Get-MgApplicationSAML

SYNOPSIS

Retrieves all Entra ID applications configured for SAML SSO.

SYNTAX

All (Default)

Get-MgApplicationSAML [-ForceNewToken] [-ExportToExcel] [-ExportPath <string>]
 [-RunFromAzureAutomation] [-ExpirationThresholdDays <int>] [-NotificationRecipient <string>]
 [-NotificationSender <string>] [-IncludeSignInStats] [-DisableParallel] [-ThrottleLimit <int>]
 [-UseBatchRequest]

ByObjectId

Get-MgApplicationSAML [-ObjectID <string>] [-ForceNewToken] [-ExportToExcel] [-ExportPath <string>]
 [-RunFromAzureAutomation] [-ExpirationThresholdDays <int>] [-NotificationRecipient <string>]
 [-NotificationSender <string>] [-IncludeSignInStats] [-DisableParallel] [-ThrottleLimit <int>]
 [-UseBatchRequest]

ByDisplayName

Get-MgApplicationSAML [-DisplayName <string>] [-ForceNewToken] [-ExportToExcel]
 [-ExportPath <string>] [-RunFromAzureAutomation] [-ExpirationThresholdDays <int>]
 [-NotificationRecipient <string>] [-NotificationSender <string>] [-IncludeSignInStats]
 [-DisableParallel] [-ThrottleLimit <int>] [-UseBatchRequest]

DESCRIPTION

This function returns a list of all Entra ID applications configured for SAML Single Sign-On along with their SAML-related properties. Each row represents one SAML signing certificate (KeyCredential with Usage ‘Sign’), so an application with multiple certificates will appear on multiple rows. The SamlSigningCertificateIsPreferred column identifies the currently active certificate:

True : this is the active signing certificate
False : this certificate exists on the application but is not currently active

EXAMPLES

EXAMPLE 1

Get-MgApplicationSAML

Retrieves all Entra ID applications configured for SAML SSO.

EXAMPLE 2

Get-MgApplicationSAML -UseBatchRequest

Uses the Graph JSON $batch endpoint to retrieve the application owners (20 requests per HTTP call, automatic 429 retry).

EXAMPLE 3

Get-MgApplicationSAML -DisableParallel

Forces sequential processing even on PowerShell 7+ (useful for debugging or to avoid concurrent Graph calls).

EXAMPLE 4

Get-MgApplicationSAML -IncludeSignInStats

Retrieves all Entra ID applications configured for SAML SSO with sign-in statistics for the last 30 days.

EXAMPLE 5

Get-MgApplicationSAML -ObjectID "xxx-xxx-xxx"

Retrieves the SAML configuration for a specific application by its ObjectID.

EXAMPLE 6

Get-MgApplicationSAML -DisplayName "My SAML App"

Retrieves the SAML configuration for a specific application by its DisplayName.

EXAMPLE 7

Get-MgApplicationSAML -DisplayName "Azure*"

Retrieves the SAML configuration for all applications whose DisplayName starts with “Azure”.

EXAMPLE 8

Get-MgApplicationSAML -DisplayName "*Portal*"

Retrieves the SAML configuration for all applications whose DisplayName contains “Portal”.

EXAMPLE 9

Get-MgApplicationSAML -ForceNewToken

Forces the function to disconnect and reconnect to Microsoft Graph to obtain a new access token.

EXAMPLE 10

Get-MgApplicationSAML -ExportToExcel

Gets all SAML applications and exports them to an Excel file.

EXAMPLE 11

Get-MgApplicationSAML -RunFromAzureAutomation -ExpirationThresholdDays 30 -NotificationRecipient 'admin@company.com' -NotificationSender 'automation@company.com'

Gets all SAML applications using managed identity authentication and sends notification for certificates expiring within 30 days.

EXAMPLE 12

Get-MgApplicationSAML -RunFromAzureAutomation -ExpirationThresholdDays 7 -NotificationRecipient 'admin@company.com' -NotificationSender 'automation@company.com'

Gets all SAML applications using managed identity and sends email notification for certificates expiring within 7 days.

PARAMETERS

-DisableParallel

(Optional) Forces sequential processing. By default, on PowerShell 7+ the function processes SAML applications in parallel (ForEach-Object -Parallel) to speed up discovery; on PowerShell 5.1 it always runs sequentially.

