MicrosoftGraphApplications

Details

ID	`MicrosoftGraphApplications`
Provider	Microsoft
Category	IT Services
From Version	5.0.0
Docker Image	`demisto/crypto:1.0.0.8187750`
Supported Modules	Agentix Cloud Runtime Security Cloud Posture Security XSIAM EDR Cortex Cloud

README

Use the Entra ID Applications integration (formerly Azure Active Directory Applications) to manage authorized applications.
This integration was integrated and tested with version v1.0 of Microsoft Graph Services API.

Configure Entra ID Applications in Cortex

Parameter	Description	Required
Application ID		False
Azure AD endpoint	Azure AD endpoint associated with a national cloud.	False
Trust any certificate (not secure)		False
Use system proxy settings		False
Authentication Type	Type of authentication - could be Client Credentials Authorization Flow (recommended) or Device Flow	False
Tenant ID (for Client Credentials mode)		False
Client Secret (for Client Credentials mode)		False
Azure Managed Identities Client ID	The Managed Identities client ID for authentication - relevant only if the integration is running on Azure VM.	False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

msgraph-apps-auth-start

Run this command to start the authorization process and follow the instructions in the command results.

msgraph-apps-auth-complete

Run this command to complete the authorization process. Should be used after running the msgraph-apps-auth-start command.

msgraph-apps-auth-reset

Run this command if for some reason you need to rerun the authentication process.

msgraph-apps-auth-test

Tests connectivity to Microsoft.

msgraph-apps-service-principal-list

Retrieves a list of applications.

Base Command

msgraph-apps-service-principal-list

Input

Argument Name	Description	Required
limit	Maximum results to fetch. A value of 0 fetches all results. Default is 10.	Optional

Context Output

Path	Type	Description
MSGraphApplication.keyCredentials.keyId	String	The unique identifier (GUID) for the key.
MSGraphApplication.keyCredentials.customKeyIdentifier	String	Custom key identifier.
MSGraphApplication.keyCredentials.displayName	String	Friendly name for the key. Optional.
MSGraphApplication.keyCredentials.type	String	The type of key credential; for example, “Symmetric”.
MSGraphApplication.keyCredentials.key	String	The certificate’s raw data in byte array converted to Base64 string.
MSGraphApplication.keyCredentials.usage	String	A string that describes the purpose for which the key can be used; for example, “Verify”.
MSGraphApplication.keyCredentials.startDateTime	Date	The date and time at which the credential expires.The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 would look like this: ‘2014-01-01T00:00:00Z’
MSGraphApplication.keyCredentials.endDateTime	Date	The date and time at which the credential becomes valid.The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 would look like this: ‘2014-01-01T00:00:00Z’
MSGraphApplication.accountEnabled	Boolean	true if the application account is enabled; otherwise, false.
MSGraphApplication.appDescription	String	A brief description of the application.
MSGraphApplication.appDisplayName	String	The display name exposed by the associated application.
MSGraphApplication.appId	String	The unique identifier for the associated application (its appId property).
MSGraphApplication.appOwnerOrganizationId	String	Contains the tenant ID where the application is registered. This is applicable only to service principals backed by applications.
MSGraphApplication.appRoleAssignmentRequired	Boolean	Whether users or other service principals need to be granted an application role assignment for this service principal before users can sign in or apps can get tokens. Default is false.
MSGraphApplication.applicationTemplateId	String	Unique identifier of the application template that the service principal was created from.
MSGraphApplication.createdDateTime	Date	Time the application was created.
MSGraphApplication.deletedDateTime	Date	Time the application was deleted.
MSGraphApplication.description	String	A brief description of the application.
MSGraphApplication.displayName	String	The display name for the application.
MSGraphApplication.homepage	String	Home page or landing page of the application.
MSGraphApplication.id	String	The unique identifier for the application.
MSGraphApplication.info.logoUrl	String	Content delivery network (CDN) URL to the application’s logo.
MSGraphApplication.info.marketingUrl	String	Link to the application’s marketing page.
MSGraphApplication.info.privacyStatementUrl	String	Link to the application’s privacy statement.
MSGraphApplication.info.supportUrl	String	Link to the application’s support page.
MSGraphApplication.info.termsOfServiceUrl	String	Link to the application’s terms of service statement.
MSGraphApplication.loginUrl	String	The URL where the service provider redirects the user to Microsoft Entra ID to authenticate. Microsoft Entra ID uses the URL to launch the application from Microsoft 365 or the Microsoft Entra My Apps.
MSGraphApplication.logoutUrl	String	Specifies the URL that will be used by Microsoft’s authorization service to log out an user.
MSGraphApplication.notes	String	The application’s notes.
MSGraphApplication.oauth2PermissionScopes.adminConsentDescription	String	A description of the delegated permissions, intended to be read by an administrator granting the permission on behalf of all users. This text appears in tenant-wide admin consent experiences.
MSGraphApplication.oauth2PermissionScopes.adminConsentDisplayName	String	The permission’s title, intended to be read by an administrator granting the permission on behalf of all users.
MSGraphApplication.oauth2PermissionScopes.id	String	Unique delegated permission identifier inside the collection of delegated permissions defined for a resource application.
MSGraphApplication.oauth2PermissionScopes.isEnabled	Boolean	Whether OAuth 2.0 permission scopes are enabled.
MSGraphApplication.oauth2PermissionScopes.type	String	Whether this delegated permission should be considered safe for non-admin users to consent to on behalf of themselves, or whether an administrator should be required for consent to the permissions.
MSGraphApplication.oauth2PermissionScopes.userConsentDescription	String	A description of the delegated permissions, intended to be read by a user granting the permission on their own behalf. This text appears in consent experiences where the user is consenting only on behalf of themselves.
MSGraphApplication.oauth2PermissionScopes.userConsentDisplayName	String	A title for the permission.
MSGraphApplication.oauth2PermissionScopes.value	String	The value to include in the scope claim in access tokens.
MSGraphApplication.preferredSingleSignOnMode	String	The single sign-on mode configured for this application. Microsoft Entra ID uses the preferred single sign-on mode to launch the application from Microsoft 365 or the Microsoft Entra My Apps. The supported values are password, SAML, external, and OIDC.
MSGraphApplication.preferredTokenSigningKeyThumbprint	String	Thumbprint of preferred certificate to sign the token.
MSGraphApplication.replyUrls	String	The URLs that user tokens are sent to for signing in with the associated application, or the redirect URIs that OAuth 2.0 authorization codes and access tokens are sent to for the associated application.
MSGraphApplication.samlSingleSignOnSettings	String	The collection for settings related to SAML single sign-on.
MSGraphApplication.servicePrincipalNames	String	The list of identifier URIs.
MSGraphApplication.servicePrincipalType	String	Identifies if the service principal represents an application or a managed identity.
MSGraphApplication.signInAudience	String	The audience that can sign in.
MSGraphApplication.tokenEncryptionKeyId	String	The key ID of a public key from the key credentials.
MSGraphApplication.verifiedPublisher.addedDateTime	Date	The timestamp when the verified publisher was first added or most recently updated.
MSGraphApplication.verifiedPublisher.displayName	String	The verified publisher name from the application publisher’s Partner Center account.
MSGraphApplication.verifiedPublisher.verifiedPublisherId	String	The ID of the verified publisher from the application publisher’s Partner Center account.

