> For the complete documentation index, see [llms.txt](https://docs.realmjoin.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.realmjoin.com/automation/runbooks/runbook-references/org/applications/add-application-registration.md).

# Add Application Registration

### Description

This runbook creates a new application registration in Microsoft Entra ID and optionally configures redirect URIs and SAML settings. It validates the submitted parameters, prevents duplicate app creation, and writes verbose logs for troubleshooting. Use it to standardize application registration setup, including visibility and assignment-related options.

### Location

Organization → Applications → Add Application Registration

**Full Runbook name**

rjgit-org\_applications\_add-application-registration

### Details

| Property         | Value                              |
| ---------------- | ---------------------------------- |
| Version          | 1.0.2                              |
| Required modules | RealmJoin.RunbookHelper (>= 0.8.9) |
| Schedulable      | no                                 |

### Permissions

#### Application permissions

* **Type**: Microsoft Graph
  * Application.ReadWrite.OwnedBy
    * *Creates the app and service principal, patches SAML settings and adds a token signing certificate*
  * Organization.Read.All
    * *Reads /organization to determine the tenant id reported alongside the new AppId*
  * Group.ReadWrite.All
    * *Creates the user-assignment group and assigns it to the app when UserAssignmentRequired is set*

#### RBAC roles

* Application Developer
  * *Backs creating and configuring the new app registration and service principal*

### Parameters

#### ApplicationName

The display name of the application registration to create.

| Property            | Value            |
| ------------------- | ---------------- |
| Required            | true             |
| Default Value       |                  |
| Type                | String           |
| Portal display name | Application Name |

#### RedirectURI

Used for UI selection only. Determines which redirect URI type to configure - None, Web, SPA, or Public Client

| Property            | Value                   |
| ------------------- | ----------------------- |
| Required            | false                   |
| Default Value       |                         |
| Type                | String                  |
| Portal display name | Redirect URI (Optional) |

**Portal options**

| Portal option                           | Value |
| --------------------------------------- | ----- |
| None                                    |       |
| Web                                     |       |
| SAML                                    |       |
| Public client/native (mobile & desktop) |       |
| Single-page application (SPA)           |       |

#### signInAudience

Specifies who can use the application. Defaults to "AzureADMyOrg" (single tenant).

| Property         | Value                                  |
| ---------------- | -------------------------------------- |
| Required         | false                                  |
| Default Value    | AzureADMyOrg                           |
| Type             | String                                 |
| Hidden in portal | yes (preset via runbook customization) |

#### webRedirectURI

Redirect URI or URIs for web applications. Multiple values can be separated by semicolons.

| Property            | Value                                                                             |
| ------------------- | --------------------------------------------------------------------------------- |
| Required            | false                                                                             |
| Default Value       |                                                                                   |
| Type                | String                                                                            |
| Portal display name | Web Redirect URI e.g. <https://myapp.com/auth> (semicolon-separated for multiple) |

#### spaRedirectURI

Redirect URI or URIs for single-page applications. Multiple values can be separated by semicolons.

| Property            | Value                                                                                                  |
| ------------------- | ------------------------------------------------------------------------------------------------------ |
| Required            | false                                                                                                  |
| Default Value       |                                                                                                        |
| Type                | String                                                                                                 |
| Portal display name | Single-page application (SPA) Redirect URI e.g. <https://myapp.com> (semicolon-separated for multiple) |

#### publicClientRedirectURI

Redirect URI or URIs for public client/native applications. Multiple values can be separated by semicolons.

| Property            | Value                                                                                   |
| ------------------- | --------------------------------------------------------------------------------------- |
| Required            | false                                                                                   |
| Default Value       |                                                                                         |
| Type                | String                                                                                  |
| Portal display name | Public client/native Redirect URI e.g. myapp\://auth (semicolon-separated for multiple) |

#### EnableSAML

If set to true, SAML-based authentication is configured for the application. If enabled, additional SAML-related parameters become required.

| Property      | Value   |
| ------------- | ------- |
| Required      | false   |
| Default Value | False   |
| Type          | Boolean |

#### SAMLReplyURL

The reply URL for SAML-based authentication

| Property      | Value  |
| ------------- | ------ |
| Required      | false  |
| Default Value |        |
| Type          | String |

#### SAMLSignOnURL

The sign-on URL for SAML authentication.

| Property      | Value  |
| ------------- | ------ |
| Required      | false  |
| Default Value |        |
| Type          | String |

#### SAMLLogoutURL

The logout URL for SAML authentication.

| Property      | Value  |
| ------------- | ------ |
| Required      | false  |
| Default Value |        |
| Type          | String |

#### SAMLIdentifier

The SAML identifier (Entity ID). If not specified, defaults to "urn:app:{AppId}".

| Property      | Value  |
| ------------- | ------ |
| Required      | false  |
| Default Value |        |
| Type          | String |

#### SAMLRelayState

The SAML relay state parameter for maintaining application state during authentication.

| Property      | Value  |
| ------------- | ------ |
| Required      | false  |
| Default Value |        |
| Type          | String |

#### SAMLExpiryNotificationEmail

Email address to receive notifications when the SAML token signing certificate is about to expire.

| Property      | Value  |
| ------------- | ------ |
| Required      | false  |
| Default Value |        |
| Type          | String |

#### SAMLCertificateLifeYears

Lifetime of the SAML token signing certificate in years. Default is 3 years.

| Property      | Value |
| ------------- | ----- |
| Required      | false |
| Default Value | 3     |
| Type          | Int32 |

#### isApplicationVisible

Determines whether the application is visible in the My Apps portal. Default is true.

| Property            | Value                                 |
| ------------------- | ------------------------------------- |
| Required            | false                                 |
| Default Value       | True                                  |
| Type                | Boolean                               |
| Portal display name | Application visible in My Apps portal |

#### UserAssignmentRequired

Determines whether users must be assigned to the application before accessing it. When enabled, an EntraID group is created for user assignment. Default is false.

| Property            | Value                    |
| ------------------- | ------------------------ |
| Required            | false                    |
| Default Value       | False                    |
| Type                | Boolean                  |
| Portal display name | User assignment required |

#### groupAssignmentPrefix

Prefix for the automatically created EntraID group when UserAssignmentRequired is enabled. Default is "col - Entra - users - ".

| Property            | Value                                                                  |
| ------------------- | ---------------------------------------------------------------------- |
| Required            | false                                                                  |
| Default Value       | col - Entra - users -                                                  |
| Type                | String                                                                 |
| Portal display name | Group assignment prefix (Only necessary when User assignment required) |

#### implicitGrantAccessTokens

Enable implicit grant flow for access tokens. Default is false.

| Property            | Value                                   |
| ------------------- | --------------------------------------- |
| Required            | false                                   |
| Default Value       | False                                   |
| Type                | Boolean                                 |
| Portal display name | Enable implicit grant for access tokens |

#### implicitGrantIDTokens

Enable implicit grant flow for ID tokens. Default is false.

| Property            | Value                               |
| ------------------- | ----------------------------------- |
| Required            | false                               |
| Default Value       | False                               |
| Type                | Boolean                             |
| Portal display name | Enable implicit grant for ID tokens |

[Back to Runbook Reference overview](/automation/runbooks/runbook-references.md)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.realmjoin.com/automation/runbooks/runbook-references/org/applications/add-application-registration.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.