HardDeletionSetting.ReadWrite.Enable

Allows the app to enable hard deletion protection settings on users, applications, groups, and service principals on behalf of the signed-in user. Requires Global Administrator or Backup Administrator role.

Merill's Note

For an app to access data in Microsoft Graph, the user or administrator must grant it the permissions it needs. This article lists all the Microsoft Graph APIs and your tenant data that can be accessed by the application (vendor/developer) if you consent to the HardDeletionSetting.ReadWrite.Enable permission.

If you need to create an audit report of the permissions granted to all the apps in your tenant, you can run the Export-MsIdAppConsentGrantReport command. See How To: Run a quick OAuth app audit of your tenant

Category	Application	Delegated
Identifier	87f25f46-ce1e-47ed-935c-9d70b296f060	969ac762-bace-4685-8f56-a496211ea8e8
DisplayText	Enable hard deletion protection settings	Enable hard deletion protection settings
Description	Allows the app to enable hard deletion protection settings on users, applications, groups, and service principals without a signed-in user. Requires Global Administrator or Backup Administrator role.	Allows the app to enable hard deletion protection settings on users, applications, groups, and service principals on behalf of the signed-in user. Requires Global Administrator or Backup Administrator role.
AdminConsentRequired	Yes	Yes

Graph Methods

→ API supports delegated access (access on behalf of a user)
→ API supports app-only access (access without a user)

	Methods
	PATCH /applications(appId='{appId}')
	PATCH /applications/{applicationObjectId}
	PATCH /groups/{id}
	PATCH /servicePrincipals(appId='{appId}')
	PATCH /servicePrincipals/{id}

→ API supports delegated access (access on behalf of a user)
→ API supports app-only access (access without a user)

	Methods
	PATCH /applications(appId='{appId}')
	PATCH /applications/{applicationObjectId}
	PATCH /groups/{id}
	PATCH /servicePrincipals(appId='{appId}')
	PATCH /servicePrincipals/{id}

→ Command supports delegated access (access on behalf of a user)
→ Command supports app-only access (access without a user)

	Commands
	Update-MgApplication
	Update-MgGroup
	Update-MgServicePrincipal

→ Command supports delegated access (access on behalf of a user)
→ Command supports app-only access (access without a user)

	Commands
	Update-MgBetaApplication
	Update-MgBetaGroup
	Update-MgBetaServicePrincipal

Resources

Granting this permission allows the calling application to access (and/or update) the following information in your tenant.

Graph reference: addIn

Property	Type	Description
id	GUID	The unique identifier for the addIn object.
properties	keyValue collection	The collection of key-value pairs that define parameters that the consuming service can use or call. You must specify this property when performing a POST or a PATCH operation on the addIns collection. Required.
type	string	The unique name for the functionality exposed by the app.

Graph reference: agentIdentity

Property	Type	Description
odata.type	String	`#microsoft.graph.agentIdentity`. Distinguishes this object as an agent identity. Can be used to identify this object as an agent identity, instead of another kind of service principal.
accountEnabled	Boolean	`true` if the agent identity account is enabled; otherwise, `false`. If set to `false`, then no users are able to sign in to this app, even if they're assigned to it. Inherited from servicePrincipal.
agentIdentityBlueprintId	String	The appId of the agent identity blueprint that defines the configuration for this agent identity.
customSecurityAttributes	customSecurityAttributeValue	An open complex type that holds the value of a custom security attribute that is assigned to a directory object. Nullable. Requires `$select` to retrieve. Inherited from servicePrincipal.
createdByAppId	String	The appId of the application that created this agent identity. Set internally by Microsoft Entra ID. Read-only. Inherited from servicePrincipal.
createdDateTime	DateTimeOffset	The date and time the agent identity was created. Read-only. Inherited from servicePrincipal.
disabledByMicrosoftStatus	String	Specifies whether Microsoft has disabled the registered Agent Identity Blueprint. The possible values are: `null` (default value), `NotDisabled`, and `DisabledDueToViolationOfServicesAgreement` (reasons may include suspicious, abusive, or malicious activity, or a violation of the Microsoft Services Agreement). Inherited from servicePrincipal.
displayName	String	The display name for the agent identity. Inherited from servicePrincipal.
id	String	The unique identifier for the agent identity. Inherited from directoryObject. Key. Not nullable. Read-only. Inherited from entity.
managerApplications	Guid collection	The collection of application IDs designated as managers of this agent identity's backing agentIdentityBlueprint. Read-only; the value is server-managed and reflects the managerApplications of the backing agentIdentityBlueprint. To change the managers, an owner or administrator must update the managerApplications property on the backing agentIdentityBlueprint in the tenant where it's registered. For multitenant agent identity blueprints, admins in a tenant where the blueprint is only consumed can't make this change — they must ask an owner or administrator in the blueprint's home tenant. Not nullable. Returned only on `$select`.
servicePrincipalType	String	Set to ServiceIdentity for all agent identities. Inherited from servicePrincipal.
tags	String collection	Custom strings that can be used to categorize and identify the agent identity. Not nullable. The value is the union of strings set here and on the associated Agent Identity Blueprint entity's **t