Command Example

!msgraph-apps-service-principal-list limit=1

Context Example

{
    "MSGraphApplication": {
        "accountEnabled": true,
        "addIns": [],
        "alternativeNames": [],
        "appDescription": null,
        "appDisplayName": "Common Data Service",
        "appId": "00000007-0000-0000-c000-000000000000",
        "appOwnerOrganizationId": ":app-owner-organization-id:",
        "appRoleAssignmentRequired": false,
        "appRoles": [],
        "applicationTemplateId": null,
        "createdDateTime": "2019-12-11T11:35:03Z",
        "deletedDateTime": null,
        "description": null,
        "displayName": "Common Data Service",
        "homepage": null,
        "id": ":id:",
        "info": {
            "logoUrl": null,
            "marketingUrl": null,
            "privacyStatementUrl": null,
            "supportUrl": null,
            "termsOfServiceUrl": null
        },
        "keyCredentials": [],
        "loginUrl": null,
        "logoutUrl": null,
        "notes": null,
        "notificationEmailAddresses": [],
        "oauth2PermissionScopes": [
            {
                "adminConsentDescription": "Allows the application to access Common Data Service acting as users in the organization.",
                "adminConsentDisplayName": "Access Common Data Service as organization users",
                "id": ":id:",
                "isEnabled": true,
                "type": "User",
                "userConsentDescription": "Allows the application to access Common Data Service as you.",
                "userConsentDisplayName": "Access Common Data Service as you",
                "value": "user_impersonation"
            }
        ],
        "passwordCredentials": [],
        "preferredSingleSignOnMode": null,
        "preferredTokenSigningKeyThumbprint": null,
        "replyUrls": [
            "https://admin.example.com/",
            "https://port.example..com/",
            "https://cloudredirector.example.com/"
        ],
        "resourceSpecificApplicationPermissions": [],
        "samlSingleSignOnSettings": null,
        "servicePrincipalNames": [
            "https://admin.example.com/",
            "https://port.example.com/",
            "https://cloudredirector.example.com/"
        ],
        "servicePrincipalType": "Application",
        "signInAudience": "AzureADMultipleOrgs",
        "tags": [],
        "tokenEncryptionKeyId": null,
        "verifiedPublisher": {
            "addedDateTime": null,
            "displayName": null,
            "verifiedPublisherId": null
        }
    }
}

Human Readable Output

Available services (applications)

id appId appDisplayName accountEnabled

:id: 00000007-0000-0000-c000-000000000000 Common Data Service true

id	appId	appDisplayName	accountEnabled
:id:	00000007-0000-0000-c000-000000000000	Common Data Service	true

msgraph-apps-service-principal-remove

Removes an application from the directory.

Base Command

msgraph-apps-service-principal-remove

Input

Argument Name	Description	Required
id	The application id to remove. Can be retrieved via the msgraph-apps-service-principal-list command.	Optional
app_id	The application client id to remove. Can be retrieved via the msgraph-apps-service-principal-list command.	Optional

Context Output

There is no context output for this command.

Command Example

!msgraph-apps-service-principal-remove id=ID_TEST

Human Readable Output

Service ID_TEST was deleted.

msgraph-apps-service-principal-get

Retrieve the properties and relationships of a servicePrincipal object.

Base Command

msgraph-apps-service-principal-get

Input

Argument Name	Description	Required
id	The application id to get. Can be retrieved via the msgraph-apps-service-principal-list command.	Optional
app_id	The application client id to get. Can be retrieved via the msgraph-apps-service-principal-list command.	Optional

