AADApplication¶

Parameters¶

Parameter	Attribute	DataType	Description	Allowed Values
DisplayName	Key	String	DisplayName of the app
ObjectId	Write	String	ObjectID of the app.
AppId	Write	String	AppId for the app.
AvailableToOtherTenants	Write	Boolean	Indicates whether this application is available in other tenants.
Description	Write	String	A free text field to provide a description of the application object to end users. The maximum allowed size is 1024 characters.
GroupMembershipClaims	Write	String	A bitmask that configures the groups claim issued in a user or OAuth 2.0 access token that the application expects.
Homepage	Write	String	The URL to the application's homepage.
IdentifierUris	Write	StringArray[]	User-defined URI(s) that uniquely identify a Web application within its Azure AD tenant, or within a verified custom domain.
IsFallbackPublicClient	Write	Boolean	Specifies the fallback application type as public client, such as an installed application running on a mobile device. The default value is false, which means the fallback application type is confidential client such as web app. There are certain scenarios where Microsoft Entra ID cannot determine the client application type (for example, ROPC flow where it is configured without specifying a redirect URI). In those cases, Microsoft Entra ID will interpret the application type based on the value of this property.
KnownClientApplications	Write	StringArray[]	Client applications that are tied to this resource application.
OptionalClaims	Write	MSFT_MicrosoftGraphoptionalClaims	Application developers can configure optional claims in their Microsoft Entra applications to specify the claims that are sent to their application by the Microsoft security token service. For more information, see How to: Provide optional claims to your app.
Api	Write	MSFT_MicrosoftGraphapiApplication	Specifies settings for an application that implements a web API.
AuthenticationBehaviors	Write	MSFT_MicrosoftGraphauthenticationBehaviors	The collection of breaking change behaviors related to token issuance that are configured for the application. Authentication behaviors are unset by default (null) and must be explicitly enabled or disabled. Nullable. Returned only on $select. For more information about authentication behaviors, see Manage application authenticationBehaviors to avoid unverified use of email claims for user identification or authorization.
PasswordCredentials	Write	MSFT_MicrosoftGraphpasswordCredential[]	The collection of password credentials associated with the application. Not nullable.
KeyCredentials	Write	MSFT_MicrosoftGraphkeyCredential[]	The collection of key credentials associated with the application. Not nullable. Supports $filter (eq, not, ge, le).
AppRoles	Write	MSFT_MicrosoftGraphappRole[]	The collection of roles defined for the application. With app role assignments, these roles can be assigned to users, groups, or service principals associated with other applications. Not nullable.
LogoutURL	Write	String	The logout url for this application.
PublicClient	Write	Boolean	Specifies whether this application is a public client (such as an installed application running on a mobile device). Default is false.
ReplyURLs	Write	StringArray[]	Specifies the URLs that user tokens are sent to for sign in, or the redirect URIs that OAuth 2.0 authorization codes and access tokens are sent to.
Owners	Write	StringArray[]	UPN or ObjectID values of the app's owners.
OnPremisesPublishing	Write	MSFT_AADApplicationOnPremisesPublishing	Represents the set of properties required for configuring Application Proxy for this application. Configuring these properties allows you to publish your on-premises application for secure remote access.
ApplicationTemplateId	Write	String	Identifier of the associated Application Template.
Ensure	Write	String	Specify if the Azure AD App should exist or not.	`Present`, `Absent`
Credential	Write	PSCredential	Credentials for the Microsoft Graph delegated permissions.
ApplicationId	Write	String	Id of the Azure Active Directory application to authenticate with.
ApplicationSecret	Write	PSCredential	Secret of the Azure Active Directory application to authenticate with.
TenantId	Write	String	Id of the Azure Active Directory tenant used for authentication.
Permissions	Write	MSFT_AADApplicationPermission[]	API permissions for the Azure Active Directory Application.
CertificateThumbprint	Write	String	Thumbprint of the Azure Active Directory application's authentication certificate to use for authentication.
ManagedIdentity	Write	Boolean	Managed ID being used for authentication.
AccessTokens	Write	StringArray[]	Access token used for authentication.

