### Get devices by display name prefix

Source: https://github.com/microsoftdocs/entra-powershell-docs/blob/main/docs/reference/v1.0/Microsoft.Entra.DirectoryManagement/Get-EntraDevice.md

This example demonstrates how to retrieve all devices whose display name starts with a specific string.

```APIDOC
## Get-EntraDevice -Filter "startsWith(DisplayName,'Woodgrove')"

### Description
Retrieves all devices from Microsoft Entra ID whose display name starts with the specified string.

### Parameters
#### Query Parameters
- **Filter** (string) - Required - OData filter to search for devices by display name prefix.

### Request Example
```powershell
Connect-Entra -Scopes 'Device.Read.All'
Get-EntraDevice -Filter "startsWith(DisplayName,'Woodgrove')"
```

### Response
#### Success Response (200)
Returns a collection of devices whose display names start with the specified prefix.

#### Response Example
```json
[
  {
    "DeletedDateTime": null,
    "Id": "bbbbbbbb-1111-2222-3333-cccccccccccc",
    "AccountEnabled": true,
    "ApproximateLastSignInDateTime": null,
    "ComplianceExpirationDateTime": null,
    "DeviceCategory": null,
    "DeviceId": "eeeeeeee-4444-5555-6666-ffffffffffff",
    "DeviceMetadata": "MetaData",
    "DeviceOwnership": null
  }
]
```
```

--------------------------------

### Get available license plans

Source: https://github.com/microsoftdocs/entra-powershell-docs/blob/main/docs/reference/v1.0/Microsoft.Entra.DirectoryManagement/Get-EntraSubscribedSku.md

This example demonstrates how to retrieve available license plans by expanding the PrepaidUnits property.

```APIDOC
## Get-EntraSubscribedSku - Expand PrepaidUnits

### Description
Retrieves subscribed SKUs and expands the PrepaidUnits property to show available license plans.

### Method
GET

### Endpoint
/subscribedSkus

### Parameters
#### Query Parameters
- **Property** (String[]) - Optional - Specifies the properties to retrieve for the subscribed SKUs. Include 'Sku*', 'ConsumedUnits', and 'PrepaidUnits' to get license plan details.

### Response
#### Success Response (200)
- **SkuId** (String) - The unique identifier of the SKU.
- **SkuPartNumber** (String) - The part number of the SKU.
- **ConsumedUnits** (Integer) - The number of units consumed for the SKU.
- **PrepaidUnits** (Object) - Contains details about the available license plans.
  - **Enabled** (Integer) - The number of enabled license units.
  - **LockedOut** (Integer) - The number of locked out license units.
  - **Suspended** (Integer) - The number of suspended license units.
  - **Warning** (Integer) - The number of license units with a warning status.

### Request Example
```powershell
Get-EntraSubscribedSku | Select-Object -Property Sku*, ConsumedUnits -ExpandProperty PrepaidUnits
```

### Response Example
```json
[
  {
    "SkuId": "efccb6f7-5641-4e0e-bd10-b4976e1bf68e",
    "SkuPartNumber": "EMS",
    "ConsumedUnits": 3,
    "Enabled": 5,
    "LockedOut": 0,
    "Suspended": 0,
    "Warning": 0
  }
]
```
```

--------------------------------

### Get All Tenant Details

Source: https://github.com/microsoftdocs/entra-powershell-docs/blob/main/docs/reference/v1.0/Microsoft.Entra.DirectoryManagement/Get-EntraTenantDetail.md

This example shows how to retrieve all tenant details. Ensure you are connected to Microsoft Entra ID with appropriate scopes.

```powershell
Connect-Entra -Scopes 'Organization.Read.All'
Get-EntraTenantDetail -All
```

--------------------------------

### Example 1: Get role assignments

Source: https://github.com/microsoftdocs/entra-powershell-docs/blob/main/docs/reference/v1.0/Microsoft.Entra.Governance/Get-EntraDirectoryRoleAssignment.md

This example demonstrates how to connect to Microsoft Entra ID and retrieve all role assignments.

```APIDOC
```powershell
Connect-Entra -Scopes 'RoleManagement.Read.Directory', 'EntitlementManagement.Read.All'
Get-EntraDirectoryRoleAssignment
```
```