Graph reference: agentIdentityBlueprint

Property	Type	Description
api	apiApplication	Specifies settings for an agent identity blueprint that implements a web API. Inherited from application.
appId	String	The unique identifier for the agent identity blueprint that is assigned by Microsoft Entra ID. Not nullable. Read-only. Inherited from application.
appRoles	appRole collection	The collection of roles defined for the agent identity blueprint. With app role assignments, these roles can be assigned to users, groups, or service principals associated with other applications. Not nullable. Inherited from application.
certification	certification	Specifies the certification status of the agent identity blueprint. Inherited from application.
createdByAppId	String	The appId of the application that created this agent identity blueprint. Set internally by Microsoft Entra ID. Read-only. Inherited from application.
createdDateTime	DateTimeOffset	The date and time the agent identity blueprint was registered. The DateTimeOffset type represents date and time information using ISO 8601 format and is always in UTC time. Read-only. Inherited from application.
description	String	Free text field to provide a description of the agent identity blueprint to end users. The maximum allowed size is 1,024 characters. The least privileged permission to update this property is AgentIdentityBlueprint.UpdateBranding.All. Inherited from application.
disabledByMicrosoftStatus	String	Specifies whether Microsoft has disabled the registered agent identity blueprint. The possible values are: `null` (default value), `NotDisabled`, and `DisabledDueToViolationOfServicesAgreement` (reasons may include suspicious, abusive, or malicious activity, or a violation of the Microsoft Services Agreement). Inherited from application.
displayName	String	The display name for the agent identity blueprint. Maximum length is 256 characters. The least privileged permission to update this property is AgentIdentityBlueprint.UpdateBranding.All. Inherited from application.
groupMembershipClaims	String	Configures the `groups` claim issued in a user or OAuth 2.0 access token that the agent identity blueprint expects. To set this attribute, use one of the following string values: `None`, `SecurityGroup` (for security groups and Microsoft Entra roles), `All` (this gets all security groups, distribution groups, and Microsoft Entra directory roles that the signed-in user is a member of). Inherited from application.
id	String	Unique identifier for the agent identity blueprint object. This property is referred to as Object ID in the Microsoft Entra admin center. Key. Not nullable. Read-only. Inherited from directoryObject.
identifierUris	String collection	Also known as App ID URI, this value is set when an agent identity blueprint is used as a resource app. The identifierUris acts as the prefix for the scopes you reference in your API's code, and it must be globally unique across Microsoft Entra ID. Not nullable. Inherited from application.
info	informationalUrl	Basic profile information of the agent identity blueprint, such as it's marketing, support, terms of service, and privacy statement URLs. The terms of service and privacy statement are surfaced to users through the user consent experience. Inherited from application.
keyCredentials	keyCredential collection	The collection of key credentials associated with the agent identity blueprint. Not nullable. The least privileged permission to update this property is AgentIdentityBlueprint.AddRemoveCreds.All. Inherited from application.
managerApplications	Guid collection	A collection of application IDs for Microsoft first-party applications designated as managers of this agent blueprint. Manager applications can create agent blueprint principals, agent identities, and agent users for managed agent blueprints without requiring highly privileged permissions such as `AgentIdentityBlueprintPrincipal.ReadWrite.All`. Limited to a maximum of 10 entries. Not nullable. Only Microsoft first-party applications can be designated as managers. Not returned by default. Supports `$select`.
optionalClaims	optionalClaims	Application developers can configure optional claims in their Microsoft Entra agent identity blueprints to specify the claims that are sent to their application by the Microsoft security token service. Inherited from application.
passwordCredentials	passwordCredential collection	The collection of password credentials associated with the agent identity blueprint. Not nullable. The least privileged permission to update this property is AgentIdentityBlueprint.AddRemoveCreds.All. Inherited from application. You can also add passwords after creating the agent identity blueprint by calling the Add password API.
publisherDomain	String	The verified publisher domain for the agent identity blueprint. Read-only. Inherited from application.
requiredResourceAccess	requiredResourceAccess collection	Specifies the resources that the agentIdentityBlueprint needs to access. This property also specifies the set of delegated permissions and application roles that it needs for each of those resources. This configuration of access to the required resources drives the consent experience. No more than 50 resource services (APIs) can be configured. The total number of required permissions must not exceed 400. For more information, see Limits on requested permissions per app. Not nullable. Inherited from application. Supports `$filter` (`eq`, `not`, `ge`, `le`).
serviceManagementReference	String	References application or service contact information from a Service or Asset Management database. Nullable. Inherited from application.
signInAudience	String	Specifies the Microsoft accounts that are supported for the current agent identity blueprint. The possible values are: `AzureADMyOrg` (default), `AzureADMultipleOrgs`, `AzureADandPersonalMicrosoftAccount`, and `PersonalMicrosoftAccount`. Inherited from application.
tags	String collection	Custom strings that can be used to categorize and identify the agent identity blueprint. Not nullable. Inherited from application.
tokenEncryptionKeyId	Guid	Specifies the keyId of a public key from the keyCredentials collection. When configured, Microsoft Entra ID encrypts all the tokens it emits by using the key this property points to. Inherited from application.
uniqueName	String	The unique identifier that can be assigned to an agent identity blueprint and used as an alternate key. Immutable. Read-only. Inherited from application.
verifiedPublisher	verifiedPublisher	Specifies the verified publisher of the agent identity blueprint. Inherited from application.
web	webApplication	Specifies settings for a web application. Inherited from application.

Graph reference: agentIdentityBlueprintPrincipal

Property	Type	Description
accountEnabled	Boolean	`true` if the agent identity blueprint principal account is enabled; otherwise, `false`. If set to `false`, then no users are able to sign in to this app, even if they're assigned to it. Inherited from servicePrincipal.
appDescription	String	The description exposed by the associated agent identity blueprint. Inherited from servicePrincipal.
appDisplayName	String	The display name exposed by the associated agent identity blueprint. Maximum length is 256 characters. Inherited from servicePrincipal.
appId	String	The appId of the associated agent identity blueprint. Alternate key. Inherited from servicePrincipal.
appOwnerOrganizationId	Guid	Contains the tenant ID where the agent identity blueprint is registered. This is applicable only to agent identity blueprint principals backed by applications. Inherited from servicePrincipal.
appRoleAssignmentRequired	Boolean	Specifies whether users or other service principals need to be granted an app role assignment for this agent identity blueprint principal before users can sign in or apps can get tokens. The default value is `false`. Not nullable. Inherited from servicePrincipal.
appRoles	appRole collection	The roles exposed by the agent identity blueprint, which this agent identity blueprint principal represents. For more information, see the appRoles property definition on the application entity. Not nullable. Inherited from servicePrincipal.
createdByAppId	String	The appId of the application that created this agent identity blueprint principal. Set internally by Microsoft Entra ID. Read-only. Inherited from servicePrincipal.
disabledByMicrosoftStatus	String	Specifies whether Microsoft has disabled the registered agent identity blueprint. The possible values are: `null` (default value), `NotDisabled`, and `DisabledDueToViolationOfServicesAgreement` (reasons may include suspicious, abusive, or malicious activity, or a violation of the Microsoft Services Agreement). Inherited from servicePrincipal.
displayName	String	The display name for the agent identity blueprint principal. Inherited from servicePrincipal.
id	String	The unique identifier for the agent identity blueprint principal. Inherited from entity. Key. Not nullable. Read-only.
info	informationalUrl	Basic profile information of the acquired application such as app's marketing, support, terms of service and privacy statement URLs. The terms of service and privacy statement are surfaced to users through the user consent experience. Inherited from servicePrincipal.
managerApplications	Guid collection	The collection of application IDs designated as managers of this agent identity blueprint principal's backing agentIdentityBlueprint. Read-only; the value is server-managed and reflects the managerApplications of the backing agentIdentityBlueprint. To change the managers, an owner or administrator must update the managerApplications property on the backing agentIdentityBlueprint in the tenant where it's registered. For multitenant agent identity blueprints, admins in a tenant where the blueprint is only consumed can't make this change — they must ask an owner or administrator in the blueprint's home tenant. Not nullable. Returned only on `$select`.
publishedPermissionScopes	permissionScope collection	The delegated permissions exposed by the application. For more information, see the oauth2PermissionScopes property on the agent identity blueprint entity's api property. Not nullable. Inherited from servicePrincipal.
publisherName	String	The name of the Microsoft Entra tenant that published the application. Inherited from servicePrincipal.
servicePrincipalNames	String collection	Contains the list of identifiersUris, copied over from the associated agent identity blueprint. More values can be added to hybrid agent identity blueprint. These values can be used to identify the permissions exposed by this app within Microsoft Entra ID. Not nullable. Property blocked on Agent Identity Blueprint Principal. Inherited from servicePrincipal.
servicePrincipalType	String	Identifies if the agent identity blueprint principal represents an application. This is set by Microsoft Entra ID internally. For an agent identity blueprint principal that represents an application this is set as Application. Inherited from servicePrincipal.
signInAudience	String	Specifies the Microsoft accounts that are supported for the current agent identity blueprint. Read-only. Supported values are: `AzureADMyOrg`, `AzureADMultipleOrgs`, `AzureADandPersonalMicrosoftAccount`, and `PersonalMicrosoftAccount`. Inherited from servicePrincipal.
tags	String collection	Custom strings that can be used to categorize and identify the agent identity blueprint principal. Not nullable. The value is the union of strings set here and on the associated agent identity blueprint entity's tags property. Inherited from servicePrincipal.
verifiedPublisher	verifiedPublisher	Specifies the verified publisher of the application that's linked to this agent identity blueprint principal. Inherited from servicePrincipal.

Graph reference: allowedTenantsAudience

Property	Type	Description
allowedTenantIds	String collection	The list of Entra tenant IDs where the application can be used as either a client application or a resource application (API). This property must contain at least one value and can't include more than 20 values. The tenant ID where the application is registered may be included, but is not required (see isHomeTenantAllowed). Required.
isHomeTenantAllowed	Boolean	Whether the tenant where the application is registered is allowed. Currently, only `true` is supported. Default is `true`.
kind	kind	If provided, must be `allowedTenants`. Optional. Inherited from signInAudienceRestrictionsBase.