Type: System.Management.Automation.SwitchParameter
DefaultValue: False
SupportsWildcards: false
Aliases: []
ParameterSets:
- Name: (All)
  Position: Named
  IsRequired: false
  ValueFromPipeline: false
  ValueFromPipelineByPropertyName: false
  ValueFromRemainingArguments: false
DontShow: false
AcceptedValues: []
HelpMessage: ''

-DisplayName

(Optional) Retrieves the SAML configuration for a specific application by its DisplayName. Supports wildcards (* and ?) for partial name matching (e.g. “Azure*”, “Portal”).

Type: System.String
DefaultValue: ''
SupportsWildcards: false
Aliases: []
ParameterSets:
- Name: ByDisplayName
  Position: Named
  IsRequired: false
  ValueFromPipeline: false
  ValueFromPipelineByPropertyName: false
  ValueFromRemainingArguments: false
DontShow: false
AcceptedValues: []
HelpMessage: ''

-ExpirationThresholdDays

(Required when RunFromAzureAutomation is enabled) Number of days threshold for expiration notification. Default is 30 days.

Type: System.Int32
DefaultValue: 30
SupportsWildcards: false
Aliases: []
ParameterSets:
- Name: (All)
  Position: Named
  IsRequired: false
  ValueFromPipeline: false
  ValueFromPipelineByPropertyName: false
  ValueFromRemainingArguments: false
DontShow: false
AcceptedValues: []
HelpMessage: ''

-ExportPath

Optional output directory for the Excel export (defaults to the user profile).

Type: System.String
DefaultValue: ''
SupportsWildcards: false
Aliases: []
ParameterSets:
- Name: (All)
  Position: Named
  IsRequired: false
  ValueFromPipeline: false
  ValueFromPipelineByPropertyName: false
  ValueFromRemainingArguments: false
DontShow: false
AcceptedValues: []
HelpMessage: ''

-ExportToExcel

(Optional) If specified, exports the results to an Excel file in the user’s profile directory.

Type: System.Management.Automation.SwitchParameter
DefaultValue: False
SupportsWildcards: false
Aliases: []
ParameterSets:
- Name: (All)
  Position: Named
  IsRequired: false
  ValueFromPipeline: false
  ValueFromPipelineByPropertyName: false
  ValueFromRemainingArguments: false
DontShow: false
AcceptedValues: []
HelpMessage: ''

-ForceNewToken

(Optional) Forces the function to disconnect and reconnect to Microsoft Graph to obtain a new access token.

Type: System.Management.Automation.SwitchParameter
DefaultValue: False
SupportsWildcards: false
Aliases: []
ParameterSets:
- Name: (All)
  Position: Named
  IsRequired: false
  ValueFromPipeline: false
  ValueFromPipelineByPropertyName: false
  ValueFromRemainingArguments: false
DontShow: false
AcceptedValues: []
HelpMessage: ''

-IncludeSignInStats

(Optional) If specified, includes sign-in statistics for the last 30 days for each application. Requires AuditLog.Read.All permission. Please be advised that this process is time-consuming.

Type: System.Management.Automation.SwitchParameter
DefaultValue: False
SupportsWildcards: false
Aliases: []
ParameterSets:
- Name: (All)
  Position: Named
  IsRequired: false
  ValueFromPipeline: false
  ValueFromPipelineByPropertyName: false
  ValueFromRemainingArguments: false
DontShow: false
AcceptedValues: []
HelpMessage: ''

-NotificationRecipient

(Required when RunFromAzureAutomation is enabled) Email address to receive expiration notifications.

Type: System.String
DefaultValue: ''
SupportsWildcards: false
Aliases: []
ParameterSets:
- Name: (All)
  Position: Named
  IsRequired: false
  ValueFromPipeline: false
  ValueFromPipelineByPropertyName: false
  ValueFromRemainingArguments: false
DontShow: false
AcceptedValues: []
HelpMessage: ''

-NotificationSender

(Required when RunFromAzureAutomation is enabled) Email address of the sender for expiration notifications.

Type: System.String
DefaultValue: ''
SupportsWildcards: false
Aliases: []
ParameterSets:
- Name: (All)
  Position: Named
  IsRequired: false
  ValueFromPipeline: false
  ValueFromPipelineByPropertyName: false
  ValueFromRemainingArguments: false
DontShow: false
AcceptedValues: []
HelpMessage: ''

-ObjectID

(Optional) Retrieves the SAML configuration for a specific application by its ObjectID.

