Microsoft Graph Applications

Use the Microsoft Graph Applications integration to manage authorized application. This integration was integrated and tested with version v1.0 of Microsoft Graph Services API.

Configure MicrosoftGraphServices on Cortex XSOAR#

  1. Navigate to Settings > Integrations > Servers & Services.

  2. Search for MicrosoftGraphServices.

  3. Click Add instance to create and configure a new integration instance.

    Application IDTrue
    Trust any certificate (not secure)False
    Use system proxy settingsFalse
  4. Click Test to validate the URLs, token, and connection.


You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook. After you successfully execute a command, a DBot message appears in the War Room with the command details.


Run this command to start the authorization process and follow the instructions in the command results.


Run this command to complete the authorization process. Should be used after running the msgraph-apps-auth-start command.


Run this command if for some reason you need to rerun the authentication process.


Tests connectivity to Microsoft.


Retrieves a list of applications.

Base Command#



Argument NameDescriptionRequired
limitMaximum results to fetch. A value of 0 fetches all results. Default is 10.Optional

Context Output#

MSGraphApplication.keyCredentials.keyIdStringThe unique identifier (GUID) for the key.
MSGraphApplication.keyCredentials.customKeyIdentifierStringCustom key identifier.
MSGraphApplication.keyCredentials.displayNameStringFriendly name for the key. Optional.
MSGraphApplication.keyCredentials.typeStringThe type of key credential; for example, “Symmetric”.
MSGraphApplication.keyCredentials.keyStringThe certificate's raw data in byte array converted to Base64 string.
MSGraphApplication.keyCredentials.usageStringA string that describes the purpose for which the key can be used; for example, “Verify”.
MSGraphApplication.keyCredentials.startDateTimeDateThe date and time at which the credential expires.The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 would look like this: '2014-01-01T00:00:00Z'
MSGraphApplication.keyCredentials.endDateTimeDateThe date and time at which the credential becomes valid.The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. For example, midnight UTC on Jan 1, 2014 would look like this: '2014-01-01T00:00:00Z'
MSGraphApplication.accountEnabledBooleantrue if the application account is enabled; otherwise, false.
MSGraphApplication.appDescriptionStringA brief description of the application.
MSGraphApplication.appDisplayNameStringThe display name exposed by the associated application.
MSGraphApplication.appIdStringThe unique identifier for the associated application (its appId property).
MSGraphApplication.appOwnerOrganizationIdStringContains the tenant ID where the application is registered. This is applicable only to service principals backed by applications.
MSGraphApplication.appRoleAssignmentRequiredBooleanWhether users or other service principals need to be granted an application role assignment for this service principal before users can sign in or apps can get tokens. Default is false.
MSGraphApplication.applicationTemplateIdStringUnique identifier of the application template that the service principal was created from.
MSGraphApplication.createdDateTimeDateTime the application was created.
MSGraphApplication.deletedDateTimeDateTime the application was deleted.
MSGraphApplication.descriptionStringA brief description of the application.
MSGraphApplication.displayNameStringThe display name for the application.
MSGraphApplication.homepageStringHome page or landing page of the application.
MSGraphApplication.idStringThe unique identifier for the application. delivery network (CDN) URL to the application's logo. to the application's marketing page. to the application's privacy statement. to the application's support page. to the application's terms of service statement.
MSGraphApplication.loginUrlStringThe URL where the service provider redirects the user to Azure AD to authenticate. Azure AD uses the URL to launch the application from Microsoft 365 or the Azure AD My Apps.
MSGraphApplication.logoutUrlStringSpecifies the URL that will be used by Microsoft's authorization service to log out an user.
MSGraphApplication.notesStringThe application's notes.
MSGraphApplication.oauth2PermissionScopes.adminConsentDescriptionStringA description of the delegated permissions, intended to be read by an administrator granting the permission on behalf of all users. This text appears in tenant-wide admin consent experiences.
MSGraphApplication.oauth2PermissionScopes.adminConsentDisplayNameStringThe permission's title, intended to be read by an administrator granting the permission on behalf of all users.
MSGraphApplication.oauth2PermissionScopes.idStringUnique delegated permission identifier inside the collection of delegated permissions defined for a resource application.
MSGraphApplication.oauth2PermissionScopes.isEnabledBooleanWhether OAuth 2.0 permission scopes are enabled.
MSGraphApplication.oauth2PermissionScopes.typeStringWhether this delegated permission should be considered safe for non-admin users to consent to on behalf of themselves, or whether an administrator should be required for consent to the permissions.
MSGraphApplication.oauth2PermissionScopes.userConsentDescriptionStringA description of the delegated permissions, intended to be read by a user granting the permission on their own behalf. This text appears in consent experiences where the user is consenting only on behalf of themselves.
MSGraphApplication.oauth2PermissionScopes.userConsentDisplayNameStringA title for the permission.
MSGraphApplication.oauth2PermissionScopes.valueStringThe value to include in the scope claim in access tokens.
MSGraphApplication.preferredSingleSignOnModeStringThe single sign-on mode configured for this application. Azure AD uses the preferred single sign-on mode to launch the application from Microsoft 365 or the Azure AD My Apps. The supported values are password, SAML, external, and OIDC.
MSGraphApplication.preferredTokenSigningKeyThumbprintStringThumbprint of preferred certificate to sign the token.
MSGraphApplication.replyUrlsStringThe URLs that user tokens are sent to for signing in with the associated application, or the redirect URIs that OAuth 2.0 authorization codes and access tokens are sent to for the associated application.
MSGraphApplication.samlSingleSignOnSettingsStringThe collection for settings related to SAML single sign-on.
MSGraphApplication.servicePrincipalNamesStringThe list of identifier URIs.
MSGraphApplication.servicePrincipalTypeStringIdentifies if the service principal represents an application or a managed identity.
MSGraphApplication.signInAudienceStringThe audience that can sign in.
MSGraphApplication.tokenEncryptionKeyIdStringThe key ID of a public key from the key credentials.
MSGraphApplication.verifiedPublisher.addedDateTimeDateThe timestamp when the verified publisher was first added or most recently updated.
MSGraphApplication.verifiedPublisher.displayNameStringThe verified publisher name from the application publisher's Partner Center account.
MSGraphApplication.verifiedPublisher.verifiedPublisherIdStringThe ID of the verified publisher from the application publisher's Partner Center account.