Graph reference: apiApplication

Property	Type	Description
acceptMappedClaims	Boolean	When `true`, allows an application to use claims mapping without specifying a custom signing key.
knownClientApplications	Guid collection	Used for bundling consent if you have a solution that contains two parts: a client app and a custom web API app. If you set the appID of the client app to this value, the user only consents once to the client app. Microsoft Entra ID knows that consenting to the client means implicitly consenting to the web API and automatically provisions service principals for both APIs at the same time. Both the client and the web API app must be registered in the same tenant.
oauth2PermissionScopes	permissionScope collection	The definition of the delegated permissions exposed by the web API represented by this application registration. These delegated permissions may be requested by a client application, and may be granted by users or administrators during consent. Delegated permissions are sometimes referred to as OAuth 2.0 scopes. These scopes and the application's appRoles share a default limit of 700 permission definitions per application. Enabled and disabled definitions both count. For counting rules, behavior for existing objects above the limit, and design guidance, see App role limits.
preAuthorizedApplications	preAuthorizedApplication collection	Lists the client applications that are preauthorized with the specified delegated permissions to access this application's APIs. Users aren't required to consent to any preauthorized application (for the permissions specified). However, any other permissions not listed in preAuthorizedApplications (requested through incremental consent for example) will require user consent.
requestedAccessTokenVersion	Int32	Specifies the access token version expected by this resource. This changes the version and format of the JWT produced independent of the endpoint or client used to request the access token. The endpoint used, v1.0 or v2.0, is chosen by the client and only impacts the version of id_tokens. Resources need to explicitly configure **r

Graph reference: application

Property	Type	Description
addIns	addIn collection	Defines custom behavior that a consuming service can use to call an app in specific contexts. For example, applications that can render file streams can set the addIns property for its "FileHandler" functionality. This lets services like Microsoft 365 call the application in the context of a document the user is working on.
api	apiApplication	Specifies settings for an application that implements a web API.
appId	String	The unique identifier for the application that is assigned to an application by Microsoft Entra ID. Not nullable. Read-only. Alternate key. Supports `$filter` (`eq`).
applicationTemplateId	String	Unique identifier of the applicationTemplate. Supports `$filter` (`eq`, `not`, `ne`). Read-only. `null` if the app wasn't created from an application template.
appRoles	appRole collection	The collection of roles defined for the application. With app role assignments, these roles can be assigned to users, groups, or service principals associated with other applications. Not nullable. App roles and exposed delegated permission scopes (api.oauth2PermissionScopes) share a default limit of 700 permission definitions per application. Enabled and disabled definitions both count. This limit is separate from the aggregate 1,200-entry application manifest limit and from app role assignment limits. For counting rules, behavior for existing objects above the limit, and design guidance, see App role limits.
authenticationBehaviors	authenticationBehaviors	The set of breaking change behaviors related to token issuance that are configured for the application. Authentication behaviors are unset by default (`null`) and must be explicitly enabled or disabled. Nullable. Returned only on `$select`. Requires `$select` to retrieve. For more information about authentication behaviors, see Manage application authenticationBehaviors.
certification	certification	Specifies the certification status of the application.
createdByAppId	String	The appId of the application that created this application. Set internally by Microsoft Entra ID. Read-only.
createdDateTime	DateTimeOffset	The date and time the application was registered. The DateTimeOffset type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is `2014-01-01T00:00:00Z`. Read-only. Supports `$filter` (`eq`, `ne`, `not`, `ge`, `le`, `in`, and `eq` on `null` values) and `$orderby`.
deletedDateTime	DateTimeOffset	The date and time the application was deleted. The DateTimeOffset type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is `2014-01-01T00:00:00Z`. Read-only.
description	String	Free text field to provide a description of the application object to end users. The maximum allowed size is 1,024 characters. Supports `$filter` (`eq`, `ne`, `not`, `ge`, `le`, `startsWith`) and `$search`.
disabledByMicrosoftStatus	String	Specifies whether Microsoft has disabled the registered application. The possible values are: `null` (default value), `NotDisabled`, and `DisabledDueToViolationOfServicesAgreement` (reasons include suspicious, abusive, or malicious activity, or a violation of the Microsoft Services Agreement). Supports `$filter` (`eq`, `ne`, `not`).
displayName	String	The display name for the application. Maximum length is 256 characters. Supports `$filter` (`eq`, `ne`, `not`, `ge`, `le`, `in`, `startsWith`, and `eq` on `null` values), `$search`, and `$orderby`.
groupMembershipClaims	String	Configures the `groups` claim issued in a user or OAuth 2.0 access token that the application expects. To set this attribute, use one of the following valid string values: `None`, `SecurityGroup` (for security groups and Microsoft Entra roles), `All` (this gets all of the security groups, distribution groups, and Microsoft Entra directory roles that the signed-in user is a member of).
id	String	Unique identifier for the application object. This property is referred to as Object ID in the Microsoft Entra admin center. Inherited from directoryObject. Key. Not nullable. Read-only. Supports `$filter` (`eq`, `ne`, `not`, `in`).
identifierUris	String collection	Also known as App ID URI, this value is set when an application is used as a resource app. The identifierUris acts as the prefix for the scopes you reference in your API's code, and it must be globally unique across Microsoft Entra ID. For more information on valid identifierUris patterns and best practices, see Microsoft Entra application registration security best practices. Not nullable. Supports `$filter` (`eq`, `ne`, `ge`, `le`, `startsWith`).
info	informationalUrl	Basic profile information of the application such as app's marketing, support, terms of service and privacy statement URLs. The terms of service and privacy statement are surfaced to users through the user consent experience. For more info, see How to: Add Terms of service and privacy statement for registered Microsoft Entra apps. Supports `$filter` (`eq`, `ne`, `not`, `ge`, `le`, and `eq` on `null` values).
isDeviceOnlyAuthSupported	Boolean	Specifies whether this application supports device authentication without a user. The default is `false`.
isFallbackPublicClient	Boolean	Specifies the fallback application type as public client, such as an installed application running on a mobile device. The default value is `false`, which means the fallback application type is confidential client such as a web app. There are certain scenarios where Microsoft Entra ID can't determine the client application type. For example, the ROPC flow where it's configured without specifying a redirect URI. In those cases, Microsoft Entra ID interprets the application type based on the value of this property.
keyCredentials	keyCredential collection	The collection of key credentials associated with the application. Not nullable. Supports `$filter` (`eq`, `not`, `ge`, `le`).
logo	Stream	The main logo for the application. Not nullable.
managerApplications	Guid collection	A collection of application IDs for Microsoft first-party applications designated as managers. Manager applications can create service principals, agent identities, and agent users for managed agent blueprints. Limited to a maximum of 10 entries. Not nullable. Only supported on agentIdentityBlueprint objects; attempts to set this property on non-agent-blueprint applications return an error. Not returned by default; must be explicitly requested via `$select`.
nativeAuthenticationApisEnabled	nativeAuthenticationApisEnabled	Specifies whether the Native Authentication APIs are enabled for the application. The possible values are: `none` and `all`. Default is `none`. For more information, see Native Authentication.
notes	String	Notes relevant for the management of the application.
oauth2RequiredPostResponse	Boolean	Specifies whether, as part of OAuth 2.0 token requests, Microsoft Entra ID allows POST requests, as opposed to GET requests. The default is `false`, which specifies that only GET requests are allowed.
optionalClaims	optionalClaims	Application developers can configure optional claims in their Microsoft Entra applications to specify the claims that are sent to their application by the Microsoft security token service. For more information, see How to: Provide optional claims to your app.
parentalControlSettings	parentalControlSettings	Specifies parental control settings for an application.
passwordCredentials	passwordCredential collection	The collection of password credentials associated with the application. Not nullable.
publicClient	publicClientApplication	Specifies settings for installed clients such as desktop or mobile devices.
publisherDomain	String	The verified publisher domain for the application. Read-only. For more information, see How to: Configure an application's publisher domain. Supports `$filter` (`eq`, `ne`, `ge`, `le`, `startsWith`).
requestSignatureVerification	requestSignatureVerification	Specifies whether this application requires Microsoft Entra ID to verify the signed authentication requests.
requiredResourceAccess	requiredResourceAccess collection	Specifies the resources that the application needs to access. This property also specifies the set of delegated permissions and application roles that it needs for each of those resources. This configuration of access to the required resources drives the consent experience. No more than 50 resource services (APIs) can be configured. Beginning mid-October 2021, the total number of required permissions must not exceed 400. For more information, see Limits on requested permissions per app. Not nullable. Supports `$filter` (`eq`, `not`, `ge`, `le`).
samlMetadataUrl	String	The URL where the service exposes SAML metadata for federation. This property is valid only for single-tenant applications. Nullable.
serviceManagementReference	String	References application or service contact information from a Service or Asset Management database. Nullable.
servicePrincipalLockConfiguration	servicePrincipalLockConfiguration	Specifies whether sensitive properties of a multitenant application should be locked for editing after the application is provisioned in a tenant. Nullable. `null` by default.
signInAudience	String	Specifies the Microsoft accounts that are supported for the current application. The possible values are: `AzureADMyOrg` (default), `AzureADMultipleOrgs`, `AzureADandPersonalMicrosoftAccount`, and `PersonalMicrosoftAccount`. See more in the table. The value of this object also limits the number of permissions an app can request. For more information, see Limits on requested permissions per app. The value for this property has implications on other app object properties. As a result, if you change this property, you might need to change other properties first. For more information, see Validation differences for signInAudience. Supports `$filter` (`eq`, `ne`, `not`).
spa	spaApplication	Specifies settings for a single-page application, including sign out URLs and redirect URIs for authorization codes and access tokens.
tags	String collection	Custom strings that can be used to categorize and identify the application. Not nullable. Strings added here will also appear in the tags property of any associated service principals. Supports `$filter` (`eq`, `not`, `ge`, `le`, `startsWith`) and `$search`.
tokenEncryptionKeyId	String	Specifies the keyId of a public key from the keyCredentials collection. When configured, Microsoft Entra ID encrypts all the tokens it emits by using the key this property points to. The application code that receives the encrypted token must use the matching private key to decrypt the token before it can be used for the signed-in user.
uniqueName	String	The unique identifier that can be assigned to an application and used as an alternate key. Immutable. Read-only.
verifiedPublisher	verifiedPublisher	Specifies the verified publisher of the application. For more information about how publisher verification helps support application security, trustworthiness, and compliance, see Publisher verification.
web	webApplication	Specifies settings for a web application.

Graph reference: appRole

Property	Type	Description
allowedMemberTypes	String collection	Specifies whether this app role can be assigned to users and groups (by setting to `"User"]`), to other application's (by setting to `["Application"]`, or both (by setting to `["User", "Application"]`). App roles supporting assignment to other applications' service principals are also known as [application permissions. The "Application" value is only supported for app roles defined on application entities.
description	String	The description for the app role. This is displayed when the app role is being assigned and, if the app role functions as an application permission, during consent experiences.
displayName	String	Display name for the permission that appears in the app role assignment and consent experiences.
id	Guid	Unique role identifier inside the appRoles collection. When creating a new app role, a new GUID identifier must be provided.
isEnabled	Boolean	When creating or updating an app role, this must be set to true (which is the default). To delete a role, this must first be set to false. At that point, in a subsequent call, this role may be removed.
origin	String	Specifies if the app role is defined on the application object or on the servicePrincipal entity. Must not be included in any POST or PATCH requests. Read-only.
value	String	Specifies the value to include in the `roles` claim in ID tokens and access tokens authenticating an assigned user or service principal. Must not exceed 120 characters in length. Allowed characters are `:` `!` `#` `$` `%` `&` `'` `(` `)` `*` `+` `,` `-` `.` `/` `:` `;` `<` `=` `>` `?` `@` `[` `]` `^` `+` `_` ` `{` `\|` `}` `~`, and characters in the ranges `0-9`, `A-Z` and `a-z`. Any other character, including the space character, aren't allowed. May not begin with `.`.

Property	Type	Description
displayName	String	The display name of the label. Read-only.
labelId	String	The unique identifier of the label.

Graph reference: group

Property	Type	Description
accessType	groupAccessType	Indicates the type of access to the group. The possible values are: `none`, `private`, `secret`, `public`, `unknownFutureValue`. Requires `$select` to retrieve. Supported only on the Get group API (`GET /groups/{ID}`).
allowExternalSenders	Boolean	Indicates if people external to the organization can send messages to the group. The default value is `false`. Requires `$select` to retrieve. Supported only on the Get group API (`GET /groups/{ID}`).
assignedLabels	assignedLabel collection	The list of sensitivity label pairs (label ID, label name) associated with a Microsoft 365 group or a cloud security group. Requires a Microsoft Entra ID P1 license. Requires `$select` to retrieve. This property can be specified during group creation or update. However, for cloud security groups, it's immutable once set. This property can be updated only in delegated scenarios where the caller requires both the Microsoft Graph permission and a supported administrator role. To learn more about managing this property for Microsoft 365 vs. cloud security groups, see Key differences from Microsoft 365 group labeling.
assignedLicenses	assignedLicense collection	The licenses that are assigned to the group. Requires `$select` to retrieve. Supports `$filter` (`eq`). Read-only.
autoSubscribeNewMembers	Boolean	Indicates if new members added to the group are autosubscribed to receive email notifications. You can set this property in a PATCH request for the group; don't set it in the initial POST request that creates the group. Default value is `false`. Requires `$select` to retrieve. Supported only on the Get group API (`GET /groups/{ID}`).
classification	String	Describes a classification for the group (such as low, medium, or high business impact). Valid values for this property are defined by creating a ClassificationList setting value, based on the template definition. Returned by default. Supports `$filter` (`eq`, `ne`, `not`, `ge`, `le`, `startsWith`).
createdDateTime	DateTimeOffset	Timestamp of when the group was created. The value can't be modified and is automatically populated when the group is created. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on January 1, 2014 is `2014-01-01T00:00:00Z`. Returned by default. Read-only.
deletedDateTime	DateTimeOffset	For some Microsoft Entra objects (user, group, application), if the object is deleted, it's first logically deleted, and this property is updated with the date and time when the object was deleted. Otherwise this property is `null`. If the object is restored, this property is updated to `null`. Inherited from directoryObject.
description	String	An optional description for the group. Returned by default. Supports `$filter` (`eq`, `ne`, `not`, `ge`, `le`, `startsWith`) and `$search`.
displayName	String	The display name for the group. This property is required when a group is created and can't be cleared during updates. Maximum length is 256 characters. Returned by default. Supports `$filter` (`eq`, `ne`, `not`, `ge`, `le`, `in`, `startsWith`, and `eq` on `null` values), `$search`, and `$orderby`.
expirationDateTime	DateTimeOffset	Timestamp of when the group is set to expire. It's `null` for security groups, but for Microsoft 365 groups, it represents when the group is set to expire as defined in the groupLifecyclePolicy. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC. For example, midnight UTC on January 1, 2014 is `2014-01-01T00:00:00Z`. Returned by default. Supports `$filter` (`eq`, `ne`, `not`, `ge`, `le`, `in`). Read-only.
groupTypes	String collection	Specifies the group type and its membership. If the collection contains `Unified`, the group is a Microsoft 365 group; otherwise, it's either a security group or a distribution group. For details, see groups overview. If the collection includes `DynamicMembership`, the group has dynamic membership; otherwise, membership is static. Returned by default. Supports `$filter` (`eq`, `not`).
hasMembersWithLicenseErrors	Boolean	Indicates whether there are members in this group that have license errors from its group-based license assignment. This property is never returned on a GET operation. You can use it as a $filter argument to get groups that have members with license errors (that is, filter for this property being true). See an example. Supports `$filter` (`eq`).
hideFromAddressLists	Boolean	True if the group isn't displayed in certain parts of the Outlook UI: the Address Book, address lists for selecting message recipients, and the Browse Groups dialog for searching groups; otherwise, false. The default value is `false`. Requires `$select` to retrieve. Supported only on the Get group API (`GET /groups/{ID}`).
hideFromOutlookClients	Boolean	True if the group isn't displayed in Outlook clients, such as Outlook for Windows and Outlook on the web; otherwise, false. The default value is `false`. Requires `$select` to retrieve. Supported only on the Get group API (`GET /groups/{ID}`).
id	String	The unique identifier for the group. Returned by default. Inherited from directoryObject. Key. Not nullable. Read-only. Supports `$filter` (`eq`, `ne`, `not`, `in`).
isArchived	Boolean	When a group is associated with a team, this property determines whether the team is in read-only mode. To read this property, use the `/group/{groupId}/team` endpoint or the Get team API. To update this property, use the archiveTeam and unarchiveTeam APIs.
isAssignableToRole	Boolean	Indicates whether this group can be assigned to a Microsoft Entra role. Optional. This property can only be set while creating the group and is immutable. If set to `true`, the securityEnabled property must also be set to `true`, visibility must be `Hidden`, and the group can't be a dynamic group (that is, groupTypes can't contain `DynamicMembership`). Only callers with at least the Privileged Role Administrator role can set this property. The caller must also be assigned the RoleManagement.ReadWrite.Directory permission to set this property or update the membership of such groups. For more, see Using a group to manage Microsoft Entra role assignments Using this feature requires a Microsoft Entra ID P1 license. Returned by default. Supports `$filter` (`eq`, `ne`, `not`).
isFavorite	Boolean	Indicates whether the user marked the group as favorite. Requires `$select` to retrieve. Supported only on the Get group API (`GET /groups/{ID}`).
isManagementRestricted	Boolean	Indicates whether the group is a member of a restricted management administrative unit. If not set, the default value is `null` and the default behavior is false. Read-only. To manage a group member of a restricted management administrative unit, the administrator or calling app must be assigned a Microsoft Entra role at the scope of the restricted management administrative unit. Requires `$select` to retrieve.
isSubscribedByMail	Boolean	Indicates whether the signed-in user is subscribed to receive email conversations. The default value is `true`. Requires `$select` to retrieve. Supported only on the Get group API (`GET /groups/{ID}`).
licenseProcessingState	String	Indicates the status of the group license assignment to all group members. The default value is `false`. Read-only. Possible values: `QueuedForProcessing`, `ProcessingInProgress`, and `ProcessingComplete`. Requires `$select` to retrieve. Read-only.
mail	String	The SMTP address for the group, for example, "[email protected]". Returned by default. Read-only. Supports `$filter` (`eq`, `ne`, `not`, `ge`, `le`, `in`, `startsWith`, and `eq` on `null` values).
mailEnabled	Boolean	Specifies whether the group is mail-enabled. Required. Returned by default. Supports `$filter` (`eq`, `ne`, `not`).
mailNickname	String	The mail alias for the group, unique for Microsoft 365 groups in the organization. Maximum length is 64 characters. This property can contain only characters in the ASCII character set 0 - 127 except the following characters: `@ () \ [] " ; : <> , SPACE`. Required. Returned by default. Supports `$filter` (`eq`, `ne`, `not`, `ge`, `le`, `in`, `startsWith`, and `eq` on `null` values).
membershipRule	String	The rule that determines members for this group if the group is a dynamic group (groupTypes contains `DynamicMembership`). For more information about the syntax of the membership rule, see Membership Rules syntax. Returned by default. Supports `$filter` (`eq`, `ne`, `not`, `ge`, `le`, `startsWith`).
membershipRuleProcessingState	String	Indicates whether the dynamic membership processing is on or paused. Possible values are `On` or `Paused`. Returned by default. Supports `$filter` (`eq`, `ne`, `not`, `in`).
onPremisesDomainName	String	Contains the on-premises domain FQDN, also called dnsDomainName synchronized from the on-premises directory. The property is only populated for customers synchronizing their on-premises directory to Microsoft Entra ID via Microsoft Entra Connect. Returned by default. Read-only.
onPremisesExtensionAttributes	onPremisesExtensionAttributes	Complex type containing extension attributes 1-15 for the group, synchronized from on-premises Active Directory. Returned only on `$select`. Supports `$filter` (`eq`, `ne`, `not`, `in`).
onPremisesLastSyncDateTime	DateTimeOffset	Indicates the last time at which the group was synced with the on-premises directory. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on January 1, 2014 is `2014-01-01T00:00:00Z`. Returned by default. Read-only. Supports `$filter` (`eq`, `ne`, `not`, `ge`, `le`, `in`).
onPremisesNetBiosName	String	Contains the on-premises netBios name synchronized from the on-premises directory. The property is only populated for customers synchronizing their on-premises directory to Microsoft Entra ID via Microsoft Entra Connect. Returned by default. Read-only.
onPremisesProvisioningErrors	onPremisesProvisioningError collection	Errors when using Microsoft synchronization product during provisioning. Returned by default. Supports `$filter` (`eq`, `not`).
onPremisesSamAccountName	String	Contains the on-premises SAM account name synchronized from the on-premises directory. The property is only populated for customers synchronizing their on-premises directory to Microsoft Entra ID via Microsoft Entra Connect. Returned by default. Supports `$filter` (`eq`, `ne`, `not`, `ge`, `le`, `in`, `startsWith`). Read-only.
onPremisesSecurityIdentifier	String	Contains the on-premises security identifier (SID) for the group synchronized from on-premises to the cloud. Read-only. Returned by default. Supports `$filter` (`eq` including on `null` values).
onPremisesSyncEnabled	Boolean	`true` if this group is synced from an on-premises directory; `false` if this group was originally synced from an on-premises directory but is no longer synced; null if this object has never synced from an on-premises directory (default). Returned by default. Read-only. Supports `$filter` (`eq`, `ne`, `not`, `in`, and `eq` on `null` values).
preferredDataLocation	String	The preferred data location for the Microsoft 365 group. By default, the group inherits the group creator's preferred data location. To set this property, the calling app must be granted the Directory.ReadWrite.All permission and the user be assigned at least one of the following Microsoft Entra roles: User Account Administrator Directory Writer Exchange Administrator SharePoint Administrator For more information about this property, see OneDrive Online Multi-Geo. Nullable. Returned by default.
preferredLanguage	String	The preferred language for a Microsoft 365 group. Should follow ISO 639-1 Code; for example, `en-US`. Returned by default. Supports `$filter` (`eq`, `ne`, `not`, `ge`, `le`, `in`, `startsWith`, and `eq` on `null` values).
proxyAddresses	String collection	Email addresses for the group that direct to the same group mailbox. For example: `["SMTP: [email protected]", "smtp: [email protected]"]`. The any operator is required to filter expressions on multi-valued properties. Returned by default. Read-only. Not nullable. Supports `$filter` (`eq`, `not`, `ge`, `le`, `startsWith`, `endsWith`, `/$count eq 0`, `/$count ne 0`).
renewedDateTime	DateTimeOffset	Timestamp of when the group was last renewed. This value can't be modified directly and is only updated via the renew service action. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC. For example, midnight UTC on January 1, 2014 is `2014-01-01T00:00:00Z`. Returned by default. Supports `$filter` (`eq`, `ne`, `not`, `ge`, `le`, `in`). Read-only.
resourceBehaviorOptions	String collection	Specifies the group behaviors that can be set for a Microsoft 365 group during creation. This property can be set only as part of creation (POST). For the list of possible values, see Microsoft 365 group behaviors and provisioning options.
resourceProvisioningOptions	String collection	Specifies the group resources that are associated with the Microsoft 365 group. The possible value is `Team`. For more information, see Microsoft 365 group behaviors and provisioning options. Returned by default. Supports `$filter` (`eq`, `not`, `startsWith`).
securityEnabled	Boolean	Specifies whether the group is a security group. Required. Returned by default. Supports `$filter` (`eq`, `ne`, `not`, `in`).
securityIdentifier	String	Security identifier of the group, used in Windows scenarios. Read-only. Returned by default.
serviceProvisioningErrors	serviceProvisioningError collection	Errors published by a federated service describing a nontransient, service-specific error regarding the properties or link from a group object. Supports `$filter` (`eq`, `not`, for isResolved and serviceInstance).
theme	string	Specifies a Microsoft 365 group's color theme. Possible values are `Teal`, `Purple`, `Green`, `Blue`, `Pink`, `Orange`, or `Red`. Returned by default.
uniqueName	String	The unique identifier that can be assigned to a group and used as an alternate key. Immutable. Read-only.
unseenConversationsCount	Int32	Count of conversations that have had one or more new posts delivered since the signed-in user's last visit to the group. This property is the same as unseenCount. Requires `$select` to retrieve. Supported only on the Get group API (`GET /groups/{ID}`).
unseenCount	Int32	Count of conversations that have received new posts since the signed-in user last visited the group. This property is the same as unseenConversationsCount. Requires `$select` to retrieve. Supported only on the Get group API (`GET /groups/{ID}`).
unseenMessagesCount	Int32	Count of new posts that have been delivered to the group's conversations since the signed-in user's last visit to the group. Requires `$select` to retrieve. Supported only on the Get group API (`GET /groups/{ID}`).
visibility	String	Specifies the group join policy and group content visibility for groups. The possible values are: `Private`, `Public`, or `HiddenMembership`. `HiddenMembership` can be set only for Microsoft 365 groups when the groups are created. It can't be updated later. Other values of visibility can be updated after group creation. If visibility value isn't specified during group creation on Microsoft Graph, a security group is created as `Private` by default, and the Microsoft 365 group is `Public`. Groups assignable to roles are always `Private`. To learn more, see group visibility options. Returned by default. Nullable.