Context Output

Path	Type	Description
MSGraphApplication.keyCredentials.keyId	String	The unique identifier (GUID) for the key.
MSGraphApplication.keyCredentials.customKeyIdentifier	String	Custom key identifier.
MSGraphApplication.keyCredentials.displayName	String	Friendly name for the key. Optional.
MSGraphApplication.keyCredentials.type	String	The type of key credential; for example, “Symmetric”.
MSGraphApplication.keyCredentials.key	String	The certificate’s raw data in byte array converted to Base64 string.
MSGraphApplication.keyCredentials.usage	String	A string that describes the purpose for which the key can be used; for example, “Verify”.
MSGraphApplication.keyCredentials.startDateTime	Date	The date and time at which the credential expires.The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 would look like this: ‘2014-01-01T00:00:00Z’.
MSGraphApplication.keyCredentials.endDateTime	Date	The date and time at which the credential becomes valid.The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 would look like this: ‘2014-01-01T00:00:00Z’.
MSGraphApplication.accountEnabled	Boolean	true if the application account is enabled; otherwise, false.
MSGraphApplication.appDescription	String	A brief description of the application.
MSGraphApplication.appDisplayName	String	The display name exposed by the associated application.
MSGraphApplication.appId	String	The unique identifier for the associated application (its appId property).
MSGraphApplication.appOwnerOrganizationId	String	Contains the tenant ID where the application is registered. This is applicable only to service principals backed by applications.
MSGraphApplication.appRoleAssignmentRequired	Boolean	Whether users or other service principals need to be granted an application role assignment for this service principal before users can sign in or apps can get tokens. Default is false.
MSGraphApplication.applicationTemplateId	String	Unique identifier of the application template that the service principal was created from.
MSGraphApplication.createdDateTime	Date	Time the application was created.
MSGraphApplication.deletedDateTime	Date	Time the application was deleted.
MSGraphApplication.description	String	A brief description of the application.
MSGraphApplication.displayName	String	The display name for the application.
MSGraphApplication.homepage	String	Home page or landing page of the application.
MSGraphApplication.id	String	The unique identifier for the application.
MSGraphApplication.info.logoUrl	String	Content delivery network (CDN) URL to the application’s logo.
MSGraphApplication.info.marketingUrl	String	Link to the application’s marketing page.
MSGraphApplication.info.privacyStatementUrl	String	Link to the application’s privacy statement.
MSGraphApplication.info.supportUrl	String	Link to the application’s support page.
MSGraphApplication.info.termsOfServiceUrl	String	Link to the application’s terms of service statement.
MSGraphApplication.loginUrl	String	The URL where the service provider redirects the user to Microsoft Entra ID to authenticate. Microsoft Entra ID uses the URL to launch the application from Microsoft 365 or the Microsoft Entra My Apps.
MSGraphApplication.logoutUrl	String	Specifies the URL that will be used by Microsoft’s authorization service to log out an user.
MSGraphApplication.notes	String	The application’s notes.
MSGraphApplication.oauth2PermissionScopes.adminConsentDescription	String	A description of the delegated permissions, intended to be read by an administrator granting the permission on behalf of all users. This text appears in tenant-wide admin consent experiences.
MSGraphApplication.oauth2PermissionScopes.adminConsentDisplayName	String	The permission’s title, intended to be read by an administrator granting the permission on behalf of all users.
MSGraphApplication.oauth2PermissionScopes.id	String	Unique delegated permission identifier inside the collection of delegated permissions defined for a resource application.
MSGraphApplication.oauth2PermissionScopes.isEnabled	Boolean	Whether OAuth 2.0 permission scopes are enabled.
MSGraphApplication.oauth2PermissionScopes.type	String	Whether this delegated permission should be considered safe for non-admin users to consent to on behalf of themselves, or whether an administrator should be required for consent to the permissions.
MSGraphApplication.oauth2PermissionScopes.userConsentDescription	String	A description of the delegated permissions, intended to be read by a user granting the permission on their own behalf. This text appears in consent experiences where the user is consenting only on behalf of themselves.
MSGraphApplication.oauth2PermissionScopes.userConsentDisplayName	String	A title for the permission.
MSGraphApplication.oauth2PermissionScopes.value	String	The value to include in the scope claim in access tokens.
MSGraphApplication.preferredSingleSignOnMode	String	The single sign-on mode configured for this application. Microsoft Entra ID uses the preferred single sign-on mode to launch the application from Microsoft 365 or the Microsoft Entra My Apps. The supported values are password, SAML, external, and OIDC.
MSGraphApplication.preferredTokenSigningKeyThumbprint	String	Thumbprint of preferred certificate to sign the token.
MSGraphApplication.replyUrls	String	The URLs that user tokens are sent to for signing in with the associated application, or the redirect URIs that OAuth 2.0 authorization codes and access tokens are sent to for the associated application.
MSGraphApplication.samlSingleSignOnSettings	String	The collection for settings related to SAML single sign-on.
MSGraphApplication.servicePrincipalNames	String	The list of identifier URIs.
MSGraphApplication.servicePrincipalType	String	Identifies if the service principal represents an application or a managed identity.
MSGraphApplication.signInAudience	String	The audience that can sign in.
MSGraphApplication.tokenEncryptionKeyId	String	The key ID of a public key from the key credentials.
MSGraphApplication.verifiedPublisher.addedDateTime	Date	The timestamp when the verified publisher was first added or most recently updated.
MSGraphApplication.verifiedPublisher.displayName	String	The verified publisher name from the application publisher’s Partner Center account.
MSGraphApplication.verifiedPublisher.verifiedPublisherId	String	The ID of the verified publisher from the application publisher’s Partner Center account.

Command Example

!msgraph-apps-service-principal-get id=TEST

Context Example

{'@odata.context': 'https://graph.microsoft.com/v1.0/$metadata#servicePrincipals/$entity',
                                  'id': 'XXXX', 'deletedDateTime': None, 'accountEnabled': True, 'alternativeNames': [],
                                  'appDisplayName': 'Test', 'appDescription': None,
                                  'appId': 'XXXX', 'applicationTemplateId': None, 'appOwnerOrganizationId': 'XXXX',
                                  'appRoleAssignmentRequired': False, 'createdDateTime': '', 'description': None,
                                  'disabledByMicrosoftStatus': None, 'displayName': 'Test', 'homepage': None, 'loginUrl': None,
                                  'logoutUrl': None, 'notes': None, 'notificationEmailAddresses': [],
                                  'preferredSingleSignOnMode': None, 'preferredTokenSigningKeyThumbprint': None, 'replyUrls': [],
                                  'servicePrincipalNames': ['XXXX'], 'servicePrincipalType': 'Application',
                                  'signInAudience': 'AzureADMyOrg',
                                  'tags': ['HideApp', 'WindowsAzureActiveDirectoryIntegratedApp'], 'tokenEncryptionKeyId': None,
                                  'samlSingleSignOnSettings': None, 'addIns': [], 'appRoles': [],
                                  'info': {'logoUrl': None, 'marketingUrl': None, 'privacyStatementUrl': None, 'supportUrl': None,
                                           'termsOfServiceUrl': None}, 'keyCredentials': [], 'oauth2PermissionScopes': [],
                                  'passwordCredentials': [], 'resourceSpecificApplicationPermissions': [],
                                  'verifiedPublisher': {'displayName': None, 'verifiedPublisherId': None, 'addedDateTime': None}}

msgraph-apps-service-principal-update

Update the properties of servicePrincipal object.

