> For the complete documentation index, see [llms.txt](https://docs.realmjoin.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.realmjoin.com/automation/runbooks/runbook-references/org/applications/add-gsa-application-registration.md). # Add Gsa Application Registration ### Description This script creates a new Global Secure Access Application registration in Azure Active Directory (Entra ID) with comprehensive configuration options. In addition to the application, a security group for managing access to the application is created (naming scheme configurable via Runbook Customization) and assigned to the application's service principal. If the application already exists, the runbook runs in update mode: app creation is skipped and only the segment / group / assignment steps are performed. All lookups (e.g. connector group) are validated BEFORE anything is created. If a later step fails anyway, objects created in this run (application, group) are rolled back and removed. Pre-existing objects (update mode) are never removed. ### Location Organization → Applications → Add GSA Application Registration **Full Runbook name** rjgit-org\_applications\_add-GSA-application-registration ### Details | Property | Value | | ---------------- | --------------------------------------------------------------------------------------- | | Version | 1.3.3 | | Required modules |

RealmJoin.RunbookHelper (>= 0.8.9)
Microsoft.Graph.Authentication (>= 2.39.0)

| | Schedulable | no | ### Permissions #### Application permissions * **Type**: Microsoft Graph * Application.ReadWrite.All * *Instantiates the app from the application template, patches onPremisesPublishing and adds app segments* * Directory.ReadWrite.All * *Required by the App Proxy endpoints: reads connector groups and assigns the app's connectorGroup* * Group.ReadWrite.All * *Creates the access security group for the app and deletes it on rollback* * AppRoleAssignment.ReadWrite.All * *Assigns the access group to the app via /servicePrincipals/{id}/appRoleAssignedTo* ### Parameters #### name The base name of the Global Secure Access application to create. The final application name is built as " ". | Property | Value | | ------------------- | --------------------------------- | | Required | true | | Default Value | | | Type | String | | Portal display name | Application Name (Must be unique) | #### prefix Prefix added to the application name. A space is inserted between prefix and name unless the prefix ends with "-", "\_" or a space. Example: prefix "GSA-" + name "MyApp" results in application "GSA-MyApp". | Property | Value | | ------------------- | ----------------------- | | Required | true | | Default Value | | | Type | String | | Portal display name | Application Name Prefix | #### groupPrefix Prefix for the security group name. The group name is built as "" - independent of the application prefix. Example: groupPrefix "App - Entra - GSA - " + name "MyApp" results in group "App - Entra - GSA - MyApp". Default: "App - Entra - GSA - ". | Property | Value | | ------------------- | ------------------------------------------------------------------- | | Required | false | | Default Value | App - Entra - GSA - | | Type | String | | Portal display name | Group name prefix (admin-defined, change via Runbook Customization) | #### groupSuffix Optional suffix for the security group name, e.g. " (users)". Default: empty. | Property | Value | | ---------------- | -------------------------------------- | | Required | false | | Default Value | | | Type | String | | Hidden in portal | yes (preset via runbook customization) | #### applicationType The type of GSA application to create. Options: "nonwebapp" (Enterprise App) or "quickaccessapp" (Quick Access App). | Property | Value | | ------------------- | ------------------------- | | Required | true | | Default Value | | | Type | String | | Portal display name | Application Type (Unique) | **Portal options** | Portal option | Value | | ---------------- | ----- | | Enterprise App | | | Quick Access App | | #### connectorGroup The connectorGroup to be used for the application. Must be defined in the Runbook Customization. | Property | Value | | ------------------- | ---------------------------------------------------------------------------------- | | Required | false | | Default Value | | | Type | String | | Portal display name | Connector Group (Please define your connector groups in the Runbook Customization) | #### destinationHost The destination host or IP range for the application. Supports formats: FQDN (example.com), single IP (192.168.0.1), CIDR notation (192.168.0.1/24), or IP range (192.168.0.1..192.168.0.20). | Property | Value | | ------------------- | ------------------------------------------------------------------------------------------------- | | Required | false | | Default Value | | | Type | String | | Portal display name | Destination Host or Range: example.com / 192.168.0.1 / 192.168.0.1/24 / 192.168.0.1..192.168.0.20 | #### destinationType The type of destination specified. Options: "fqdn", "ip", "ipRangeCidr", or "ipRange". Hidden in UI as it's automatically determined from destinationHost format. | Property | Value | | ---------------- | -------------------------------------- | | Required | false | | Default Value | | | Type | String | | Hidden in portal | yes (preset via runbook customization) | #### ports The port(s) to configure for the application. Supports single port (443), multiple ports (80,443), or port range (8000-8080). | Property | Value | | ------------------- | ---------------------------------------- | | Required | false | | Default Value | | | Type | String | | Portal display name | Ports (e.g., 443 or 80,443 or 8000-8080) | #### protocol The network protocol to use. Options: "tcp", "udp", or "tcp,udp". Default is "tcp". | Property | Value | | ------------------- | -------- | | Required | false | | Default Value | | | Type | String | | Portal display name | Protocol | **Portal options** | Portal option | Value | | ------------- | ----- | | TCP | | | UDP | | | TCP,UDP | | [Back to Runbook Reference overview](/automation/runbooks/runbook-references.md) --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.realmjoin.com/automation/runbooks/runbook-references/org/applications/add-gsa-application-registration.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.