$body = @ displayName = "CI/CD Automation App" signInAudience = "AzureADMyOrg" keyCredentials = @( @ type = "AsymmetricX509Cert" usage = "Verify" key = $base64Cert startDateTime = (Get-Date -Format "yyyy-MM-ddTHH:mm:ssZ") endDateTime = (Get-Date).AddYears(1).ToString("yyyy-MM-ddTHH:mm:ssZ")

But $expand on passwordCredentials or keyCredentials is . Avoid it unless necessary. Instead, fetch apps first (no expand), then batch request credentials:

But the endpoint supports , $filter , $select , and $top — which most people underutilize. Useful query patterns # Get an app by its client ID (not GUID id) GET /applications?$filter=appId eq '11111111-2222-3333-4444-555555555555' Get apps with secrets expiring in the next 30 days GET /applications?$expand=passwordCredentials&$filter=passwordCredentials/any(p:p/endDateTime le 2025-05-17T00:00:00Z) Only fetch specific fields (reduces latency) GET /applications?$select=displayName,appId,web,identifierUris 3. Hidden & Undocumented Behaviors api and web are mutually exclusive You cannot have a public client app ( web redirect URIs) that also exposes an API ( api scopes) in the same object—without causing odd validation failures. If you need both, split into two app registrations. signInAudience controls the universe Many developers leave this as "AzureADMyOrg" (single-tenant). But if you ever want to allow personal Microsoft accounts or other Azure AD tenants, change it to AzureADMultipleOrgs or AzureADandPersonalMicrosoftAccount .

Have you hit any weird edge cases with /applications ? Found an undocumented field? Let me know—I'm collecting them for a follow-up post.

GET /applications?$filter=signInAudience eq 'AzureADMultipleOrgs'&$expand=owners($top=1),requiredResourceAccess If the response has an empty owners list, any admin in any tenant could theoretically modify the app's consent permissions. That's a red flag for supply chain risk. The /v1.0/applications endpoint looks simple on the surface—just CRUD on app registrations. But its real power comes from understanding the expansion properties, credential types, and the subtle boundary between application and service principal.

| Feature | /v1.0 | /beta | |---------|---------|---------| | Federated identity credentials (workload identity federation) | ❌ | ✅ | | App role assignment conditions | ❌ | ✅ | | serviceManagementReference | ❌ | ✅ | | uniqueName (human-readable app identifier) | ❌ | ✅ |

"requests": [ "id": "1", "method": "GET", "url": "/applications/id/passwordCredentials" , "id": "2", "method": "GET", "url": "/applications/id/keyCredentials" ]