Https- - Graph.microsoft.com V1.0 Applications

GET /applications?$filter=signInAudience eq 'AzureADMultipleOrgs'&$expand=owners($top=1),requiredResourceAccess If the response has an empty owners list, any admin in any tenant could theoretically modify the app's consent permissions. That's a red flag for supply chain risk. The /v1.0/applications endpoint looks simple on the surface—just CRUD on app registrations. But its real power comes from understanding the expansion properties, credential types, and the subtle boundary between application and service principal.

But $expand on passwordCredentials or keyCredentials is . Avoid it unless necessary. Instead, fetch apps first (no expand), then batch request credentials: https- graph.microsoft.com v1.0 applications

This reduces throttling risk and improves predictability. The /v1.0 endpoint is stable and production-safe. But missing features: GET /applications

1. Over-privileged app roles via appRoles You can define custom roles in the appRoles array. The danger: any admin can assign users to those roles without extra approval if the app has been consented. Audit appRoles regularly. 2. Leaking identifierUris If your app uses identifierUris (e.g., api://my-app ), that URI becomes a potential token target. An attacker who can register a conflicting URI in another tenant cannot take over your app—but they can cause token validation confusion if your app incorrectly validates the aud claim. 3. requiredResourceAccess creep Apps can request requiredResourceAccess —permissions they need. Over time, developers add scopes but never remove old ones. Attackers can use orphaned, high-privilege permissions if an app's secret is compromised. But its real power comes from understanding the

$cert = New-SelfSignedCertificate -Subject "CN=Automation" -CertStoreLocation "Cert:\CurrentUser\My" -KeyExportPolicy Exportable -KeySpec KeyExchange -KeyLength 2048 -KeyAlgorithm RSA -HashAlgorithm SHA256 $base64Cert = [System.Convert]::ToBase64String($cert.RawData)

"requests": [ "id": "1", "method": "GET", "url": "/applications/id/passwordCredentials" , "id": "2", "method": "GET", "url": "/applications/id/keyCredentials" ]