Applications - Https- Graph.microsoft.com V1.0

"appId": "<the appId from above>"

| Limit | Value | |-------|-------| | Requests per 10 seconds per app | 2,000 | | Requests per 10 seconds per tenant | 5,000 | | Max $top | 999 |

The endpoint https://graph.microsoft.com/v1.0/applications is the programmatic backbone of application identity management in Entra ID (formerly Azure AD). It’s powerful, subtle, and—if you’re not careful—dangerous.

$cert = New-SelfSignedCertificate -Subject "CN=Automation" -CertStoreLocation "Cert:\CurrentUser\My" -KeyExportPolicy Exportable -KeySpec KeyExchange -KeyLength 2048 -KeyAlgorithm RSA -HashAlgorithm SHA256 $base64Cert = [System.Convert]::ToBase64String($cert.RawData) https- graph.microsoft.com v1.0 applications

But $expand on passwordCredentials or keyCredentials is . Avoid it unless necessary. Instead, fetch apps first (no expand), then batch request credentials:

| Feature | /v1.0 | /beta | |---------|---------|---------| | Federated identity credentials (workload identity federation) | ❌ | ✅ | | App role assignment conditions | ❌ | ✅ | | serviceManagementReference | ❌ | ✅ | | uniqueName (human-readable app identifier) | ❌ | ✅ |

In this post, we’ll tear down the endpoint, explore its hidden properties, look at real-world automation patterns, and cover the security pitfalls that even seasoned admins miss. Before writing code, we need to clear up a massive source of confusion. "appId": "&lt;the appId from above&gt;" | Limit |

| Entity | Endpoint | Tenant scope | Analogy | |--------|----------|--------------|---------| | Application | /v1.0/applications | Home tenant only | Blueprint | | Service Principal | /v1.0/servicePrincipals | One per tenant | Built house |

Whether you're automating app lifecycle, building an internal governance tool, or hunting for security misconfigurations, this endpoint is your scalpel. Use it with precision, respect its throttling limits, and always—always—validate the signInAudience before you deploy.

But that’s not the same as a ( /servicePrincipals ), which is the instance of that app in a specific tenant. Avoid it unless necessary

"requests": [ "id": "1", "method": "GET", "url": "/applications/id/passwordCredentials" , "id": "2", "method": "GET", "url": "/applications/id/keyCredentials" ]

This reduces throttling risk and improves predictability. The /v1.0 endpoint is stable and production-safe. But missing features: