Get-MgApplicationAssignment

SYNOPSIS

Retrieves all Entra ID applications and their assignment types.

SYNTAX

All (Default)

Get-MgApplicationAssignment [-AllApplications] [-AssignmentNotEnforced] [-AssignmentEmpty]
 [-ExportToExcel] [-ExportPath <string>] [-DisableParallel] [-ThrottleLimit <int>]
 [-UseBatchRequest]

ByApplicationId

Get-MgApplicationAssignment [[-ApplicationId] <string[]>] [-AssignmentNotEnforced]
 [-AssignmentEmpty] [-ExportToExcel] [-ExportPath <string>] [-DisableParallel]
 [-ThrottleLimit <int>] [-UseBatchRequest]

ByObjectId

Get-MgApplicationAssignment [-ObjectID <string>] [-AssignmentNotEnforced] [-AssignmentEmpty]
 [-ExportToExcel] [-ExportPath <string>] [-DisableParallel] [-ThrottleLimit <int>]
 [-UseBatchRequest]

ByDisplayName

Get-MgApplicationAssignment [-DisplayName <string>] [-AssignmentNotEnforced] [-AssignmentEmpty]
 [-ExportToExcel] [-ExportPath <string>] [-DisableParallel] [-ThrottleLimit <int>]
 [-UseBatchRequest]

DESCRIPTION

This function returns a list of all Entra ID applications with their assignment information, identifying whether they are assigned to all users or have specific assignments. If no assignments exist, it indicates whether the application is available to “all users”. Give information about assigned users, groups, or service principals and if the group is protected/static/dynamic.

EXAMPLES

EXAMPLE 1

Get-MgApplicationAssignment

Retrieves all applications and their assignment types.

EXAMPLE 2

Get-MgApplicationAssignment -UseBatchRequest

Uses the Graph JSON $batch endpoint to retrieve the app role assignments (20 requests per HTTP call, automatic 429 retry).

EXAMPLE 3

Get-MgApplicationAssignment -DisableParallel

Forces sequential processing even on PowerShell 7+ (useful for debugging or to avoid concurrent Graph calls).

EXAMPLE 4

Get-MgApplicationAssignment -ApplicationId "xxx", "yyy"

Retrieves assignment types for the specified application IDs.

EXAMPLE 5

Get-MgApplicationAssignment -ObjectID '11111111-2222-3333-4444-555555555555'

Retrieves assignment types for the service principal matching this ObjectID.

EXAMPLE 6

Get-MgApplicationAssignment -DisplayName 'My SAML App'

Retrieves assignment types for the service principal matching this DisplayName.

EXAMPLE 7

Get-MgApplicationAssignment -AssignmentEmpty

Retrieves only applications with no specific user/group/service principal assignments.

EXAMPLE 8

Get-MgApplicationAssignment -ExportToExcel

Gets all applications and exports them to an Excel file

PARAMETERS

-AllApplications

(Optional) If specified, retrieves all service principals regardless of type. By default, only Enterprise Applications (tagged ‘WindowsAzureActiveDirectoryIntegratedApp’) are returned.

Type: System.Management.Automation.SwitchParameter
DefaultValue: False
SupportsWildcards: false
Aliases: []
ParameterSets:
- Name: All
  Position: Named
  IsRequired: false
  ValueFromPipeline: false
  ValueFromPipelineByPropertyName: false
  ValueFromRemainingArguments: false
DontShow: false
AcceptedValues: []
HelpMessage: ''

-ApplicationId

(Optional) One or more Application IDs (AppId) to filter the results. If not provided, all applications will be processed.

Type: System.String[]
DefaultValue: ''
SupportsWildcards: false
Aliases: []
ParameterSets:
- Name: ByApplicationId
  Position: 0
  IsRequired: false
  ValueFromPipeline: false
  ValueFromPipelineByPropertyName: false
  ValueFromRemainingArguments: false
DontShow: false
AcceptedValues: []
HelpMessage: ''

-AssignmentEmpty

(Optional) If specified, only applications with no specific user/group/service principal assignments will be returned. Note: these apps may still be accessible to all users if AppRoleAssignmentRequired is $false.

Type: System.Management.Automation.SwitchParameter
DefaultValue: False
SupportsWildcards: false
Aliases: []
ParameterSets:
- Name: (All)
  Position: Named
  IsRequired: false
  ValueFromPipeline: false
  ValueFromPipelineByPropertyName: false
  ValueFromRemainingArguments: false
DontShow: false
AcceptedValues: []
HelpMessage: ''

-AssignmentNotEnforced

(Optional) If specified, only applications where AppRoleAssignmentRequired is $false (open to all users, no assignment needed) will be returned.

Type: System.Management.Automation.SwitchParameter
DefaultValue: False
SupportsWildcards: false
Aliases: []
ParameterSets:
- Name: (All)
  Position: Named
  IsRequired: false
  ValueFromPipeline: false
  ValueFromPipelineByPropertyName: false
  ValueFromRemainingArguments: false
DontShow: false
AcceptedValues: []
HelpMessage: ''

-DisableParallel

(Optional) Forces sequential processing. By default, on PowerShell 7+ the function analyzes applications in parallel (ForEach-Object -Parallel) to speed up processing; on PowerShell 5.1 it always runs sequentially.

