Microsoft Entra ID (formerly Azure AD)

Microsoft Entra ID (formerly Azure AD) Service Principals.service Principal.Actions API

The servicePrincipals.servicePrincipal.Actions API from Microsoft Entra ID (formerly Azure AD) — 13 operation(s) for serviceprincipals.serviceprincipal.actions.

GitHub OpenAPI
Business capability
Identity & Access Management BC-620.20

Operations 13

Each operation below carries the questions people ask an LLM about it and the instructions they give an agent to run it. Generated by API Evangelist overlay

POST /servicePrincipals/{servicePrincipal-id}/microsoft.graph.addKey Add a key credential to a service principal · Invoke action addKey #
Ask an LLM
“How do I roll an expiring certificate key on a service principal?”
“Do I need a proof-of-possession token to add a new key to a service principal?”
Tell an agent
Add key credential {key_credential} to service principal {service_principal} with proof {proof}.
Add a new certificate key to service principal {service_principal}.
POST /servicePrincipals/{servicePrincipal-id}/microsoft.graph.addPassword Add a client secret to a service principal · Invoke action addPassword #
Ask an LLM
“Can I generate a new client secret for a service principal?”
“What does the API return when I add a password to a service principal?”
Tell an agent
Add a new password {password_credential} to service principal {service_principal}.
Generate a strong client secret for service principal {service_principal}.
POST /servicePrincipals/{servicePrincipal-id}/microsoft.graph.addTokenSigningCertificate Create a token signing certificate for a service principal · Invoke action addTokenSigningCertificate #
Ask an LLM
“How do I create a self-signed SAML token signing certificate for an enterprise app?”
“Can I choose the display name and expiry date of a service principal's signing certificate?”
Tell an agent
Create a token signing certificate named {display_name} for service principal {service_principal}, expiring {end_date}.
Generate a self-signed signing certificate for service principal {service_principal}.
POST /servicePrincipals/{servicePrincipal-id}/microsoft.graph.checkMemberGroups Check a service principal's membership in given groups · Invoke action checkMemberGroups #
Ask an LLM
“Is a service principal a member of any of these specific groups?”
“Can I check a list of group IDs against a service principal's memberships in one call?”
Tell an agent
Check which of groups {group_ids} service principal {service_principal} belongs to.
Tell me if service principal {service_principal} is in group list {group_ids}.
POST /servicePrincipals/{servicePrincipal-id}/microsoft.graph.checkMemberObjects Check a service principal's membership in given objects · Invoke action checkMemberObjects #
Ask an LLM
“Can I test whether a service principal is a member of specific groups, roles or administrative units?”
“Which of a list of directory object IDs does a service principal belong to?”
Tell an agent
Check which of objects {ids} service principal {service_principal} is a member of.
Test service principal {service_principal} membership against roles and units {ids}.
POST /servicePrincipals/{servicePrincipal-id}/microsoft.graph.getMemberGroups Get all groups a service principal belongs to · Invoke action getMemberGroups #
Ask an LLM
“Which groups is a service principal a member of, including nested ones?”
“Can I restrict a service principal's group memberships to security groups only?”
Tell an agent
Get every group ID service principal {service_principal} belongs to.
List group memberships for service principal {service_principal}, security groups only: {security_only}.
POST /servicePrincipals/{servicePrincipal-id}/microsoft.graph.getMemberObjects Get all groups, roles and units a service principal is in · Invoke action getMemberObjects #
Ask an LLM
“What groups, administrative units and directory roles does a service principal belong to?”
“Can I get every membership object ID for a service principal, not just groups?”
Tell an agent
Get all group, role and administrative unit IDs for service principal {service_principal}.
List every membership object of service principal {service_principal} with securityEnabledOnly {security_only}.
POST /servicePrincipals/{servicePrincipal-id}/microsoft.graph.removeKey Remove a key credential from a service principal · Invoke action removeKey #
Ask an LLM
“How do I retire an old certificate key from a service principal?”
“What proof do I need to remove a key credential from a service principal?”
Tell an agent destructive · confirm first
Remove key {key_id} from service principal {service_principal} using proof {proof}.
Delete the expiring certificate key {key_id} on service principal {service_principal}.
POST /servicePrincipals/{servicePrincipal-id}/microsoft.graph.removePassword Remove a client secret from a service principal · Invoke action removePassword #
Ask an LLM
“Can I revoke a client secret that was added to a service principal?”
“Which ID do I pass to delete a password from a service principal?”
Tell an agent destructive · confirm first
Remove password {key_id} from service principal {service_principal}.
Revoke the client secret {key_id} on service principal {service_principal}.
POST /servicePrincipals/{servicePrincipal-id}/microsoft.graph.restore Restore a deleted service principal · Invoke action restore #
Ask an LLM
“Can I bring back a service principal that was recently deleted?”
“How long do I have to restore a deleted enterprise app from deleted items?”
Tell an agent
Restore deleted service principal {service_principal}.
Recover service principal {service_principal} from deleted items.
POST /servicePrincipals/microsoft.graph.getAvailableExtensionProperties List directory extension properties available · Invoke action getAvailableExtensionProperties #
Ask an LLM
“What directory extension attributes are registered in my tenant, including from multitenant apps?”
“Can I see only the extension properties synced from on-premises?”
Tell an agent
List all directory extension properties available in the tenant.
Show available extension properties where synced from on-premises is {synced}.
POST /servicePrincipals/microsoft.graph.getByIds Look up directory objects by a list of IDs · Invoke action getByIds #
Ask an LLM
“Can I resolve a batch of object IDs to users, groups and service principals in one request?”
“Is it possible to limit an ID lookup to certain object types?”
Tell an agent
Look up the directory objects with IDs {ids}.
Resolve IDs {ids} to objects of types {types}.
POST /servicePrincipals/microsoft.graph.validateProperties Check a group name against naming policy · Invoke action validateProperties #
Ask an LLM
“Will a Microsoft 365 group display name pass my tenant's naming policy before I create it?”
“Can I check whether a mail nickname contains blocked words?”
Tell an agent
Validate display name {display_name} and mail nickname {mail_nickname} for a {entity_type}.
Check group name {display_name} against naming policy on behalf of user {user}.

