azurekqlazure-ad-graph-apimicrosoft-entra-id

Query Azure Resource Graph and get a list of all the application registration that contains "test"


I have to list for a PowerBI dashboard all of the application registrations that contains "test" in the name and the owner of it by using KQL and Azure Resource Graph query. It tried different flavors from the documentation and look something like this, but without success:

aadApplications
| project ApplicationId = appId, DisplayName, CreatedTime = createdDateTime
| join kind=leftouter (
    AadApplicationOwners
    | project ApplicationId = appId, Owner = userPrincipalName
) on ApplicationId
| summarize Owners = make_set(Owner), AppRoles = make_set(appRoleDisplayNames) by ApplicationId, DisplayName, CreatedTime
| project ApplicationID, Owners = tostring(Owners), DisplayName, AppRoles = tostring(AppRoles), CreatedTime

Solution

  • Note that: AAD applications are objects within Azure Active Directory service and are not Azure Resources. Refer this blog by AdamMarczakIO.

    Hence, alternatively you can make use of PowerShell or CLI or Rest API to query the Azure Active Directory applications.

    To list the applications contains "test" and the owners of the applications with the details, make use of below PowerShell script:

    Connect-MgGraph
    
    # Fetch applications containing "test" in their name
    $applications = Get-MgApplication | Where-Object { $_.DisplayName -like "*test*" }
    
    $tableData = @()
    foreach ($app in $applications) {
        
        $owners = Get-MgApplicationOwner -ApplicationId $app.Id -ErrorAction SilentlyContinue
    
        $ownerId = if ($owners) { $owners.Id } else { "" }
        $ownerName = if ($owners) { $owners.DisplayName } else { "" }
    
        $tableData += [PSCustomObject]@{
            "Application ID" = $app.Id
            "Application Name" = $app.DisplayName
            "Owner ID" = $ownerId
            "AppRoles" = $app.AppRoles
            "Created Time" = $app.CreatedDateTime
        }
    }
    
    $tableData | Format-Table -AutoSize "Application ID", "Application Name", "Owner ID", "AppRoles", "Created Time"
    

    enter image description here

    Output:

    Application ID Application Name Owner ID AppRoles Created Time   
    XXX              Test             XXX      XXX     XXXX