application resource type

Important: APIs under the /beta version in Microsoft Graph are in preview and are subject to change. Use of these APIs in production applications is not supported.

Represents an application. Any application that outsources authentication to Azure Active Directory (Azure AD) must be registered in a directory. Application registration involves telling Azure AD about your application, including the URL where it's located, the URL to send replies after authentication, the URI to identify your application, and more. For more information, see Basics of Registering an Application in Azure AD. Inherits from directoryObject.

Note: Changes to application resource type is currently in development for preview. Please see known issues with Microsoft Graph for more information.

JSON representation

Here is a JSON representation of the resource

  "allowPublicClient": true,
  "api": {"@odata.type": "microsoft.graph.api"},
  "applicationAliases": ["String"],
  "createdDateTime": "String (timestamp)",
  "deletedDateTime": "String (timestamp)",
  "displayName": "String",
  "id": "String (identifier)",
  "info": {"@odata.type": "microsoft.graph.informationalUrl"},
  "installedClients": {"@odata.type": "microsoft.graph.installedClient"},
  "keyCredentials": [{"@odata.type": "microsoft.graph.keyCredential"}],
  "logo": "Stream",
  "orgRestrictions": ["Guid"],
  "passwordCredentials": [{"@odata.type": "microsoft.graph.passwordCredential"}],
  "preAuthorizedApplications": [{"@odata.type": "microsoft.graph.preAuthorizedApplication"}],
  "requiredResourceAccess": [{"@odata.type": "microsoft.graph.requiredResourceAccess"}],
  "tags": ["String"],
  "web": {"@odata.type": "microsoft.graph.web"}


Property Type Description
allowPublicClient Boolean Specifies if the application can act as a public client. For example, an installed application running on a mobile device. Default value is false.
api api Specifies settings for an API application.
appRoles appRole collection The collection of application roles that an application may declare. These roles can be assigned to users, groups, or service principals. Not nullable.
applicationAliases String collection The URIs that identify the application. For more information see, Application Objects and Service Principal Objects. The any operator is required for filter expressions on multi-valued properties. Not nullable.
createdDateTime DateTimeOffset The date and time the application was registered.
deletedDateTime DateTimeOffset The date and time the application was deleted.
displayName String The display name for the application.
id String The unique identifier for the application. Inherited from directoryObject. Key. Not nullable. Read-only.
info informationalUrl Basic profile information of the application.
installedClients installedClient Specifies settings for installed clients such as desktop or mobile devices.
keyCredentials keyCredential collection The collection of key credentials associated with the application Not nullable.
logo Stream The main logo for the application. Not nullable.
orgRestrictions String collection The organizational tenantIds to which the application is restricted. If the collection is empty, the application is multi-tenant (not restricted). If the collection contains tenantIds, the application is restricted to the organizational tenantIds in the collection. Specifying other tenants but not the tenantId where the application is registered implies that the application's own tenantId is indirectly included.
passwordCredentials passwordCredential collection The collection of password credentials associated with the application. Not nullable.
preAuthorizedApplications preAuthorizedApplication collection Lists applications and requested permissions for implicit consent. Requires an admin to have provided consent to the application. preAuthorizedApplications do not require the user to consent to the requested permissions. Permissions listed in preAuthorizedApplications do not require user consent. However, any additional requested permissions not listed in preAuthorizedApplications require user consent.
requiredResourceAccess requiredResourceAccess collection Specifies resources that this application requires access to and the set of OAuth permission scopes and application roles that it needs under each of those resources. This pre-configuration of required resource access drives the consent experience. Not nullable.
tags String collection Custom strings that can be used to categorize and identify the application.
web web Specifies settings for a web application.


Relationship Type Description
connectorGroup connectorGroup The connectorGroup the application is using with Azure AD Application Proxy. Nullable.
createdOnBehalfOf directoryObject Read-only.
extensionProperties extensionProperty collection The extension properties associated with the application. Read-only. Nullable.
owners directoryObject collection Directory objects that are owners of the application. The owners are a set of non-admin users who are allowed to modify this object. Requires version 2013-11-08 or newer. Read-only. Nullable.
policy policy collection The policies assigned to this application.


Method Return Type Description
Get application application Read properties and relationships of application object.
Create application application Creates (registers) a new application.
List applications application Retrieve the list of applications in the organization.
Update application application Update application object.
Delete application None Delete application object.
List extensionProperties extensionProperty collection Get a extensionProperty object collection.
List assigned policies policy collection Get all policies assigned to this object.
Create owner directoryObject Create a new owner by posting to the owners collection.
List owners directoryObject collection Get an owner object collection.