Base Command

msgraph-apps-service-principal-update

Input

Argument Name	Description	Required
id	The application id to update. Can be retrieved via the msgraph-apps-service-principal-list command.	Optional
app_id	The application client id to update. Can be retrieved via the msgraph-apps-service-principal-list command.	Optional
account_enabled	true if the service principal account is enabled; otherwise, false. Possible values are: true, false.	Optional
app_role_assignment_required	Specifies whether an appRoleAssignment to a user or group is required before Microsoft Entra ID will issue a user or access token to the application. Possible values are: true, false.	Optional
display_name	The display name for the service principal.	Optional
preferred_single_sign_on_mode	Specifies the single sign-on mode configured for this application. Microsoft Entra ID uses the preferred single sign-on mode to launch the application from Microsoft 365 or the Microsoft Entra My Apps. The supported values are password, saml, and oidc. Possible values are: password, saml, oidc.	Optional
reply_urls	A comma-separated list of the URLs that user tokens are sent to for sign in with the associated application, or the redirect URIs that OAuth 2.0 authorization codes and access tokens are sent to for the associated application.	Optional

Context Output

There is no context output for this command.

Command Example

!msgraph-apps-service-principal-update id=TEST account_enabled=true

Human Readable Output

Service TEST was updated successfully.

msgraph-apps-service-principal-password-add

Add a strong password or secret to a service principal.

Base Command

msgraph-apps-service-principal-password-add

Input

Argument Name	Description	Required
id	The application id to add password. Can be retrieved via the msgraph-apps-service-principal-list command.	Optional
app_id	The application client id to add password. Can be retrieved via the msgraph-apps-service-principal-list command.	Optional
display_name	Friendly name for the password. Optional.	Optional
end_date_time	The date and time at which the password expires represented using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z. Optional. The default value is “startDateTime + 2 years”.	Optional
start_date_time	The date and time at which the password becomes valid. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z. Optional. The default value is “now”.	Optional

Context Output

Path	Type	Description
MSGraphApplication.keyCredentials.customKeyIdentifier	String	Custom key identifier.
MSGraphApplication.keyCredentials.endDateTime	Date	The date and time at which the credential becomes valid.The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 would look like this: ‘2014-01-01T00:00:00Z’.
MSGraphApplication.keyCredentials.keyId	String	The unique identifier (GUID) for the key.
MSGraphApplication.keyCredentials.startDateTime	Date	The date and time at which the credential expires.The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 would look like this: ‘2014-01-01T00:00:00Z’.
MSGraphApplication.keyCredentials.displayName	String	Friendly name for the key. Optional.
MSGraphApplication.keyCredentials.secretText	String	The strong passwords generated by Entra ID that are 16-64 characters in length. There is no way to retrieve this password in the future.
MSGraphApplication.keyCredentials.hint	String	The secretText prefix.

Command Example

!msgraph-apps-service-principal-password-add id=TEST display_name='TEST'

Context Example

{'@odata.context': '',
 'customKeyIdentifier': None,
  'displayName': 'TEST',
   'endDateTime': '',
    'hint': '', 
    'keyId': '',
     'secretText': '',
     'startDateTime': ''}

Human Readable Output

A password was added to application TEST successfully.

msgraph-apps-service-principal-password-remove

Remove a password from a service principal.

Base Command

msgraph-apps-service-principal-password-remove

Input

Argument Name	Description	Required
id	The application id to remove password. Can be retrieved via the msgraph-apps-service-principal-list command.	Optional
app_id	The application client id to remove password. Can be retrieved via the msgraph-apps-service-principal-list command.	Optional
key_id	The unique identifier for the password.	Required

Context Output

There is no context output for this command.

Command Example

!msgraph-apps-service-principal-password-remove id=TEST key_id=KEY_TEST

Human Readable Output

The password of the unique identifier KEY_TEST was removed successfully.

msgraph-apps-service-principal-unlock-configuration

Unlock configuration of a service principal.

Base Command

msgraph-apps-service-principal-unlock-configuration

Input

Argument Name	Description	Required
id	The application object id (not the app id).	Required

Context Output

There is no context output for this command.

Command Example

!msgraph-apps-service-principal-unlock-configuration id=TEST

Human Readable Output

The configuration of TEST was unlocked successfully.

msgraph-apps-service-principal-lock-configuration

Lock configuration of a service principal.

Base Command

msgraph-apps-service-principal-lock-configuration

Input

Argument Name	Description	Required
id	The application object id (not the app id).	Required

Context Output

There is no context output for this command.

Command Example

!msgraph-apps-service-principal-lock-configuration id=TEST

Human Readable Output

The configuration of TEST was locked successfully.