Command Example#

!msgraph-apps-service-principal-list limit=1

Context Example#

"MSGraphApplication": {
"accountEnabled": true,
"addIns": [],
"alternativeNames": [],
"appDescription": null,
"appDisplayName": "Common Data Service",
"appId": "00000007-0000-0000-c000-000000000000",
"appOwnerOrganizationId": ":app-owner-organization-id:",
"appRoleAssignmentRequired": false,
"appRoles": [],
"applicationTemplateId": null,
"createdDateTime": "2019-12-11T11:35:03Z",
"deletedDateTime": null,
"description": null,
"displayName": "Common Data Service",
"homepage": null,
"id": ":id:",
"info": {
"logoUrl": null,
"marketingUrl": null,
"privacyStatementUrl": null,
"supportUrl": null,
"termsOfServiceUrl": null
"keyCredentials": [],
"loginUrl": null,
"logoutUrl": null,
"notes": null,
"notificationEmailAddresses": [],
"oauth2PermissionScopes": [
"adminConsentDescription": "Allows the application to access Common Data Service acting as users in the organization.",
"adminConsentDisplayName": "Access Common Data Service as organization users",
"id": ":id:",
"isEnabled": true,
"type": "User",
"userConsentDescription": "Allows the application to access Common Data Service as you.",
"userConsentDisplayName": "Access Common Data Service as you",
"value": "user_impersonation"
"passwordCredentials": [],
"preferredSingleSignOnMode": null,
"preferredTokenSigningKeyThumbprint": null,
"replyUrls": [
"resourceSpecificApplicationPermissions": [],
"samlSingleSignOnSettings": null,
"servicePrincipalNames": [
"servicePrincipalType": "Application",
"signInAudience": "AzureADMultipleOrgs",
"tags": [],
"tokenEncryptionKeyId": null,
"verifiedPublisher": {
"addedDateTime": null,
"displayName": null,
"verifiedPublisherId": null

Human Readable Output#

Available services (applications):#

🆔00000007-0000-0000-c000-000000000000Common Data Servicetrue


Removes an application from the directory.

Base Command#



Argument NameDescriptionRequired
idThe ID of the service to remove. Can be retrieved via the msgraph-apps-service-principal-remove command.Required

Context Output#

There is no context output for this command.

Command Example#

!msgraph-apps-service-principal-remove id=4d77f5f1-ec0b-482c-a4ae-1df6a50f19c2

Human Readable Output#

Service 4d77f5f1-ec0b-482c-a4ae-1df6a50f19c2 was deleted.