Solution GetDirectoryServicePrincipal

Directory Enterprise Apps (Service Principals) report

Solution Code: GetDirectoryServicePrincipal

Description

This report lists the Enterprise Applications (service principals) in your Entra ID tenant, including their sign-on configuration, credentials, owners and granted permissions.

Column Title	Description
Id	Service principal object ID
DisplayName	Name of the enterprise application
AppId	Application (client) ID
ServicePrincipalType	Application, ManagedIdentity, Legacy, etc.
AppOwnerOrganizationId	Tenant ID that owns the underlying app
AppOwnerOrganization	Internal / Microsoft / Third Party
PublisherName	Verified publisher display name
ApplicationAudience	Single tenant / Multitenant / Personal, etc.
CreatedDateTime	When the service principal was created
OwnersTotal	Number of owners
Owners	Owner UPNs (or display names)
SamlSso	Whether SAML single sign-on is configured
ExposesApi	Whether the app exposes OAuth2 permission scopes
ReplyUrls	Configured reply/redirect URLs
HasWildcardReplyUrl	Whether any reply URL contains a wildcard
SecretCount / SecretsValid / SecretExpired / SecretExpiresIn30Days	Client-secret credential counts
CertCount / CertsValid / CertExpired / CertExpiresIn30Days	Certificate credential counts
AssignmentRequired	Whether user assignment is required to access the app
GrantedDelegatedPermissions	Delegated (OAuth2) grants: [Admin/User] Resource (scopes)
GrantedApplicationPermissions	Application role grants: Resource (role)
Remarks	Remarks/errors captured while building the row

Requirements

API	Delegated	Application
Microsoft Graph	Application.Read.All Directory.Read.All	Application.Read.All
RBAC	Global Reader*	NA

Global Reader, Application Administrator or Cloud Application Administrator.

Parameters

This Solution has no parameters.

How this Solution works

1. Retrieves all service principals in the tenant.
2. For each one, retrieves its owners, delegated (OAuth2) permission grants and application role assignments, resolving each resource/role to a readable name.
3. Records one row per service principal.

Notes

Resource applications and roles are cached during the run so repeated look-ups of the same resource (e.g. Microsoft Graph) are only fetched once.