Graph reference: groupWritebackConfiguration

Property	Type	Description
isEnabled	Boolean	Indicates whether writeback of cloud groups to on-premises Active Directory is enabled. Nullable. Default value is `true` for Microsoft 365 groups and `false` for security groups. Inherited from writebackConfiguration.
onPremisesGroupType	String	Indicates the target on-premises group type the cloud object is written back as. Nullable. The possible values are: `universalDistributionGroup`, `universalSecurityGroup`, `universalMailEnabledSecurityGroup`. If the cloud group is a unified (Microsoft 365) group, this property can be one of the following: `universalDistributionGroup`, `universalSecurityGroup`, `universalMailEnabledSecurityGroup`. Microsoft Entra security groups can be written back as `universalSecurityGroup`. If **i

Graph reference: informationalUrl

Property	Type	Description
logoUrl	String	CDN URL to the application's logo, Read-only.
marketingUrl	String	Link to the application's marketing page. For example, https://www.contoso.com/app/marketing
privacyStatementUrl	String	Link to the application's privacy statement. For example, https://www.contoso.com/app/privacy
supportUrl	String	Link to the application's support page. For example, https://www.contoso.com/app/support
termsOfServiceUrl	String	Link to the application's terms of service statement. For example, https://www.contoso.com/app/termsofservice

Graph reference: keyCredential

Property	Type	Description
customKeyIdentifier	Binary	A 40-character binary type that can be used to identify the credential. Optional. When not provided in the payload, defaults to the thumbprint of the certificate.
displayName	String	The friendly name for the key, with a maximum length of 90 characters. Longer values are accepted but shortened. Optional.
endDateTime	DateTimeOffset	The date and time at which the credential expires. The DateTimeOffset type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is `2014-01-01T00:00:00Z`.
key	Binary	The certificate's raw data in byte array converted to Base64 string. Requires `$select` to retrieve; only available for single object requests (`GET /applications/{applicationId}?$select=keyCredentials` or `GET /servicePrincipals/{servicePrincipalId}?$select=keyCredentials`); otherwise, it's always `null`. From a .cer certificate, you can read the key using the Convert.ToBase64String() method. For more information, see Get the certificate key.
keyId	Guid	The unique identifier (GUID) for the key.
startDateTime	DateTimeOffset	The date and time at which the credential becomes valid.The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is `2014-01-01T00:00:00Z`.
type	String	The type of key credential; for example, `Symmetric`, `AsymmetricX509Cert`.
usage	String	A string that describes the purpose for which the key can be used; for example, `Verify`.

Graph reference: onPremisesPublishing

Property	Type	Description
alternateUrl	String	If you're configuring a traffic manager in front of multiple app proxy applications, this user-friendly URL points to the traffic manager.
applicationServerTimeout	String	The duration the connector waits for a response from the backend application before closing the connection. Possible values are `default`, `long`. When set to default, the backend application timeout has a length of 85 seconds. When set to long, the backend timeout is increased to 180 seconds. Use `long` if your server takes more than 85 seconds to respond to requests or if you are unable to access the application and the error status is "Backend Timeout". Default value is `default`.
applicationType	String	System-defined value that indicates whether this application is an application proxy configured application. The possible values are `quickaccessapp` and `nonwebapp`. Read-only.
externalAuthenticationType	externalAuthenticationType	Details the pre-authentication setting for the application. Pre-authentication enforces that users must authenticate before accessing the app. Pass through doesn't require authentication. The possible values are: `passthru`, `aadPreAuthentication`.
externalUrl	String	The published external URL for the application. For example, `https://intranet-contoso.msappproxy.net/`.
internalUrl	String	The internal url of the application. For example, `https://intranet/`.
isAccessibleViaZTNAClient	Boolean	Indicates whether the application is accessible via a Global Secure Access client on a managed device.
isBackendCertificateValidationEnabled	Boolean	Indicates whether backend SSL certificate validation is enabled for the application. For all new Application Proxy apps, the property is set to `true` by default. For all existing apps, the property is set to `false`.
isContinuousAccessEvaluationEnabled	Boolean	Indicates whether continuous access evaluation is enabled for Application Proxy application. For all Application Proxy apps, the property is set to `true` by default.
isDeviceAccessEnabled	Boolean	Indicates whether the Microsoft Entra Private Access application is accessible or available in device access mode. `false` by default.
isDnsResolutionEnabled	Boolean	Indicates Microsoft Entra Private Access should handle DNS resolution. `false` by default.
isHttpOnlyCookieEnabled	Boolean	Indicates if the HTTPOnly cookie flag should be set in the HTTP response headers. Set this value to `true` to have Application Proxy cookies include the HTTPOnly flag in the HTTP response headers. If using Remote Desktop Services, set this value to False. Default value is `false`.
isOnPremPublishingEnabled	Boolean	Indicates if the application is currently being published via Application Proxy or not. This is preset by the system. Read-only.
isPersistentCookieEnabled	Boolean	Indicates if the Persistent cookie flag should be set in the HTTP response headers. Keep this value set to `false`. Only use this setting for applications that can't share cookies between processes. For more information about cookie settings, see Cookie settings for accessing on-premises applications in Microsoft Entra ID. Default value is `false`.
isSecureCookieEnabled	Boolean	Indicates if the Secure cookie flag should be set in the HTTP response headers. Set this value to `true` to transmit cookies over a secure channel such as an encrypted HTTPS request. Default value is `true`.
isStateSessionEnabled	Boolean	Indicates whether validation of the state parameter when the client uses the OAuth 2.0 authorization code grant flow is enabled. This setting allows admins to specify whether they want to enable CSRF protection for their apps.
isTranslateHostHeaderEnabled	Boolean	Indicates if the application should translate urls in the response headers. Keep this value as `true` unless your application required the original host header in the authentication request. Default value is `true`.
isTranslateLinksInBodyEnabled	Boolean	Indicates if the application should translate urls in the application body. Keep this value as `false` unless you have hardcoded HTML links to other on-premises applications and don't use custom domains. For more information, see Link translation with Application Proxy. Default value is `false`.
onPremisesApplicationSegments (deprecated)	onPremisesApplicationSegment collection	Represents the application segment collection for an on-premises wildcard application. This property is deprecated and will stop returning data on June 1, 2023. Use segmentsConfiguration instead.
segmentsConfiguration	segmentConfiguration	Represents the collection of application segments for an on-premises wildcard application that's published through Microsoft Entra application proxy.
singleSignOnSettings	onPremisesPublishingSingleSignOn	Represents the single sign-on configuration for the on-premises application.
trafficRoutingMethod	trafficRoutingMethod	Indicates how traffic is distributed across multiple connectors in a connector group. The possible values are: `none`, `random`, `sessionPersistence`, `performance` (Not implemented), `unknownFutureValue`.
useAlternateUrlForTranslationAndRedirect	Boolean	Indicates whether the application should use alternateUrl instead of externalUrl.
verifiedCustomDomainCertificatesMetadata	verifiedCustomDomainCertificatesMetadata	Details of the certificate associated with the application when a custom domain is in use. `null` when using the default domain. Read-only.
verifiedCustomDomainKeyCredential	keyCredential	The associated key credential for the custom domain used.
verifiedCustomDomainPasswordCredential	passwordCredential	The associated password credential for the custom domain used.