MSFT_AADApplicationOnPremisesPublishingSegmentCORS¶

Parameters¶

Parameter	Attribute	DataType	Description
allowedHeaders	Write	StringArray[]	The request headers that the origin domain may specify on the CORS request. The wildcard character * indicates that any header beginning with the specified prefix is allowed.
maxAgeInSeconds	Write	UInt32	The maximum amount of time that a browser should cache the response to the preflight OPTIONS request.
resource	Write	String	Resource within the application segment for which CORS permissions are granted. / grants permission for whole app segment.
allowedMethods	Write	StringArray[]	The HTTP request methods that the origin domain may use for a CORS request.
allowedOrigins	Write	StringArray[]	The origin domains that are permitted to make a request against the service via CORS. The origin domain is the domain from which the request originates. The origin must be an exact case-sensitive match with the origin that the user age sends to the service.

MSFT_AADApplicationOnPremisesPublishingSegment¶

Parameters¶

Parameter	Attribute	DataType	Description
alternateUrl	Write	String	If you're configuring a traffic manager in front of multiple App Proxy application segments, contains the user-friendly URL that will point to the traffic manager.
corsConfigurations	Write	MSFT_AADApplicationOnPremisesPublishingSegmentCORS[]	CORS Rule definition for a particular application segment.
externalUrl	Write	String	The published external URL for the application segment; for example, https://intranet.contoso.com./
internalUrl	Write	String	The internal URL of the application segment; for example, https://intranet/.

MSFT_AADApplicationOnPremisesPublishingSingleSignOnSettingKerberos¶

Parameters¶

Parameter	Attribute	DataType	Description	Allowed Values
kerberosServicePrincipalName	Write	String	The Internal Application SPN of the application server. This SPN needs to be in the list of services to which the connector can present delegated credentials.
kerberosSignOnMappingAttributeType	Write	String	The Delegated Login Identity for the connector to use on behalf of your users. For more information, see Working with different on-premises and cloud identities . Possible values are: userPrincipalName, onPremisesUserPrincipalName, userPrincipalUsername, onPremisesUserPrincipalUsername, onPremisesSAMAccountName.

MSFT_AADApplicationOnPremisesPublishingSingleSignOnSetting¶

Parameters¶

Parameter	Attribute	DataType	Description	Allowed Values
singleSignOnMode	Write	String	The preferred single-sign on mode for the application. Possible values are: none, onPremisesKerberos, aadHeaderBased,pingHeaderBased, oAuthToken.
kerberosSignOnSettings	Write	MSFT_AADApplicationOnPremisesPublishingSingleSignOnSettingKerberos	The Kerberos Constrained Delegation settings for applications that use Integrated Window Authentication.

MSFT_AADApplicationOnPremisesPublishing¶

Parameters¶

Parameter	Attribute	DataType	Description
alternateUrl	Write	String	If you're configuring a traffic manager in front of multiple App Proxy applications, the alternateUrl is the user-friendly URL that points to the traffic manager.
applicationServerTimeout	Write	String	The duration the connector waits for a response from the backend application before closing the connection. Possible values are default, long.
externalAuthenticationType	Write	String	Details the pre-authentication setting for the application. Pre-authentication enforces that users must authenticate before accessing the app. Pass through doesn't require authentication. Possible values are: passthru, aadPreAuthentication.
externalUrl	Write	String	The published external url for the application. For example, https://intranet-contoso.msappproxy.net/.
internalUrl	Write	String	The internal url of the application. For example, https://intranet/.
isBackendCertificateValidationEnabled	Write	Boolean	Indicates whether backend SSL certificate validation is enabled for the application. For all new Application Proxy apps, the property is set to true by default. For all existing apps, the property is set to false.
isHttpOnlyCookieEnabled	Write	Boolean	Indicates if the HTTPOnly cookie flag should be set in the HTTP response headers. Set this value to true to have Application Proxy cookies include the HTTPOnly flag in the HTTP response headers. If using Remote Desktop Services, set this value to False. Default value is false.
isPersistentCookieEnabled	Write	Boolean	Indicates if the Persistent cookie flag should be set in the HTTP response headers. Keep this value set to false. Only use this setting for applications that can't share cookies between processes. For more information about cookie settings, see Cookie settings for accessing on-premises applications in Microsoft Entra ID. Default value is false.
isSecureCookieEnabled	Write	Boolean	Indicates if the Secure cookie flag should be set in the HTTP response headers. Set this value to true to transmit cookies over a secure channel such as an encrypted HTTPS request. Default value is true.
isStateSessionEnabled	Write	Boolean	Indicates whether validation of the state parameter when the client uses the OAuth 2.0 authorization code grant flow is enabled. This setting allows admins to specify whether they want to enable CSRF protection for their apps.
isTranslateHostHeaderEnabled	Write	Boolean	Indicates if the application should translate urls in the response headers. Keep this value as true unless your application required the original host header in the authentication request. Default value is true.
isTranslateLinksInBodyEnabled	Write	Boolean	Indicates if the application should translate urls in the application body. Keep this value as false unless you have hardcoded HTML links to other on-premises applications and don't use custom domains. For more information, see Link translation with Application Proxy. Default value is false.
onPremisesApplicationSegments	Write	MSFT_AADApplicationOnPremisesPublishingSegment[]	Represents the collection of application segments for an on-premises wildcard application that's published through Microsoft Entra application proxy.
singleSignOnSettings	Write	MSFT_AADApplicationOnPremisesPublishingSingleSignOnSetting	Represents the single sign-on configuration for the on-premises application.