Configuration parameters

app_id — Application ID
azure_ad_endpoint — Azure AD endpoint
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings
authentication_type — Authentication Type
tenant_id — Tenant ID (for Client Credentials mode)
credentials — Client Secret (for Client Credentials mode)
managed_identities_client_id —

Commands (12)

msgraph-apps-auth-complete
Run this command to complete the authorization process. Should be used after running the msgraph-apps-auth-start command.
msgraph-apps-auth-reset
Run this command if for some reason you need to rerun the authentication process.
msgraph-apps-auth-start
Run this command to start the authorization process and follow the instructions in the command results.
msgraph-apps-auth-test
Tests connectivity to Microsoft.
msgraph-apps-service-principal-get
Retrieve the properties and relationships of a servicePrincipal object.
msgraph-apps-service-principal-list
Retrieves a list of applications.
msgraph-apps-service-principal-lock-configuration
Lock configuration of a service principal.
msgraph-apps-service-principal-password-add
Add a strong password or secret to a service principal. To allow this command, use msgraph-apps-service-principal-unlock-configuration. The password will be expired in 1 hour by default.
msgraph-apps-service-principal-password-remove
Remove a password from a service principal. To allow this command, use msgraph-apps-service-principal-unlock-configuration.
msgraph-apps-service-principal-remove
Removes an application from the directory.
msgraph-apps-service-principal-unlock-configuration
Unlock configuration of a service principal.
msgraph-apps-service-principal-update
Update the properties of servicePrincipal object.

Source

MicrosoftGraphApplications.py MicrosoftGraphApplications_test.py MicrosoftGraphApplications.yml MicrosoftGraphApplications_description.md command_examples.txt

Download History Raw

category: IT Services
provider: Microsoft
sectionorder:
- Connect
- Collect
commonfields:
  id: MicrosoftGraphApplications
  version: -1
configuration:
- defaultvalue: 6b071e63-f701-454b-9e54-ede4c96483e6
  display: Application ID
  name: app_id
  type: 0
  additionalinfo:
  section: Connect
  required: false
- defaultvalue: https://login.microsoftonline.com
  display: Azure AD endpoint
  name: azure_ad_endpoint
  options:
  - https://login.microsoftonline.com
  - https://login.microsoftonline.us
  - https://login.microsoftonline.de
  - https://login.chinacloudapi.cn
  type: 15
  additionalinfo: Azure AD endpoint associated with a national cloud.
  section: Connect
  advanced: true
  required: false
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  defaultvalue: 'false'
  additionalinfo:
  section: Connect
  advanced: true
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  defaultvalue: "false"
  additionalinfo:
  section: Connect
  advanced: true
  required: false
- name: authentication_type
  display: Authentication Type
  defaultvalue: Device Code
  type: 15
  additionalinfo: Type of authentication - could be Client Credentials Authorization Flow (recommended) or Device Flow
  options:
  - Device Code
  - Client Credentials
  - Azure Managed Identities
  section: Connect
  advanced: true
  required: false
- name: tenant_id
  display: Tenant ID (for Client Credentials mode)
  defaultvalue:
  type: 0
  additionalinfo: ""
  section: Connect
  advanced: true
  required: false
- name: credentials
  hiddenusername: true
  displaypassword: Client Secret (for Client Credentials mode)
  display: Client Secret (for Client Credentials mode)
  defaultvalue:
  type: 9
  additionalinfo: ""
  section: Connect
  required: false
- additionalinfo: The Managed Identities client ID for authentication - relevant only if the integration is running on Azure VM.
  displaypassword: Azure Managed Identities Client ID
  name: managed_identities_client_id
  hiddenusername: true
  type: 9
  section: Connect
  required: false
description: Use the Entra ID Applications integration (formerly Azure Active Directory Applications) to manage authorized applications.
display: Entra ID Applications
name: MicrosoftGraphApplications
script:
  commands:
  - description: Run this command to start the authorization process and follow the instructions in the command results.
    name: msgraph-apps-auth-start
    arguments: []
    outputs: []
  - description: Run this command to complete the authorization process. Should be used after running the msgraph-apps-auth-start command.
    name: msgraph-apps-auth-complete
    arguments: []
    outputs: []
  - description: Run this command if for some reason you need to rerun the authentication process.
    name: msgraph-apps-auth-reset
    arguments: []
    outputs: []
  - description: Tests connectivity to Microsoft.
    name: msgraph-apps-auth-test
    arguments: []
    outputs: []
  - description: Retrieves a list of applications.
    name: msgraph-apps-service-principal-list
    arguments:
    - name: limit
      description: Maximum results to fetch. A value of 0 fetches all results.
      defaultValue: 10
    outputs:
    - contextPath: MSGraphApplication.keyCredentials.keyId
      description: The unique identifier (GUID) for the key.
      type: String
    - contextPath: MSGraphApplication.keyCredentials.customKeyIdentifier
      description: Custom key identifier.
      type: String
    - contextPath: MSGraphApplication.keyCredentials.displayName
      description: Friendly name for the key. Optional.
      type: String
    - contextPath: MSGraphApplication.keyCredentials.type
      description: The type of key credential; for example, “Symmetric”.
      type: String
    - contextPath: MSGraphApplication.keyCredentials.key
      description: The certificate's raw data in byte array converted to Base64 string.
      type: String
    - contextPath: MSGraphApplication.keyCredentials.usage
      description: A string that describes the purpose for which the key can be used; for example, “Verify”.
      type: String
    - contextPath: MSGraphApplication.keyCredentials.startDateTime
      description: "The date and time at which the credential expires.The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 would look like this: '2014-01-01T00:00:00Z'."
      type: Date
    - contextPath: MSGraphApplication.keyCredentials.endDateTime
      description: "The date and time at which the credential becomes valid.The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 would look like this: '2014-01-01T00:00:00Z'."
      type: Date
    - contextPath: MSGraphApplication.accountEnabled
      description: true if the application account is enabled; otherwise, false.
      type: Boolean
    - contextPath: MSGraphApplication.appDescription
      description: A brief description of the application.
      type: String
    - contextPath: MSGraphApplication.appDisplayName
      description: The display name exposed by the associated application.
      type: String
    - contextPath: MSGraphApplication.appId
      description: The unique identifier for the associated application (its appId property).
      type: String
    - contextPath: MSGraphApplication.appOwnerOrganizationId
      description: Contains the tenant ID where the application is registered. This is applicable only to service principals backed by applications.
      type: String
    - contextPath: MSGraphApplication.appRoleAssignmentRequired
      description: Whether users or other service principals need to be granted an application role assignment for this service principal before users can sign in or apps can get tokens. Default is false.
      type: Boolean
    - contextPath: MSGraphApplication.applicationTemplateId
      description: Unique identifier of the application template that the service principal was created from.
      type: String
    - contextPath: MSGraphApplication.createdDateTime
      description: Time the application was created.
      type: Date
    - contextPath: MSGraphApplication.deletedDateTime
      description: Time the application was deleted.
      type: Date
    - contextPath: MSGraphApplication.description
      description: A brief description of the application.
      type: String
    - contextPath: MSGraphApplication.displayName
      description: The display name for the application.
      type: String
    - contextPath: MSGraphApplication.homepage
      description: Home page or landing page of the application.
      type: String
    - contextPath: MSGraphApplication.id
      description: The unique identifier for the application.
      type: String
    - contextPath: MSGraphApplication.info.logoUrl
      description: Content delivery network (CDN) URL to the application's logo.
      type: String
    - contextPath: MSGraphApplication.info.marketingUrl
      description: Link to the application's marketing page.
      type: String
    - contextPath: MSGraphApplication.info.privacyStatementUrl
      description: Link to the application's privacy statement.
      type: String
    - contextPath: MSGraphApplication.info.supportUrl
      description: Link to the application's support page.
      type: String
    - contextPath: MSGraphApplication.info.termsOfServiceUrl
      description: Link to the application's terms of service statement.
      type: String
    - contextPath: MSGraphApplication.loginUrl
      description: The URL where the service provider redirects the user to Microsoft Entra ID to authenticate. Microsoft Entra ID uses the URL to launch the application from Microsoft 365 or the Microsoft Entra My Apps.
      type: String
    - contextPath: MSGraphApplication.logoutUrl
      description: Specifies the URL that will be used by Microsoft's authorization service to log out an user.
      type: String
    - contextPath: MSGraphApplication.notes
      description: The application's notes.
      type: String
    - contextPath: MSGraphApplication.oauth2PermissionScopes.adminConsentDescription
      description: A description of the delegated permissions, intended to be read by an administrator granting the permission on behalf of all users. This text appears in tenant-wide admin consent experiences.
      type: String
    - contextPath: MSGraphApplication.oauth2PermissionScopes.adminConsentDisplayName
      description: The permission's title, intended to be read by an administrator granting the permission on behalf of all users.
      type: String
    - contextPath: MSGraphApplication.oauth2PermissionScopes.id
      description: Unique delegated permission identifier inside the collection of delegated permissions defined for a resource application.
      type: String
    - contextPath: MSGraphApplication.oauth2PermissionScopes.isEnabled
      description: Whether OAuth 2.0 permission scopes are enabled.
      type: Boolean
    - contextPath: MSGraphApplication.oauth2PermissionScopes.type
      description: Whether this delegated permission should be considered safe for non-admin users to consent to on behalf of themselves, or whether an administrator should be required for consent to the permissions.