Type: System.Management.Automation.SwitchParameter
DefaultValue: False
SupportsWildcards: false
Aliases: []
ParameterSets:
- Name: (All)
  Position: Named
  IsRequired: false
  ValueFromPipeline: false
  ValueFromPipelineByPropertyName: false
  ValueFromRemainingArguments: false
DontShow: false
AcceptedValues: []
HelpMessage: ''

-DisplayName

(Optional) Display name of a single service principal to target (exact match, with fallback on trimmed comparison). Cannot be combined with -ApplicationId or -ObjectID.

Type: System.String
DefaultValue: ''
SupportsWildcards: false
Aliases: []
ParameterSets:
- Name: ByDisplayName
  Position: Named
  IsRequired: false
  ValueFromPipeline: false
  ValueFromPipelineByPropertyName: false
  ValueFromRemainingArguments: false
DontShow: false
AcceptedValues: []
HelpMessage: ''

-ExportPath

Optional output directory for the Excel export (defaults to the user profile).

Type: System.String
DefaultValue: ''
SupportsWildcards: false
Aliases: []
ParameterSets:
- Name: (All)
  Position: Named
  IsRequired: false
  ValueFromPipeline: false
  ValueFromPipelineByPropertyName: false
  ValueFromRemainingArguments: false
DontShow: false
AcceptedValues: []
HelpMessage: ''

-ExportToExcel

(Optional) If specified, exports the results to an Excel file in the user’s profile directory.

Type: System.Management.Automation.SwitchParameter
DefaultValue: False
SupportsWildcards: false
Aliases: []
ParameterSets:
- Name: (All)
  Position: Named
  IsRequired: false
  ValueFromPipeline: false
  ValueFromPipelineByPropertyName: false
  ValueFromRemainingArguments: false
DontShow: false
AcceptedValues: []
HelpMessage: ''

-ObjectID

(Optional) ObjectID (GUID) of a single service principal to target. Cannot be combined with -ApplicationId or -DisplayName.

Type: System.String
DefaultValue: ''
SupportsWildcards: false
Aliases:
- Identity
ParameterSets:
- Name: ByObjectId
  Position: Named
  IsRequired: false
  ValueFromPipeline: false
  ValueFromPipelineByPropertyName: false
  ValueFromRemainingArguments: false
DontShow: false
AcceptedValues: []
HelpMessage: ''

-ThrottleLimit

(Optional) Maximum number of concurrent runspaces when running in parallel. Default is 5. Keep this value moderate to avoid Microsoft Graph throttling (HTTP 429).

Type: System.Int32
DefaultValue: 5
SupportsWildcards: false
Aliases: []
ParameterSets:
- Name: (All)
  Position: Named
  IsRequired: false
  ValueFromPipeline: false
  ValueFromPipelineByPropertyName: false
  ValueFromRemainingArguments: false
DontShow: false
AcceptedValues: []
HelpMessage: ''

-UseBatchRequest

(Optional) Uses the Microsoft Graph JSON $batch endpoint (via Invoke-MgGraphBatchRequest, 20 requests per HTTP call with automatic HTTP 429 retry) to retrieve the app role assignments, instead of ForEach-Object -Parallel. Requires the PS365 module (Invoke-MgGraphBatchRequest); when the command is not available (e.g. script deployed standalone), the function warns and falls back to the default behavior. Note: the per-principal lookups (user, group, service principal details) are still performed individually.

Type: System.Management.Automation.SwitchParameter
DefaultValue: False
SupportsWildcards: false
Aliases: []
ParameterSets:
- Name: (All)
  Position: Named
  IsRequired: false
  ValueFromPipeline: false
  ValueFromPipelineByPropertyName: false
  ValueFromRemainingArguments: false
DontShow: false
AcceptedValues: []
HelpMessage: ''

CommonParameters

This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutBuffer, -OutVariable, -PipelineVariable, -ProgressAction, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.

INPUTS

OUTPUTS

NOTES

https://ps365.clidsys.com/docs/commands/Get-MgApplicationAssignment

​SYNOPSIS

​SYNTAX

​All (Default)

​ByApplicationId

​ByObjectId

​ByDisplayName

​DESCRIPTION

​EXAMPLES

​EXAMPLE 1

​EXAMPLE 2

​EXAMPLE 3

​EXAMPLE 4

​EXAMPLE 5

​EXAMPLE 6

​EXAMPLE 7

​EXAMPLE 8

​PARAMETERS

​-AllApplications

​-ApplicationId

​-AssignmentEmpty

​-AssignmentNotEnforced

​-DisableParallel

​-DisplayName

​-ExportPath

​-ExportToExcel

​-ObjectID

​-ThrottleLimit

​-UseBatchRequest

​CommonParameters

​INPUTS

​OUTPUTS

​NOTES

​RELATED LINKS