MSFT_AADApplicationPermission¶

Parameters¶

Parameter	Attribute	DataType	Description	Allowed Values
Name	Write	String	Name of the requested permission.
SourceAPI	Write	String	Name of the API from which the permission comes from.
Type	Write	String	Type of permission.	`AppOnly`, `Delegated`
AdminConsentGranted	Write	Boolean	Represented whether or not the Admin consent been granted on the app.

MSFT_MicrosoftGraphOptionalClaims¶

Parameters¶

Parameter	Attribute	DataType	Description
AccessToken	Write	MSFT_MicrosoftGraphOptionalClaim[]	The optional claims returned in the JWT access token.
IdToken	Write	MSFT_MicrosoftGraphOptionalClaim[]	The optional claims returned in the JWT ID token.
Saml2Token	Write	MSFT_MicrosoftGraphOptionalClaim[]	The optional claims returned in the SAML token.

MSFT_MicrosoftGraphOptionalClaim¶

Parameters¶

Parameter	Attribute	DataType	Description
Essential	Write	Boolean	If the value is true, the claim specified by the client is necessary to ensure a smooth authorization experience for the specific task requested by the end user. The default value is false.
Name	Write	String	The name of the optional claim.
Source	Write	String	The source (directory object) of the claim. There are predefined claims and user-defined claims from extension properties. If the source value is null, the claim is a predefined optional claim. If the source value is user, the value in the name property is the extension property from the user object.

MSFT_MicrosoftGraphPreAuthorizedApplication¶

Parameters¶

Parameter	Attribute	DataType	Description	Allowed Values
AppId	Write	String	The unique identifier for the client application.
PermissionIds	Write	StringArray[]	The unique identifier for the scopes the client application is granted.

MSFT_MicrosoftGraphApiOauth2PermissionScopes¶

Parameters¶

Parameter	Attribute	DataType	Description
adminConsentDescription	Write	String	A description of the delegated permissions, intended to be read by an administrator granting the permission on behalf of all users. This text appears in tenant-wide admin consent experiences.
adminConsentDisplayName	Write	String	The permission's title, intended to be read by an administrator granting the permission on behalf of all users.
userConsentDescription	Write	String	A description of the delegated permissions, intended to be read by a user granting the permission on their own behalf. This text appears in consent experiences where the user is consenting only on behalf of themselves.
userConsentDisplayName	Write	String	A title for the permission, intended to be read by a user granting the permission on their own behalf. This text appears in consent experiences where the user is consenting only on behalf of themselves.
value	Write	String	Specifies the value to include in the scp (scope) claim in access tokens. Must not exceed 120 characters in length.
isEnabled	Write	Boolean	When you create or update a permission, this property must be set to true (which is the default). To delete a permission, this property must first be set to false. At that point, in a subsequent call, the permission may be removed.
type	Write	String	The possible values are: User and Admin. Specifies whether this delegated permission should be considered safe for non-admin users to consent to on behalf of themselves, or whether an administrator consent should always be required.
id	Write	String	Unique delegated permission identifier inside the collection of delegated permissions defined for a resource application.

MSFT_MicrosoftGraphApiApplication¶

Parameters¶

Parameter	Attribute	DataType	Description	Allowed Values
PreAuthorizedApplications	Write	MSFT_MicrosoftGraphPreAuthorizedApplication[]	Lists the client applications that are preauthorized with the specified delegated permissions to access this application's APIs. Users aren't required to consent to any preauthorized application (for the permissions specified). However, any other permissions not listed in preAuthorizedApplications (requested through incremental consent for example) will require user consent.
Oauth2PermissionScopes	Write	MSFT_MicrosoftGraphAPIOauth2PermissionScopes[]	List of associated API scopes.