Graph reference: parentalControlSettings

Property

Type

Description

countriesBlockedForMinors

String collection

Specifies the two-letter ISO country codes. Access to the application will be blocked for minors from the countries specified in this list.

legalAgeGroupRule

String

Specifies the legal age group rule that applies to users of the app. Can be set to one of the following values:

Value	Description
Allow	Default. Enforces the legal minimum. This means parental consent is required for minors in the European Union and Korea.
RequireConsentForPrivacyServices	Enforces the user to specify date of birth to comply with COPPA rules.
RequireConsentForMinors	Requires parental consent for ages below 18, regardless of country/region minor rules.
RequireConsentForKids	Requires parental consent for ages below 14, regardless of country/region minor rules.
BlockMinors	Blocks minors from using the app.

Graph reference: passwordCredential

Property	Type	Description
customKeyIdentifier	Binary	Do not use.
displayName	String	Friendly name for the password. Optional.
endDateTime	DateTimeOffset	The date and time at which the password expires represented using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is `2014-01-01T00:00:00Z`. Optional.
hint	String	Contains the first three characters of the password. Read-only.
keyId	Guid	The unique identifier for the password.
secretText	String	Read-only; Contains the strong passwords generated by Microsoft Entra ID that are 16-64 characters in length. The generated password value is only returned during the initial POST request to addPassword. There is no way to retrieve this password in the future.
startDateTime	DateTimeOffset	The date and time at which the password becomes valid. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is `2014-01-01T00:00:00Z`. Optional.

Graph reference: publicClientApplication

Property	Type	Description
redirectUris	String collection	Specifies the URLs where user tokens are sent for sign-in, or the redirect URIs where OAuth 2.0 authorization codes and access tokens are sent. For iOS and macOS apps, specify the value following the syntax `msauth.{BUNDLEID}://auth`, replacing "{BUNDLEID}". For example, if the bundle ID is `com.microsoft.identitysample.MSALiOS`, the URI is `msauth.com.microsoft.identitysample.MSALiOS://auth`.

Graph reference: requiredResourceAccess

Property	Type	Description
resourceAccess	resourceAccess collection	The list of OAuth2.0 permission scopes and app roles that the application requires from the specified resource.
resourceAppId	String	The unique identifier for the resource that the application requires access to. This should be equal to the **a

Property	Type	Description
relayState	String	The relative URI the service provider would redirect to after completion of the single sign-on flow.