      type: String
    - contextPath: MSGraphApplication.oauth2PermissionScopes.userConsentDescription
      description: A description of the delegated permissions, intended to be read by a user granting the permission on their own behalf. This text appears in consent experiences where the user is consenting only on behalf of themselves.
      type: String
    - contextPath: MSGraphApplication.oauth2PermissionScopes.userConsentDisplayName
      description: A title for the permission.
      type: String
    - contextPath: MSGraphApplication.oauth2PermissionScopes.value
      description: The value to include in the scope claim in access tokens.
      type: String
    - contextPath: MSGraphApplication.preferredSingleSignOnMode
      description: The single sign-on mode configured for this application. Microsoft Entra ID uses the preferred single sign-on mode to launch the application from Microsoft 365 or the Microsoft Entra My Apps. The supported values are password, SAML, external, and OIDC.
      type: String
    - contextPath: MSGraphApplication.preferredTokenSigningKeyThumbprint
      description: Thumbprint of preferred certificate to sign the token.
      type: String
    - contextPath: MSGraphApplication.replyUrls
      description: The URLs that user tokens are sent to for signing in with the associated application, or the redirect URIs that OAuth 2.0 authorization codes and access tokens are sent to for the associated application.
      type: String
    - contextPath: MSGraphApplication.samlSingleSignOnSettings
      description: The collection for settings related to SAML single sign-on.
      type: String
    - contextPath: MSGraphApplication.servicePrincipalNames
      description: The list of identifier URIs.
      type: String
    - contextPath: MSGraphApplication.servicePrincipalType
      description: Identifies if the service principal represents an application or a managed identity.
      type: String
    - contextPath: MSGraphApplication.signInAudience
      description: The audience that can sign in.
      type: String
    - contextPath: MSGraphApplication.tokenEncryptionKeyId
      description: The key ID of a public key from the key credentials.
      type: String
    - contextPath: MSGraphApplication.verifiedPublisher.addedDateTime
      description: The timestamp when the verified publisher was first added or most recently updated.
      type: Date
    - contextPath: MSGraphApplication.verifiedPublisher.displayName
      description: The verified publisher name from the application publisher's Partner Center account.
      type: String
    - contextPath: MSGraphApplication.verifiedPublisher.verifiedPublisherId
      description: The ID of the verified publisher from the application publisher's Partner Center account.
      type: String
  - description: Removes an application from the directory.
    name: msgraph-apps-service-principal-remove
    arguments:
    - name: id
      description: The application id to remove. Can be retrieved via the msgraph-apps-service-principal-list command.
      required: false
    - name: app_id
      description: The application client id to remove. Can be retrieved via the msgraph-apps-service-principal-list command.
      required: false
    outputs: []
  - description: Retrieve the properties and relationships of a servicePrincipal object.
    name: msgraph-apps-service-principal-get
    arguments:
    - name: id
      description: The application id to get. Can be retrieved via the msgraph-apps-service-principal-list command.
      required: false
    - name: app_id
      description: The application client id to get. Can be retrieved via the msgraph-apps-service-principal-list command.
      required: false
    outputs:
    - contextPath: MSGraphApplication.keyCredentials.keyId
      description: The unique identifier (GUID) for the key.
      type: String
    - contextPath: MSGraphApplication.keyCredentials.customKeyIdentifier
      description: Custom key identifier.
      type: String
    - contextPath: MSGraphApplication.keyCredentials.displayName
      description: Friendly name for the key. Optional.
      type: String
    - contextPath: MSGraphApplication.keyCredentials.type
      description: The type of key credential; for example, “Symmetric”.
      type: String
    - contextPath: MSGraphApplication.keyCredentials.key
      description: The certificate's raw data in byte array converted to Base64 string.
      type: String
    - contextPath: MSGraphApplication.keyCredentials.usage
      description: A string that describes the purpose for which the key can be used; for example, “Verify”.
      type: String
    - contextPath: MSGraphApplication.keyCredentials.startDateTime
      description: "The date and time at which the credential expires.The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 would look like this: '2014-01-01T00:00:00Z'."
      type: Date
    - contextPath: MSGraphApplication.keyCredentials.endDateTime
      description: "The date and time at which the credential becomes valid.The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 would look like this: '2014-01-01T00:00:00Z'."
      type: Date
    - contextPath: MSGraphApplication.accountEnabled
      description: whether the application account is enabled.
      type: Boolean
    - contextPath: MSGraphApplication.appDescription
      description: A brief description of the application.
      type: String
    - contextPath: MSGraphApplication.appDisplayName
      description: The display name exposed by the associated application.
      type: String
    - contextPath: MSGraphApplication.appId
      description: The unique identifier for the associated application (its appId property).
      type: String
    - contextPath: MSGraphApplication.appOwnerOrganizationId
      description: Contains the tenant ID where the application is registered. This is applicable only to service principals backed by applications.
      type: String
    - contextPath: MSGraphApplication.appRoleAssignmentRequired
      description: Whether users or other service principals need to be granted an application role assignment for this service principal before users can sign in or apps can get tokens. Default is false.
      type: Boolean
    - contextPath: MSGraphApplication.applicationTemplateId
      description: Unique identifier of the application template that the service principal was created from.
      type: String
    - contextPath: MSGraphApplication.createdDateTime
      description: Time the application was created.
      type: Date
    - contextPath: MSGraphApplication.deletedDateTime
      description: Time the application was deleted.
      type: Date
    - contextPath: MSGraphApplication.description
      description: A brief description of the application.
      type: String
    - contextPath: MSGraphApplication.displayName
      description: The display name for the application.
      type: String
    - contextPath: MSGraphApplication.homepage
      description: Home page or landing page of the application.
      type: String
    - contextPath: MSGraphApplication.id
      description: The unique identifier for the application.
      type: String
    - contextPath: MSGraphApplication.info.logoUrl
      description: Content delivery network (CDN) URL to the application's logo.
      type: String
    - contextPath: MSGraphApplication.info.marketingUrl
      description: Link to the application's marketing page.
      type: String
    - contextPath: MSGraphApplication.info.privacyStatementUrl
      description: Link to the application's privacy statement.
      type: String
    - contextPath: MSGraphApplication.info.supportUrl
      description: Link to the application's support page.
      type: String
    - contextPath: MSGraphApplication.info.termsOfServiceUrl
      description: Link to the application's terms of service statement.
      type: String
    - contextPath: MSGraphApplication.loginUrl
      description: The URL where the service provider redirects the user to Microsoft Entra ID to authenticate. Microsoft Entra ID uses the URL to launch the application from Microsoft 365 or the Microsoft Entra My Apps.
      type: String
    - contextPath: MSGraphApplication.logoutUrl
      description: Specifies the URL that will be used by Microsoft's authorization service to log out an user.
      type: String
    - contextPath: MSGraphApplication.notes
      description: The application's notes.
      type: String
    - contextPath: MSGraphApplication.oauth2PermissionScopes.adminConsentDescription
      description: A description of the delegated permissions, intended to be read by an administrator granting the permission on behalf of all users. This text appears in tenant-wide admin consent experiences.
      type: String
    - contextPath: MSGraphApplication.oauth2PermissionScopes.adminConsentDisplayName
      description: The permission's title, intended to be read by an administrator granting the permission on behalf of all users.