MSFT_MicrosoftGraphAuthenticationBehaviors¶

Parameters¶

Parameter	Attribute	DataType	Description
BlockAzureADGraphAccess	Write	Boolean	If false, allows the app to have extended access to Azure AD Graph until June 30, 2025 when Azure AD Graph is fully retired. For more information on Azure AD retirement updates, see June 2024 update on Azure AD Graph API retirement.
RemoveUnverifiedEmailClaim	Write	Boolean	If true, removes the email claim from tokens sent to an application when the email address's domain can't be verified.
RequireClientServicePrincipal	Write	Boolean	If true, requires multitenant applications to have a service principal in the resource tenant as part of authorization checks before they're granted access tokens. This property is only modifiable for multitenant resource applications that rely on access from clients without a service principal and had this behavior as set to false by Microsoft. Tenant administrators should respond to security advisories sent through Azure Health Service events and the Microsoft 365 message center.

MSFT_MicrosoftGraphKeyCredential¶

Parameters¶

Parameter	Attribute	DataType	Description
CustomKeyIdentifier	Write	String	A 40-character binary type that can be used to identify the credential. Optional. When not provided in the payload, defaults to the thumbprint of the certificate.
DisplayName	Write	String	Friendly name for the key. Optional.
EndDateTime	Write	String	The date and time at which the credential expires. The DateTimeOffset type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z.
KeyId	Write	String	The unique identifier (GUID) for the key.
Key	Write	String	The certificate's raw data in byte array converted to Base64 string.
StartDateTime	Write	String	The date and time at which the credential becomes valid.The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z.
Type	Write	String	The type of key credential for example, Symmetric, AsymmetricX509Cert.
Usage	Write	String	A string that describes the purpose for which the key can be used for example, Verify.

MSFT_MicrosoftGraphPasswordCredential¶

Parameters¶

Parameter	Attribute	DataType	Description
DisplayName	Write	String	Friendly name for the password. Optional.
EndDateTime	Write	String	The date and time at which the password expires represented using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z. Optional.
Hint	Write	String	Contains the first three characters of the password. Read-only.
KeyId	Write	String	The unique identifier for the password.
StartDateTime	Write	String	The date and time at which the password becomes valid. The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 is 2014-01-01T00:00:00Z. Optional.

MSFT_MicrosoftGraphAppRole¶

Parameters¶

Parameter	Attribute	DataType	Description
AllowedMemberTypes	Write	StringArray[]	Specifies whether this app role can be assigned to users and groups (by setting to 'User'), to other application's (by setting to 'Application', or both (by setting to 'User', 'Application'). App roles supporting assignment to other applications' service principals are also known as application permissions. The 'Application' value is only supported for app roles defined on application entities.
Description	Write	String	The description for the app role. This is displayed when the app role is being assigned and, if the app role functions as an application permission, during consent experiences.
DisplayName	Write	String	Display name for the permission that appears in the app role assignment and consent experiences.
Id	Write	String	Unique role identifier inside the appRoles collection. When creating a new app role, a new GUID identifier must be provided.
IsEnabled	Write	Boolean	When creating or updating an app role, this must be set to true (which is the default). To delete a role, this must first be set to false. At that point, in a subsequent call, this role may be removed.
Origin	Write	String	Specifies if the app role is defined on the application object or on the servicePrincipal entity. Must not be included in any POST or PATCH requests. Read-only.
Value	Write	String	Specifies the value to include in the roles claim in ID tokens and access tokens authenticating an assigned user or service principal. Must not exceed 120 characters in length. Allowed characters are : ! # $ % & ' ( ) * + , - . / : = + _ } , and characters in the ranges 0-9, A-Z and a-z. Any other character, including the space character, aren't allowed. May not begin with ..

Description¶

This resource configures an Azure Active Directory Application.

Permissions¶

Microsoft Graph¶

To authenticate with the Microsoft Graph API, this resource required the following permissions:

Delegated permissions¶

Read
- Application.Read.All
Update
- Application.Read.All, Application.ReadWrite.All, User.Read.All

Application permissions¶

Read
- Application.Read.All
Update
- Application.Read.All, Application.ReadWrite.All, User.Read.All

Examples¶

Example 1¶

This example is used to test new resources and showcase the usage of new resources being worked on. It is not meant to use as a production baseline.