Graph reference: servicePrincipal

Property	Type	Description
accountEnabled	Boolean	`true` if the service principal account is enabled; otherwise, `false`. If set to `false`, then no users are able to sign in to this app, even if they're assigned to it. Supports `$filter` (`eq`, `ne`, `not`, `in`).
addIns	addIn collection	Defines custom behavior that a consuming service can use to call an app in specific contexts. For example, applications that can render file streams may set the addIns property for its "FileHandler" functionality. This lets services like Microsoft 365 call the application in the context of a document the user is working on.
alternativeNames	String collection	Used to retrieve service principals by subscription, identify resource group and full resource IDs for managed identities. Supports `$filter` (`eq`, `not`, `ge`, `le`, `startsWith`).
appDescription	String	The description exposed by the associated application.
appDisplayName	String	The display name exposed by the associated application. Maximum length is 256 characters.
appId	String	The unique identifier for the associated application (its appId property). Alternate key. Supports `$filter` (`eq`, `ne`, `not`, `in`, `startsWith`).
applicationTemplateId	String	Unique identifier of the applicationTemplate. Supports `$filter` (`eq`, `not`, `ne`). Read-only. `null` if the service principal wasn't created from an application template.
appOwnerOrganizationId	Guid	Contains the tenant ID where the application is registered. This is applicable only to service principals backed by applications. Supports `$filter` (`eq`, `ne`, `NOT`, `ge`, `le`).
appRoleAssignmentRequired	Boolean	Specifies whether users or other service principals need to be granted an app role assignment for this service principal before users can sign in or apps can get tokens. The default value is `false`. Not nullable. Supports `$filter` (`eq`, `ne`, `NOT`).
appRoles	appRole collection	The roles exposed by the application that's linked to this service principal. For more information, see the appRoles property definition on the application entity. Not nullable. App roles and exposed delegated permission scopes (oauth2PermissionScopes) share a default limit of 700 permission definitions per service principal, including definitions inherited from the application and definitions added directly to the service principal. Enabled and disabled definitions both count. This limit counts definitions, not app role assignments. For counting rules, behavior for existing objects above the limit, and design guidance, see App role limits.
createdByAppId	String	The appId of the application that created this service principal. Set internally by Microsoft Entra ID. Read-only.
customSecurityAttributes	customSecurityAttributeValue	An open complex type that holds the value of a custom security attribute that is assigned to a directory object. Nullable. Requires `$select` to retrieve. Supports `$filter` (`eq`, `ne`, `not`, `startsWith`). Filter value is case sensitive. To read this property, the calling app must be assigned the CustomSecAttributeAssignment.Read.All permission. To write this property, the calling app must be assigned the CustomSecAttributeAssignment.ReadWrite.All permissions. To read or write this property in delegated scenarios, the admin must be assigned the Attribute Assignment Administrator role.
deletedDateTime	DateTimeOffset	The date and time the service principal was deleted. Read-only.
description	String	Free text field to provide an internal end-user facing description of the service principal. End-user portals such MyApps displays the application description in this field. The maximum allowed size is 1,024 characters. Supports `$filter` (`eq`, `ne`, `not`, `ge`, `le`, `startsWith`) and `$search`.
disabledByMicrosoftStatus	String	Specifies whether Microsoft has disabled the registered application. The possible values are: `null` (default value), `NotDisabled`, and `DisabledDueToViolationOfServicesAgreement` (reasons include suspicious, abusive, or malicious activity, or a violation of the Microsoft Services Agreement). Supports `$filter` (`eq`, `ne`, `not`).
displayName	String	The display name for the service principal. Supports `$filter` (`eq`, `ne`, `not`, `ge`, `le`, `in`, `startsWith`, and `eq` on `null` values), `$search`, and `$orderby`.
homepage	String	Home page or landing page of the application.
id	String	The unique identifier for the service principal. Inherited from directoryObject. Key. Not nullable. Read-only. Supports `$filter` (`eq`, `ne`, `not`, `in`).
info	informationalUrl	Basic profile information of the acquired application such as app's marketing, support, terms of service and privacy statement URLs. The terms of service and privacy statement are surfaced to users through the user consent experience. For more info, see How to: Add Terms of service and privacy statement for registered Microsoft Entra apps. Supports `$filter` (`eq`, `ne`, `not`, `ge`, `le`, and `eq` on `null` values).
keyCredentials	keyCredential collection	The collection of key credentials associated with the service principal. Not nullable. Supports `$filter` (`eq`, `not`, `ge`, `le`).
loginUrl	String	Specifies the URL where the service provider redirects the user to Microsoft Entra ID to authenticate. Microsoft Entra ID uses the URL to launch the application from Microsoft 365 or the Microsoft Entra My Apps. When blank, Microsoft Entra ID performs IdP-initiated sign-on for applications configured with SAML-based single sign-on. The user launches the application from Microsoft 365, the Microsoft Entra My Apps, or the Microsoft Entra SSO URL.
logoutUrl	String	Specifies the URL that the Microsoft's authorization service uses to sign out a user using OpenID Connect front-channel, back-channel, or SAML sign out protocols.
notes	String	Free text field to capture information about the service principal, typically used for operational purposes. Maximum allowed size is 1,024 characters.
notificationEmailAddresses	String collection	Specifies the list of email addresses where Microsoft Entra ID sends a notification when the active certificate is near the expiration date. This is only for the certificates used to sign the SAML token issued for Microsoft Entra Gallery applications.
oauth2PermissionScopes	permissionScope collection	The delegated permissions exposed by the application. For more information, see the oauth2PermissionScopes property on the application entity's api property. Not nullable. These scopes and appRoles share a default limit of 700 permission definitions per service principal. Enabled and disabled definitions both count. For counting rules, behavior for existing objects above the limit, and design guidance, see App role limits.
passwordCredentials	passwordCredential collection	The collection of password credentials associated with the application. Not nullable.
preferredSingleSignOnMode	string	Specifies the single sign-on mode configured for this application. Microsoft Entra ID uses the preferred single sign-on mode to launch the application from Microsoft 365 or the My Apps portal. The supported values are `password`, `saml`, `notSupported`, and `oidc`. Note: This field might be `null` for older SAML apps and for OIDC applications where it isn't set automatically.
preferredTokenSigningKeyThumbprint	String	This property can be used on SAML applications (apps that have preferredSingleSignOnMode set to `saml`) to control which certificate is used to sign the SAML responses. For applications that aren't SAML, don't write or otherwise rely on this property.
replyUrls	String collection	The URLs that user tokens are sent to for sign in with the associated application, or the redirect URIs that OAuth 2.0 authorization codes and access tokens are sent to for the associated application. Not nullable.
resourceSpecificApplicationPermissions	resourceSpecificPermission collection	The resource-specific application permissions exposed by this application. Currently, resource-specific permissions are only supported for Teams apps accessing to specific chats and teams using Microsoft Graph. Read-only.
samlSingleSignOnSettings	samlSingleSignOnSettings	The collection for settings related to saml single sign-on.
servicePrincipalNames	String collection	Contains the list of identifiersUris, copied over from the associated application. Additional values can be added to hybrid applications. These values can be used to identify the permissions exposed by this app within Microsoft Entra ID. For example, Client apps can specify a resource URI that is based on the values of this property to acquire an access token, which is the URI returned in the "aud" claim. The any operator is required for filter expressions on multi-valued properties. Not nullable. Supports `$filter` (`eq`, `not`, `ge`, `le`, `startsWith`).
servicePrincipalType	String	Identifies whether the service principal represents an application, a managed identity, or a legacy application. This property is set by Microsoft Entra ID internally. The servicePrincipalType property can be set to three different values: `Application` - A service principal that represents an application or service. The appId property identifies the associated app registration, and matches the appId of an application, possibly from a different tenant. If the associated app registration is missing, tokens aren't issued for the service principal. `ManagedIdentity` - A service principal that represents a managed identity. Service principals representing managed identities can be granted access and permissions, but can't be updated or modified directly. `Legacy` - A service principal that represents an app created before app registrations, or through legacy experiences. A legacy service principal can have credentials, service principal names, reply URLs, and other properties that are editable by an authorized user, but doesn't have an associated app registration. The appId value doesn't associate the service principal with an app registration. The service principal can only be used in the tenant where it was created. `ServiceIdentity` - A service principal that represents an agent identity. `SocialIdp` - For internal use.
signInAudience	String	Specifies the Microsoft accounts that are supported for the current application. Read-only. Supported values are: `AzureADMyOrg`: Users with a Microsoft work or school account in my organization's Microsoft Entra tenant (single-tenant). `AzureADMultipleOrgs`: Users with a Microsoft work or school account in any organization's Microsoft Entra tenant (multitenant). `AzureADandPersonalMicrosoftAccount`: Users with a personal Microsoft account, or a work or school account in any organization's Microsoft Entra tenant. `PersonalMicrosoftAccount`: Users with a personal Microsoft account only.
tags	String collection	Custom strings that can be used to categorize and identify the service principal. Not nullable. The value is the union of strings set here and on the associated application entity's tags property. Supports `$filter` (`eq`, `not`, `ge`, `le`, `startsWith`).
tokenEncryptionKeyId	String	Specifies the keyId of a public key from the keyCredentials collection. When configured, Microsoft Entra ID issues tokens for this application encrypted using the key specified by this property. The application code that receives the encrypted token must use the matching private key to decrypt the token before it can be used for the signed-in user.
verifiedPublisher	verifiedPublisher	Specifies the verified publisher of the application that's linked to this service principal.

Property	Type	Description
kind	kind	The kind of restrictions on what is allowed by the **s

Graph reference: spaApplication

Property	Type	Description
redirectUris	String collection	Specifies the URLs where user tokens are sent for sign-in, or the redirect URIs where OAuth 2.0 authorization codes and access tokens are sent.

Property	Type	Description
kind	kind	If provided, must be `unrestricted`. Optional. Inherited from signInAudienceRestrictionsBase.

Graph reference: webApplication

Property	Type	Description
homePageUrl	String	Home page or landing page of the application.
implicitGrantSettings	implicitGrantSettings	Specifies whether this web application can request tokens using the OAuth 2.0 implicit flow.
logoutUrl	String	Specifies the URL that is used by Microsoft's authorization service to log out a user using front-channel, back-channel or SAML logout protocols.
redirectUris	String collection	Specifies the URLs where user tokens are sent for sign-in, or the redirect URIs where OAuth 2.0 authorization codes and access tokens are sent.

Graph reference: windowsApplication

Property	Type	Description
packageSid	String	The package security identifier that Microsoft has assigned the application. Optional. Read-only.
redirectUris	String collection	Specifies the URLs where user tokens are sent for sign-in or the redirect URIs where OAuth 2.0 authorization codes and access tokens are sent. Only available for applications that support the `PersonalMicrosoftAccount` **s

Table of Contents

HardDeletionSetting.ReadWrite.Enable

Graph Methods

Resources