Microsoft Entra ID (formerly Azure AD)

Microsoft Entra ID (formerly Azure AD) Applications.application.Actions API

The applications.application.Actions API from Microsoft Entra ID (formerly Azure AD) — 14 operation(s) for applications.application.actions.

GitHub OpenAPI
Business capability
Identity & Access Management BC-620.20

Operations 14

Each operation below carries the questions people ask an LLM about it and the instructions they give an agent to run it. Generated by API Evangelist overlay

POST /applications/{application-id}/microsoft.graph.addKey Add a certificate key credential to an app · Invoke action addKey #
Ask an LLM
“How do I roll an expiring certificate on an app registration automatically?”
“Can I add a new key credential to an app with a signed proof of possession?”
Tell an agent
Add key credential {key} to application {app_id} using proof {proof}.
Upload a new certificate key to app registration {app_id}.
POST /applications/{application-id}/microsoft.graph.addPassword Add a client secret to an app · Invoke action addPassword #
Ask an LLM
“How do I generate a new client secret for my app registration?”
“Can I give a new application password a display name and end date?”
Tell an agent
Create a new client secret on application {app_id}.
Add password credential {password} to app {app_id}.
POST /applications/{application-id}/microsoft.graph.checkMemberGroups Check an app's membership in given groups · Invoke action checkMemberGroups #
Ask an LLM
“Which of a list of groups does an application object belong to?”
“Can I test an app registration against specific group IDs?”
Tell an agent
Check whether application {app_id} is in any of the groups {group_ids}.
Tell me which of {group_ids} contain app {app_id}.
POST /applications/{application-id}/microsoft.graph.checkMemberObjects Check an app against directory object IDs · Invoke action checkMemberObjects #
Ask an LLM
“Is an app a member of certain groups, admin units or roles by ID?”
“Can I check an application's memberships against a mixed list of object IDs?”
Tell an agent
Check application {app_id} for membership in objects {ids}.
Run checkMemberObjects for app registration {app_id}.
POST /applications/{application-id}/microsoft.graph.getMemberGroups List all groups an app belongs to · Invoke action getMemberGroups #
Ask an LLM
“What groups is an app registration a member of?”
“Can I return only the security groups an application is in?”
Tell an agent
Get every group ID that application {app_id} belongs to.
List groups for app {app_id} with security-enabled only {security_only}.
POST /applications/{application-id}/microsoft.graph.getMemberObjects List groups, admin units and roles of an app · Invoke action getMemberObjects #
Ask an LLM
“Which groups, administrative units and directory roles include this application?”
“Can I get an app's full membership list, not just groups?”
Tell an agent
Get member objects of application {app_id}, including admin units and roles.
List all memberships of app {app_id} with security-enabled only {security_only}.
POST /applications/{application-id}/microsoft.graph.removeKey Remove a certificate key credential from an app · Invoke action removeKey #
Ask an LLM
“How do I retire an old certificate from an app registration after rolling it?”
“Does removing an app key need a proof-of-possession token?”
Tell an agent destructive · confirm first
Remove key {key_id} from application {app_id} with proof {proof}.
Delete the certificate credential {key_id} on app {app_id}.
POST /applications/{application-id}/microsoft.graph.removePassword Remove a client secret from an app · Invoke action removePassword #
Ask an LLM
“How do I revoke a leaked client secret on my app registration?”
“Can I delete one application password by its key ID?”
Tell an agent destructive · confirm first
Remove client secret {key_id} from application {app_id}.
Revoke password credential {key_id} on app {app_id}.
POST /applications/{application-id}/microsoft.graph.restore Restore a deleted app registration · Invoke action restore #
Ask an LLM
“How do I bring back an app registration someone deleted?”
“Can I undelete an application by its object ID?”
Tell an agent
Restore application {app_id} from deleted items.
Undelete app registration {app_id}.
POST /applications/{application-id}/microsoft.graph.setVerifiedPublisher Set the verified publisher on an app · Invoke action setVerifiedPublisher #
Ask an LLM
“How do I get the blue verified badge on my app's consent prompt?”
“Can I link my app registration to a Partner Center publisher ID?”
Tell an agent
Set verified publisher {publisher_id} on application {app_id}.
Mark app {app_id} as published by verified publisher {publisher_id}.
POST /applications/{application-id}/microsoft.graph.unsetVerifiedPublisher Remove the verified publisher from an app · Invoke action unsetVerifiedPublisher #
Ask an LLM
“How do I take the verified publisher off an app registration?”
“What happens to the publisher properties when I unset verification on an app?”
Tell an agent destructive · confirm first
Unset the verified publisher on application {app_id}.
Clear all verified publisher properties from app {app_id}.
POST /applications/microsoft.graph.getAvailableExtensionProperties List registered directory extension properties · Invoke action getAvailableExtensionProperties #
Ask an LLM
“What directory extension attributes are registered in my tenant, including by multitenant apps?”
“Can I list only the extension properties synced from on-premises?”
Tell an agent
List all available directory extension properties.
Get extension definitions where synced from on-premises is {synced}.
POST /applications/microsoft.graph.getByIds Fetch directory objects by a list of IDs · Invoke action getByIds #
Ask an LLM
“How can I resolve a batch of object IDs to apps, users or groups in one request?”
“Can I restrict an ID lookup to application objects only?”
Tell an agent
Look up the directory objects with IDs {ids}.
Resolve IDs {ids} returning only types {types}.
POST /applications/microsoft.graph.validateProperties Check a group name against naming policy · Invoke action validateProperties #
Ask an LLM
“Will a Microsoft 365 group display name pass my tenant's naming policy?”
“Can I check a mail nickname for blocked words before creating the group?”
Tell an agent
Validate display name {display_name} and mail nickname {nickname}.
Check {display_name} against naming policy on behalf of user {user_id}.

Documentation

📖
Documentation
https://learn.microsoft.com/en-us/graph/api/overview
📖
Authentication
https://learn.microsoft.com/en-us/graph/auth/
📖
Documentation
https://learn.microsoft.com/en-us/graph/change-notifications-overview

Specifications

⚙
OpenAPI
https://raw.githubusercontent.com/api-evangelist/azure-ad/refs/heads/main/openapi/azure-ad-applications-application-actions-api-openapi.yml

Other Resources

🔗
SDKs
https://learn.microsoft.com/en-us/graph/sdks/sdks-overview
🔗
ChangeLog
https://developer.microsoft.com/en-us/graph/changelog
🔗
Webhooks
https://raw.githubusercontent.com/api-evangelist/azure-ad/refs/heads/main/asyncapi/azure-ad-change-notifications-webhooks.yml

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this
  • find_apisBrowse and filter every API in the catalog.
  • get_api_artifactsOne API's artifacts, grouped by type.
  • get_openapiThe primary OpenAPI for this API.
  • find_similar_apisAPIs that look like this one.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This API 
curl "https://apis.io/api/v1/apis/azure-ad:azure-ad-applications-application-actions-api"
All apis 
curl "https://apis.io/api/v1/apis?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

azure-ad-applications-application-actions-api-openapi.yml Raw ↑ 
openapi: 3.2.0
info:
  title: Applications.application.Actions API
  version: v1.0
servers:
- url: https://graph.microsoft.com/v1.0/
  description: Core
security:
- azureaadv2: []
tags:


# --- truncated at 32 KB (33 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/azure-ad/refs/heads/main/openapi/azure-ad-applications-application-actions-api-openapi.yml