Documentation

📖
Documentation
https://learn.microsoft.com/en-us/graph/api/overview
📖
Authentication
https://learn.microsoft.com/en-us/graph/auth/
📖
Documentation
https://learn.microsoft.com/en-us/graph/change-notifications-overview

Specifications

⚙
OpenAPI
https://raw.githubusercontent.com/api-evangelist/azure-ad/refs/heads/main/openapi/azure-ad-serviceprincipals-serviceprincipal-actions-api-openapi.yml

Other Resources

🔗
SDKs
https://learn.microsoft.com/en-us/graph/sdks/sdks-overview
🔗
ChangeLog
https://developer.microsoft.com/en-us/graph/changelog
🔗
Webhooks
https://raw.githubusercontent.com/api-evangelist/azure-ad/refs/heads/main/asyncapi/azure-ad-change-notifications-webhooks.yml

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this
  • find_apisBrowse and filter every API in the catalog.
  • get_api_artifactsOne API's artifacts, grouped by type.
  • get_openapiThe primary OpenAPI for this API.
  • find_similar_apisAPIs that look like this one.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This API 
curl "https://apis.io/api/v1/apis/azure-ad:azure-ad-serviceprincipals-serviceprincipal-actions-api"
All apis 
curl "https://apis.io/api/v1/apis?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

azure-ad-serviceprincipals-serviceprincipal-actions-api-openapi.yml Raw ↑ 
openapi: 3.2.0
info:
  title: Applications Service Principals.service Principal.Actions…
  version: v1.0
servers:
- url: https://graph.microsoft.com/v1.0/
  description: Core
security:
- azureaadv2: []
tags:


# --- truncated at 32 KB (36 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/azure-ad/refs/heads/main/openapi/azure-ad-serviceprincipals-serviceprincipal-actions-api-openapi.yml