Configuration Example
{
    param(
        [Parameter()]
        [System.String]
        $ApplicationId,

        [Parameter()]
        [System.String]
        $TenantId,

        [Parameter()]
        [System.String]
        $CertificateThumbprint
    )
    Import-DscResource -ModuleName Microsoft365DSC
    node localhost
    {
        AADApplication 'AADApp1'
        {
            DisplayName               = "AppDisplayName"
            AvailableToOtherTenants   = $false
            Description               = "Application Description"
            GroupMembershipClaims     = "None"
            Homepage                  = "https://$TenantId"
            IdentifierUris            = "https://$TenantId"
            KnownClientApplications   = ""
            LogoutURL                 = "https://$TenantId/logout"
            PublicClient              = $false
            ReplyURLs                 = "https://$TenantId"
            Permissions               = @(
                MSFT_AADApplicationPermission
                {
                    Name                = 'User.Read'
                    Type                = 'Delegated'
                    SourceAPI           = 'Microsoft Graph'
                    AdminConsentGranted = $false
                }
                MSFT_AADApplicationPermission
                {
                    Name                = 'User.ReadWrite.All'
                    Type                = 'Delegated'
                    SourceAPI           = 'Microsoft Graph'
                    AdminConsentGranted = $True
                }
                MSFT_AADApplicationPermission
                {
                    Name                = 'User.Read.All'
                    Type                = 'AppOnly'
                    SourceAPI           = 'Microsoft Graph'
                    AdminConsentGranted = $True
                }
            )
            Ensure                    = "Present"
            ApplicationId         = $ApplicationId
            TenantId              = $TenantId
            CertificateThumbprint = $CertificateThumbprint
        }
    }
}

Example 2¶

This example is used to test new resources and showcase the usage of new resources being worked on. It is not meant to use as a production baseline.

Configuration Example
{
    param(
        [Parameter()]
        [System.String]
        $ApplicationId,

        [Parameter()]
        [System.String]
        $TenantId,

        [Parameter()]
        [System.String]
        $CertificateThumbprint
    )
    Import-DscResource -ModuleName Microsoft365DSC

    node localhost
    {
        AADApplication 'AADApp1'
        {
            DisplayName               = "AppDisplayName"
            AvailableToOtherTenants   = $true # Updated Property
            Description               = "Application Description"
            GroupMembershipClaims     = "None"
            Homepage                  = "https://$TenantId"
            IdentifierUris            = "https://$TenantId"
            KnownClientApplications   = ""
            LogoutURL                 = "https://$TenantId/logout"
            PublicClient              = $false
            ReplyURLs                 = "https://$TenantId"
            Permissions               = @(
                MSFT_AADApplicationPermission
                {
                    Name                = 'User.Read'
                    Type                = 'Delegated'
                    SourceAPI           = 'Microsoft Graph'
                    AdminConsentGranted = $false
                }
                MSFT_AADApplicationPermission
                {
                    Name                = 'User.ReadWrite.All'
                    Type                = 'Delegated'
                    SourceAPI           = 'Microsoft Graph'
                    AdminConsentGranted = $True
                }
                MSFT_AADApplicationPermission
                {
                    Name                = 'User.Read.All'
                    Type                = 'AppOnly'
                    SourceAPI           = 'Microsoft Graph'
                    AdminConsentGranted = $True
                }
            )
            Ensure                    = "Present"
            ApplicationId         = $ApplicationId
            TenantId              = $TenantId
            CertificateThumbprint = $CertificateThumbprint
        }
    }
}

Example 3¶

This example is used to test new resources and showcase the usage of new resources being worked on. It is not meant to use as a production baseline.

Configuration Example
{
    param(
        [Parameter()]
        [System.String]
        $ApplicationId,

        [Parameter()]
        [System.String]
        $TenantId,

        [Parameter()]
        [System.String]
        $CertificateThumbprint
    )
    Import-DscResource -ModuleName Microsoft365DSC

    node localhost
    {
        AADApplication 'AADApp1'
        {
            DisplayName               = "AppDisplayName"
            Ensure                    = "Absent"
            ApplicationId         = $ApplicationId
            TenantId              = $TenantId
            CertificateThumbprint = $CertificateThumbprint
        }
    }
}