Microsoft Entra Register Application With Service Principal

arazzo: 1.0.1
info:
  title: Microsoft Entra Register Application With Service Principal
  summary: Create an app registration then instantiate its service principal.
  description: >-
    Registers a new application object in Microsoft Entra ID and then creates
    the matching service principal in the tenant using the appId returned by
    the registration. This is the standard two-object pattern required before
    an application can sign in or be granted access: the application object is
    the global definition while the service principal is the local tenant
    instance. Every request is written inline so the chain reads end to end.
  version: 1.0.0
  x-realizes-capability-ids:
  - BC-620.20
  x-capability-derivation:
    method: 'deterministic join: sourceDescriptions -> per-tag OpenAPI -> tag/capability edge. No classification at this step.'
    min_confidence: 0.7
    sources:
    - capability_id: BC-620.20
      capability_name: Identity & Access Management
      spec: microsoft-entra-serviceprincipals-api-openapi.yml
      confidence: 0.88
    model: Turbo EA Capabilities by Vincent Verdet — Turbo EA, https://github.com/vincentmakes/turbo-ea-capabilities, CC BY 4.0
sourceDescriptions:
- name: applicationsApi
  url: ../openapi/microsoft-entra-applications-api-openapi.yml
  type: openapi
- name: serviceprincipalsApi
  url: ../openapi/microsoft-entra-serviceprincipals-api-openapi.yml
  type: openapi
workflows:
- workflowId: register-app-with-service-principal
  summary: Register an application, then create its service principal by appId.
  description: >-
    Creates an application registration and feeds the resulting appId into a
    service principal creation so the app is usable in the tenant.
  inputs:
    type: object
    required:
    - accessToken
    - displayName
    properties:
      accessToken:
        type: string
        description: OAuth 2.0 bearer token with Application.ReadWrite.All.
      displayName:
        type: string
        description: Display name for both the application and service principal.
      signInAudience:
        type: string
        description: Which Microsoft accounts the application supports.
        default: AzureADMyOrg
  steps:
  - stepId: createApplication
    description: Register the application object that defines the app globally.
    operationId: createApplication
    parameters:
    - name: Authorization
      in: header
      value: "Bearer $inputs.accessToken"
    requestBody:
      contentType: application/json
      payload:
        displayName: $inputs.displayName
        signInAudience: $inputs.signInAudience
    successCriteria:
    - condition: $statusCode == 201
    outputs:
      applicationId: $response.body#/id
      appId: $response.body#/appId
  - stepId: createServicePrincipal
    description: >-
      Create the service principal that instantiates the application in the
      tenant, referencing the appId from the registration.
    operationId: createServicePrincipal
    parameters:
    - name: Authorization
      in: header
      value: "Bearer $inputs.accessToken"
    requestBody:
      contentType: application/json
      payload:
        appId: $steps.createApplication.outputs.appId
    successCriteria:
    - condition: $statusCode == 201
    outputs:
      servicePrincipalId: $response.body#/id
      servicePrincipalAppId: $response.body#/appId
  outputs:
    applicationId: $steps.createApplication.outputs.applicationId
    appId: $steps.createApplication.outputs.appId
    servicePrincipalId: $steps.createServicePrincipal.outputs.servicePrincipalId