      type: String
    - contextPath: MSGraphApplication.oauth2PermissionScopes.id
      description: Unique delegated permission identifier inside the collection of delegated permissions defined for a resource application.
      type: String
    - contextPath: MSGraphApplication.oauth2PermissionScopes.isEnabled
      description: Whether OAuth 2.0 permission scopes are enabled.
      type: Boolean
    - contextPath: MSGraphApplication.oauth2PermissionScopes.type
      description: Whether this delegated permission should be considered safe for non-admin users to consent to on behalf of themselves, or whether an administrator should be required for consent to the permissions.
      type: String
    - contextPath: MSGraphApplication.oauth2PermissionScopes.userConsentDescription
      description: A description of the delegated permissions, intended to be read by a user granting the permission on their own behalf. This text appears in consent experiences where the user is consenting only on behalf of themselves.
      type: String
    - contextPath: MSGraphApplication.oauth2PermissionScopes.userConsentDisplayName
      description: A title for the permission.
      type: String
    - contextPath: MSGraphApplication.oauth2PermissionScopes.value
      description: The value to include in the scope claim in access tokens.
      type: String
    - contextPath: MSGraphApplication.preferredSingleSignOnMode
      description: The single sign-on mode configured for this application. Microsoft Entra ID uses the preferred single sign-on mode to launch the application from Microsoft 365 or the Microsoft Entra My Apps. The supported values are password, SAML, external, and OIDC.
      type: String
    - contextPath: MSGraphApplication.preferredTokenSigningKeyThumbprint
      description: Thumbprint of preferred certificate to sign the token.
      type: String
    - contextPath: MSGraphApplication.replyUrls
      description: The URLs that user tokens are sent to for signing in with the associated application, or the redirect URIs that OAuth 2.0 authorization codes and access tokens are sent to for the associated application.
      type: String
    - contextPath: MSGraphApplication.samlSingleSignOnSettings
      description: The collection for settings related to SAML single sign-on.
      type: String
    - contextPath: MSGraphApplication.servicePrincipalNames
      description: The list of identifier URIs.
      type: String
    - contextPath: MSGraphApplication.servicePrincipalType
      description: Identifies if the service principal represents an application or a managed identity.
      type: String
    - contextPath: MSGraphApplication.signInAudience
      description: The audience that can sign in.
      type: String
    - contextPath: MSGraphApplication.tokenEncryptionKeyId
      description: The key ID of a public key from the key credentials.
      type: String
    - contextPath: MSGraphApplication.verifiedPublisher.addedDateTime
      description: The timestamp when the verified publisher was first added or most recently updated.
      type: Date
    - contextPath: MSGraphApplication.verifiedPublisher.displayName
      description: The verified publisher name from the application publisher's Partner Center account.
      type: String
    - contextPath: MSGraphApplication.verifiedPublisher.verifiedPublisherId
      description: The ID of the verified publisher from the application publisher's Partner Center account.
      type: String
  - description: Update the properties of servicePrincipal object.
    name: msgraph-apps-service-principal-update
    arguments:
    - name: id
      description: The application id to update. Can be retrieved via the msgraph-apps-service-principal-list command.
      required: false
    - name: app_id
      description: The application client id to update. Can be retrieved via the msgraph-apps-service-principal-list command.
      required: false
    - name: account_enabled
      description: true if the service principal account is enabled; otherwise, false.
      required: false
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
    - name: app_role_assignment_required
      description: Specifies whether an appRoleAssignment to a user or group is required before Microsoft Entra ID will issue a user or access token to the application.
      required: false
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
    - name: display_name
      description: The display name for the service principal.
      required: false
    - name: preferred_single_sign_on_mode
      description: Specifies the single sign-on mode configured for this application. Microsoft Entra ID uses the preferred single sign-on mode to launch the application from Microsoft 365 or the Microsoft Entra My Apps. The supported values are password, saml, and oidc.
      required: false
      auto: PREDEFINED
      predefined:
      - password
      - saml
      - oidc
    - name: reply_urls
      description: A comma-separated list of the URLs that user tokens are sent to for sign in with the associated application, or the redirect URIs that OAuth 2.0 authorization codes and access tokens are sent to for the associated application.
      required: false
    outputs: []
  - description: Add a strong password or secret to a service principal. To allow this command, use msgraph-apps-service-principal-unlock-configuration. The password will be expired in 1 hour by default.
    name: msgraph-apps-service-principal-password-add
    arguments:
    - name: id
      description: The application id to add password. Can be retrieved via the msgraph-apps-service-principal-list command.
      required: false
    - name: app_id
      description: The application client id to add password. Can be retrieved via the msgraph-apps-service-principal-list command.
      required: false
    - name: display_name
      description: Friendly name for the password. Optional.
      required: false
    - name: end_date_time
      description: The date and time at which the password expires represented using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z. Optional. The default value is "startDateTime + 1 hour".
      required: false
    - name: start_date_time
      description: The date and time at which the password becomes valid. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z. Optional. The default value is "now".
      required: false
    outputs:
    - contextPath: MSGraphApplication.keyCredentials.customKeyIdentifier
      description: Custom key identifier.
      type: String
    - contextPath: MSGraphApplication.keyCredentials.endDateTime
      description: "The date and time at which the credential becomes valid.The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 would look like this: '2014-01-01T00:00:00Z'."
      type: Date
    - contextPath: MSGraphApplication.keyCredentials.keyId
      description: The unique identifier (GUID) for the key.
      type: String
    - contextPath: MSGraphApplication.keyCredentials.startDateTime
      description: "The date and time at which the credential expires.The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 would look like this: '2014-01-01T00:00:00Z'."
      type: Date
    - contextPath: MSGraphApplication.keyCredentials.displayName
      description: Friendly name for the key. Optional.
      type: String
    - contextPath: MSGraphApplication.keyCredentials.secretText
      description: The strong passwords generated by Entra ID that are 16-64 characters in length. There is no way to retrieve this password in the future.
      type: String
    - contextPath: MSGraphApplication.keyCredentials.hint
      description: The secretText prefix.
      type: String
  - description: Remove a password from a service principal. To allow this command, use msgraph-apps-service-principal-unlock-configuration.
    name: msgraph-apps-service-principal-password-remove
    arguments:
    - name: id
      description: The application id to remove password. Can be retrieved via the msgraph-apps-service-principal-list command.
      required: false
    - name: app_id
      description: The application client id to remove password. Can be retrieved via the msgraph-apps-service-principal-list command.
      required: false
    - name: key_id
      description: The unique identifier for the password.
      required: true
    outputs: []
  - description: Unlock configuration of a service principal.
    name: msgraph-apps-service-principal-unlock-configuration
    arguments:
    - name: id
      description: The application object id (not the app id).
      required: true
    outputs: []
  - description: Lock configuration of a service principal.
    name: msgraph-apps-service-principal-lock-configuration
    arguments:
    - name: id
      description: The application object id (not the app id).
      required: true
    outputs: []
  runonce: false
  script: '-'
  type: python
  subtype: python3
  dockerimage: demisto/crypto:1.0.0.8187750
fromversion: 5.0.0
tests:
- MSGraph Applications Test