Type: System.String
DefaultValue: ''
SupportsWildcards: false
Aliases:
- Identity
ParameterSets:
- Name: ByObjectId
  Position: Named
  IsRequired: false
  ValueFromPipeline: false
  ValueFromPipelineByPropertyName: false
  ValueFromRemainingArguments: false
DontShow: false
AcceptedValues: []
HelpMessage: ''

-RunFromAzureAutomation

(Optional) If specified, uses managed identity authentication instead of interactive authentication. This is useful when running the script in Azure environments like Azure Functions, Logic Apps, or VMs with managed identity enabled. When this parameter is used, ExpirationThresholdDays, NotificationRecipient and NotificationSender are required. PowerShell modules used in Azure Automation must be a MAXIMUM of version 2.25.0 when using PowerShell < 7.4.0, because starting from version 2.26.0, PowerShell 7.4.0 is required, and Azure Automation does not support it yet as of February 2026. For PowerShell 7.4.0+, there are no version restrictions. https://github.com/microsoftgraph/msgraph-sdk-powershell/issues/3147 https://github.com/microsoftgraph/msgraph-sdk-powershell/issues/3151 https://github.com/microsoftgraph/msgraph-sdk-powershell/issues/3166

Type: System.Management.Automation.SwitchParameter
DefaultValue: False
SupportsWildcards: false
Aliases: []
ParameterSets:
- Name: (All)
  Position: Named
  IsRequired: false
  ValueFromPipeline: false
  ValueFromPipelineByPropertyName: false
  ValueFromRemainingArguments: false
DontShow: false
AcceptedValues: []
HelpMessage: ''

-ThrottleLimit

(Optional) Maximum number of concurrent runspaces when running in parallel. Default is 5. Keep this value moderate to avoid Microsoft Graph throttling (HTTP 429).

Type: System.Int32
DefaultValue: 5
SupportsWildcards: false
Aliases: []
ParameterSets:
- Name: (All)
  Position: Named
  IsRequired: false
  ValueFromPipeline: false
  ValueFromPipelineByPropertyName: false
  ValueFromRemainingArguments: false
DontShow: false
AcceptedValues: []
HelpMessage: ''

-UseBatchRequest

(Optional) Uses the Microsoft Graph JSON $batch endpoint (via Invoke-MgGraphBatchRequest, 20 requests per HTTP call with automatic HTTP 429 retry) to retrieve the application owners, instead of ForEach-Object -Parallel. Requires the PS365 module (Invoke-MgGraphBatchRequest); when the command is not available (e.g. script deployed standalone), the function warns and falls back to the default behavior. Note: with -IncludeSignInStats, the sign-in statistics are still retrieved per application (not batched).

Type: System.Management.Automation.SwitchParameter
DefaultValue: False
SupportsWildcards: false
Aliases: []
ParameterSets:
- Name: (All)
  Position: Named
  IsRequired: false
  ValueFromPipeline: false
  ValueFromPipelineByPropertyName: false
  ValueFromRemainingArguments: false
DontShow: false
AcceptedValues: []
HelpMessage: ''

CommonParameters

This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutBuffer, -OutVariable, -PipelineVariable, -ProgressAction, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.

INPUTS

OUTPUTS

NOTES

Limitations: The information about the SAML applications clams is not available in the Microsoft Graph API v1 but in https://main.iam.ad.ext.azure.com/api/ApplicationSso/<service-principal-id>/FederatedSsoV2 so we don’t get them

https://ps365.clidsys.com/docs/commands/Get-MgApplicationSAML

​SYNOPSIS

​SYNTAX

​All (Default)

​ByObjectId

​ByDisplayName

​DESCRIPTION

​EXAMPLES

​EXAMPLE 1

​EXAMPLE 2

​EXAMPLE 3

​EXAMPLE 4

​EXAMPLE 5

​EXAMPLE 6

​EXAMPLE 7

​EXAMPLE 8

​EXAMPLE 9

​EXAMPLE 10

​EXAMPLE 11

​EXAMPLE 12

​PARAMETERS

​-DisableParallel

​-DisplayName

​-ExpirationThresholdDays

​-ExportPath

​-ExportToExcel

​-ForceNewToken

​-IncludeSignInStats

​-NotificationRecipient

​-NotificationSender

​-ObjectID

​-RunFromAzureAutomation

​-ThrottleLimit

​-UseBatchRequest

​CommonParameters

​INPUTS

​OUTPUTS

​NOTES

​RELATED LINKS