Add Application Registration

Add an application registration to Azure AD

Description

This runbook creates a new application registration in Microsoft Entra ID and optionally configures redirect URIs and SAML settings. It validates the submitted parameters, prevents duplicate app creation, and writes verbose logs for troubleshooting. Use it to standardize application registration setup, including visibility and assignment-related options.

Location

Organization → Applications → Add Application Registration

Full Runbook name

rjgit-org_applications_add-application-registration

Details

Property	Value
Version	1.0.2
Required modules	RealmJoin.RunbookHelper (>= 0.8.9)
Schedulable	no

Permissions

Application permissions

• Type: Microsoft Graph

  • Application.ReadWrite.OwnedBy

    • Creates the app and service principal, patches SAML settings and adds a token signing certificate
  • Organization.Read.All

    • Reads /organization to determine the tenant id reported alongside the new AppId
  • Group.ReadWrite.All

    • Creates the user-assignment group and assigns it to the app when UserAssignmentRequired is set

RBAC roles

• Application Developer

  • Backs creating and configuring the new app registration and service principal

Parameters

ApplicationName

The display name of the application registration to create.

Property	Value
Required	true
Default Value
Type	String
Portal display name	Application Name

RedirectURI

Used for UI selection only. Determines which redirect URI type to configure - None, Web, SPA, or Public Client

Property	Value
Required	false
Default Value
Type	String
Portal display name	Redirect URI (Optional)

Portal options

Portal option	Value
None
Web
SAML
Public client/native (mobile & desktop)
Single-page application (SPA)

signInAudience

Specifies who can use the application. Defaults to "AzureADMyOrg" (single tenant).

Property	Value
Required	false
Default Value	AzureADMyOrg
Type	String
Hidden in portal	yes (preset via runbook customization)

webRedirectURI

Redirect URI or URIs for web applications. Multiple values can be separated by semicolons.

Property	Value
Required	false
Default Value
Type	String
Portal display name	Web Redirect URI e.g. https://myapp.com/auth (semicolon-separated for multiple)

spaRedirectURI

Redirect URI or URIs for single-page applications. Multiple values can be separated by semicolons.

Property	Value
Required	false
Default Value
Type	String
Portal display name	Single-page application (SPA) Redirect URI e.g. https://myapp.com (semicolon-separated for multiple)

publicClientRedirectURI

Redirect URI or URIs for public client/native applications. Multiple values can be separated by semicolons.

Property	Value
Required	false
Default Value
Type	String
Portal display name	Public client/native Redirect URI e.g. myapp://auth (semicolon-separated for multiple)

EnableSAML

If set to true, SAML-based authentication is configured for the application. If enabled, additional SAML-related parameters become required.

Property	Value
Required	false
Default Value	False
Type	Boolean

SAMLReplyURL

The reply URL for SAML-based authentication

Property	Value
Required	false
Default Value
Type	String

SAMLSignOnURL

The sign-on URL for SAML authentication.

Property	Value
Required	false
Default Value
Type	String

SAMLLogoutURL

The logout URL for SAML authentication.

Property	Value
Required	false
Default Value
Type	String

SAMLIdentifier

The SAML identifier (Entity ID). If not specified, defaults to "urn:app:{AppId}".

Property	Value
Required	false
Default Value
Type	String

SAMLRelayState

The SAML relay state parameter for maintaining application state during authentication.

Property	Value
Required	false
Default Value
Type	String

SAMLExpiryNotificationEmail

Email address to receive notifications when the SAML token signing certificate is about to expire.

Property	Value
Required	false
Default Value
Type	String

SAMLCertificateLifeYears

Lifetime of the SAML token signing certificate in years. Default is 3 years.

Property	Value
Required	false
Default Value	3
Type	Int32

isApplicationVisible

Determines whether the application is visible in the My Apps portal. Default is true.

Property	Value
Required	false
Default Value	True
Type	Boolean
Portal display name	Application visible in My Apps portal

UserAssignmentRequired

Determines whether users must be assigned to the application before accessing it. When enabled, an EntraID group is created for user assignment. Default is false.

Property	Value
Required	false
Default Value	False
Type	Boolean
Portal display name	User assignment required

groupAssignmentPrefix

Prefix for the automatically created EntraID group when UserAssignmentRequired is enabled. Default is "col - Entra - users - ".

Property	Value
Required	false
Default Value	col - Entra - users -
Type	String
Portal display name	Group assignment prefix (Only necessary when User assignment required)

implicitGrantAccessTokens

Enable implicit grant flow for access tokens. Default is false.

Property	Value
Required	false
Default Value	False
Type	Boolean
Portal display name	Enable implicit grant for access tokens

implicitGrantIDTokens

Enable implicit grant flow for ID tokens. Default is false.

Property	Value
Required	false
Default Value	False
Type	Boolean
Portal display name	Enable implicit grant for ID tokens

Back to Runbook Reference overview