if the application is multi-tenant. For more information see Application Objects and Service Principal Objects. The any operator is required for filter expressions on multi-valued properties. Not nullable.
info informationalUrl Basic profile information of the application such as app's marketing, support, terms of service and privacy statement URLs. The terms of service and privacy statement are surfaced to users through the user consent experience. For more info, see How to: Add Terms of service and privacy statement for registered Azure AD apps.
isFallbackPublicClient Boolean Specifies the fallback application type as public client, such as an installed application running on a mobile device. The default value is false which means the fallback application type is confidential client such as web app. There are certain scenarios where Azure AD cannot determine the client application type (e.g. ROPC flow where it is configured without specifying a redirect URI). In those cases Azure AD will interpret the application type based on the value of this property.
keyCredentials keyCredential collection The collection of key credentials associated with the application Not nullable.
logo Stream The main logo for the application. Not nullable.
optionalClaims optionalClaims Application developers can configure optional claims in their Azure AD apps to specify which claims they want in tokens sent to their application by the Microsoft security token service. See provide optional claims to your Azure AD app for more information.
parentalControlSettings parentalControlSettings Specifies parental control settings for an application.
passwordCredentials passwordCredential collection The collection of password credentials associated with the application. Not nullable.
publicClient publicClientApplication Specifies settings for installed clients such as desktop or mobile devices.
publisherDomain String The verified publisher domain for the application. Read-only.
requiredResourceAccess requiredResourceAccess collection Specifies resources that this application requires access to and the set of OAuth permission scopes and application roles that it needs under each of those resources. This pre-configuration of required resource access drives the consent experience. Not nullable.
signInAudience String Specifies the Microsoft accounts that are supported for the current application. Supported values are:
  • AzureADMyOrg: Users with a Microsoft work or school account in my organization’s Azure AD tenant (single tenant)
  • AzureADMultipleOrgs: Users with a Microsoft work or school account in any organization’s Azure AD tenant (multi-tenant).
  • AzureADandPersonalMicrosoftAccount: Users with a personal Microsoft account, or a work or school account in any organization’s Azure AD tenant.
  • PersonalMicrosoftAccount: Users with a personal Microsoft account only.
tags String collection Custom strings that can be used to categorize and identify the application. Not nullable.
tokenEncryptionKeyId String Specifies the keyId of a public key from the keyCredentials collection. When configured, Azure AD encrypts all the tokens it emits by using the key this property points to. The application code that receives the encrypted token must use the matching private key to decrypt the token before it can be used for the signed-in user.
verifiedPublisher verifiedPublisher Specifies the verified publisher of the application.
web webApplication Specifies settings for a web application.


Relationship Type Description
createdOnBehalfOf directoryObject Read-only.
extensionProperties extensionProperty collection Read-only. Nullable.
owners directoryObject collection Directory objects that are owners of the application. The owners are a set of non-admin users who are allowed to modify this object. Requires version 2013-11-08 or newer. Read-only. Nullable.

JSON representation

The following is a JSON representation of the resource.

  "addIns": [{"@odata.type": "microsoft.graph.addIn"}],
  "api": {"@odata.type": "microsoft.graph.apiApplication"},
  "appId": "String",
  "appRoles": [{"@odata.type": "microsoft.graph.appRole"}],
  "createdDateTime": "String (timestamp)",
  "deletedDateTime": "String (timestamp)",
  "displayName": "String",
  "groupMembershipClaims": "String",
  "id": "String (identifier)",
  "identifierUris": ["String"],
  "info": {"@odata.type": "microsoft.graph.informationalUrl"},
  "isFallbackPublicClient": false,
  "keyCredentials": [{"@odata.type": "microsoft.graph.keyCredential"}],
  "logo": "Stream",
  "optionalClaims": {"@odata.type": "microsoft.graph.optionalClaims"},
  "parentalControlSettings": {"@odata.type": "microsoft.graph.parentalControlSettings"},
  "passwordCredentials": [{"@odata.type": "microsoft.graph.passwordCredential"}],
  "publicClient": {"@odata.type": "microsoft.graph.publicClientApplication"},
  "publisherDomain": "String",
  "requiredResourceAccess": [{"@odata.type": "microsoft.graph.requiredResourceAccess"}],
  "signInAudience": "String",
  "tags": ["String"],
  "tokenEncryptionKeyId": "String",
  "verifiedPublisher": {"@odata.type": "microsoft.graph.verifiedPublisher"},
  "web": {"@odata.type": "microsoft.graph.webApplication"}