I've the activity log claims for an event. but how do i get more data on the appid. i tried everything like serviceprincipals,applications. literally everything. Anyone knows how to get more details for the appid. i redacted some information

Question

I've the activity log claims for an event. but how do i get more data on the appid. i tried everything like serviceprincipals,applications. literally everything. Anyone knows how to get more details for the appid. i redacted some information

Yaswanth Reddy 60

"claims":

{

    "aud": "https://management.core.windows.net/",

    "iss": "https://sts.windows.net/",

    "iat": "1732283494",

    "nbf": "1732283494",

    "exp": "1732287751",

    "http://schemas.microsoft.com/claims/authnclassreference": "1",

    "aio": "AVQAq/8YAAAAULbob8HU0KPyWB6BwFf9KeEdS5E48SsaaVprkwIDWck1wiGViZ1JRpaUqIr9DQ3E3pLloQazHUR1GawnTQSQKwYPgcK13wq/pGTUjCDuZJc=",

    "http://schemas.microsoft.com/claims/authnmethodsreferences": "pwd,mfa",

    "appid": "dc807dec-d211-4b3f-bc8a-43b3443c4874",

    "appidacr": "0",

    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname": "",

    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "",

    "groups": "",

    "idtyp": "user",

    "ipaddr": "",

    "name": "",

    "http://schemas.microsoft.com/identity/claims/objectidentifier": "",

    "puid": "10032002B554098E",

    "pwd_exp": "1005561",

    "pwd_url": "https://portal.microsoftonline.com/ChangePassword.aspx",

    "rh": "1.AQ0AAtfav1_cdECFqUnouxKrqUZIf3kAutdPukPawfj2MBMCATcNAA.",

    "http://schemas.microsoft.com/identity/claims/scope": "user_impersonation",

    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "8hZ9vrV4rBZU9xTIgUKoDEkVHFMfOVYH0yi5cPN4Rwo",

    "http://schemas.microsoft.com/identity/claims/tenantid": "",

    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "",

    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "",

    "uti": "QiR2rcIMGUKl5yYns1sXAA",

    "ver": "1.0",

    "wids": "158c047a-c907-4556-b7ef-446551a6b5f7,b79fbf4d-3ef9-4689-8143-76b194e85509",

    "xms_idrel": "28 1",

    "xms_tcdt": "1396299209"

},

Accepted answer

1 additional answer

Your answer

Answer 1

Raja Pothuraju 19,225 Microsoft External Staff

Hello @Yaswanth Reddy,

Thank you for posting your query on Microsoft Q&A.

Based on your statement, it seems you’re looking for details about an application using its AppID. As Yakun mentioned, you can easily retrieve this information using Graph Explorer by filtering the request with the AppID. Below are the steps and screenshots for better clarity on reproducing this process:

Login in to Graph Explorer with a Global Admin account. Send a GET request to the following URL:

https://graph.microsoft.com/v1.0/applications(appId='{appId}')

Replace {appId} with your application's AppID in the URL format below:

https://graph.microsoft.com/v1.0/applications(appId='142cadc3-87f9-460e-8920-xxxxxxxxxxx')

Execute the query, and it will return detailed information about the application.

User's image

If you encounter any errors while sending the GET request, please let us know so we can assist you further.

Thanks,
Raja Pothuraju.

Raja Pothuraju 19,225 Reputation points Microsoft External Staff

2024-11-29T07:52:39.8433333+00:00
Hello @Yaswanth Reddy,

Thank you for your response.

Based on the error output, this issue typically occurs when the App ID does not exist in the tenant. To verify, please log in to the Azure Portal and navigate to Microsoft Entra ID > App Registrations > All Applications. Then, use the search bar to look up the App ID.

If the application is visible but the error persists in Graph Explorer, I would like to connect with you offline to better understand the scenario and gain more context about the issue.

Here are my contact details: Please send an email to AzCommunity@microsoft.com with the subject line Attn: Pothurajur and include the following details in the email body:

A link to this thread/post

We can then connect offline to discuss this further.

Thanks,
Raja Pothuraju.
Raja Pothuraju 19,225 Reputation points Microsoft External Staff

2024-11-29T10:24:33.5666667+00:00

Hello @Yaswanth Reddy,

Thank you for taking the time to speak with me over the call.

As discussed, the application IDs you referred to are Microsoft first-party apps, while the remaining apps are resources invoked during certain actions performed within the Azure Portal UI.

You can refer to the following GitHub document for a publicly available list of Microsoft first-party apps: Microsoft First-Party Apps List

If any tokens are generated for resources in Azure, the details will be visible in the Microsoft Entra Sign-in Logs and Audit Logs. To retrieve this data programmatically using commands, you can follow the documentation below: Get-MgAuditLogSignIn PowerShell Documentation

I hope this information is helpful. Please feel free to reach out if you have any further questions.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Thanks,
Raja Pothuraju.
Yaswanth Reddy 60 Reputation points

2024-11-29T10:26:22.66+00:00

Thanks for the time Raja.

Answer 2

Yakun Huang-MSFT 10,555 Microsoft External Staff

Hello Yaswanth Reddy,

Thank you for reaching out to Microsoft Support!

You can obtain application details by sending the following request from appId:

GET https://graph.microsoft.com/v1.0/applications(appId='{appId}')

You can also obtain application information in Azure AD through appId.

Reference document:

https://learn.microsoft.com/en-us/graph/api/application-get?view=graph-rest-1.0&tabs=http

Hope this helps.

If the answer is helpful, please click Accept Answer and kindly upvote it. If you have any further questions about this answer, please click Comment.

Yaswanth Reddy 60 Reputation points

2024-11-29T07:09:12.17+00:00
Hi Raja ,

Thanks for the reply. i tried this way and got this response.

{ "error": { "code": "Request_ResourceNotFound", "message": "Resource 'dc807dec-d211-4b3f-bc8a-43b3443c4874' does not exist or one of its queried reference-property objects are not present.", "innerError": { "date": "2024-11-29T07:06:17", "request-id": "df330b82-b6d3-46c5-81e8-4cf9a0e1506b", "client-request-id": "fea286c9-fd92-96b8-3030-45b22cdce02a" } } }

i still don't know how to get the details. the methods i tried are
https://graph.microsoft.com/v1.0/applications(appId='dc807dec-d211-4b3f-bc8a-43b3443c4874')

https://graph.microsoft.com/v1.0/applications/dc807dec-d211-4b3f-bc8a-43b3443c4874

https://graph.microsoft.com/v1.0/servicePrincipals?$filter=appid

https://graph.microsoft.com/v1.0/servicePrincipals/dc807dec-d211-4b3f-bc8a-43b3443c4874

i don't know any other ways.

Share via

I've the activity log claims for an event. but how do i get more data on the appid. i tried everything like serviceprincipals,applications. literally everything. Anyone knows how to get more details for the appid. i redacted some information

1 additional answer

Your answer