--------------------------------

### Get all attribute sets

Source: https://github.com/microsoftdocs/entra-powershell-docs/blob/main/docs/reference/v1.0/Microsoft.Entra.DirectoryManagement/Get-EntraAttributeSet.md

This example returns all attribute sets.

```APIDOC
## Get-EntraAttributeSet

### Description
Gets a list of attribute sets.

### Method
GET

### Endpoint
/attributeSets

### Parameters
#### Query Parameters
- **AttributeSetId** (string) - Optional - Unique identifier for the attribute set within a tenant.
- **Property** (string[]) - Optional - Specifies properties to be returned

### Response
#### Success Response (200)
- **Id** (string) - Description
- **Description** (string) - Description
- **MaxAttributesPerSet** (integer) - Description

### Request Example
```powershell
Get-EntraAttributeSet
```

### Response Example
```json
{
  "Id": "Engineering",
  "Description": "Attributes for cloud engineering team",
  "MaxAttributesPerSet": 25
}
```
```

--------------------------------

### Get applications using a search string

Source: https://github.com/microsoftdocs/entra-powershell-docs/blob/main/docs/reference/v1.0/Microsoft.Entra.Applications/Get-EntraApplication.md

This example demonstrates how to retrieve applications by searching for a string.

```APIDOC
## Get-EntraApplication -SearchString

### Description
Retrieves Microsoft Entra ID applications that match a specified search string.

### Method
GET

### Endpoint
/applications

### Parameters
#### Query Parameters
- **SearchString** (String) - Required - The string to search for within application properties.
- **Property** (String[]) - Optional - Specifies the properties to retrieve for the applications.
- **All** - Optional - Specifies that all matching applications should be returned.

### Request Example
```powershell
Connect-Entra -Scopes 'Application.Read.All'
Get-EntraApplication -SearchString 'TestApp'
```

### Response
#### Success Response (200)
- **DisplayName** (String) - The display name of the application.
- **Id** (String) - The unique identifier of the application.
- **AppId** (String) - The application's client ID.

#### Response Example
```json
[
  {
    "DisplayName": "MyTestApp",
    "Id": "aaaaaaaa-0000-1111-2222-bbbbbbbbbbbb",
    "AppId": "bbbbbbbb-1111-2222-3333-cccccccccccc"
  },
  {
    "DisplayName": "AnotherTestApp",
    "Id": "cccccccc-4444-5555-6666-dddddddddddd",
    "AppId": "dddddddd-5555-6666-7777-eeeeeeeeeeee"
  }
]
```
```

--------------------------------

### Example 2: Get role assignments using 'All' parameter

Source: https://github.com/microsoftdocs/entra-powershell-docs/blob/main/docs/reference/v1.0/Microsoft.Entra.Governance/Get-EntraDirectoryRoleAssignment.md

This example shows how to retrieve all role assignments by explicitly using the '-All' parameter.

```APIDOC
```powershell
Connect-Entra -Scopes 'RoleManagement.Read.Directory', 'EntitlementManagement.Read.All'
Get-EntraDirectoryRoleAssignment -All
```
```

--------------------------------

### Get all applications

Source: https://github.com/microsoftdocs/entra-powershell-docs/blob/main/docs/reference/v1.0/Microsoft.Entra.Applications/Get-EntraApplication.md

This example demonstrates how to retrieve all applications from Microsoft Entra ID.

```APIDOC
## Get-EntraApplication -All

### Description
Retrieves all applications registered in Microsoft Entra ID.

### Method
GET

### Endpoint
/applications

### Parameters
#### Query Parameters
- **All** - Optional - Specifies that all applications should be returned.
- **Property** (String[]) - Optional - Specifies the properties to retrieve for the applications.

### Request Example
```powershell
Connect-Entra -Scopes 'Application.Read.All'
Get-EntraApplication -All
```

### Response
#### Success Response (200)
- **DisplayName** (String) - The display name of the application.
- **Id** (String) - The unique identifier of the application.
- **AppId** (String) - The application's client ID.
- **SignInAudience** (String) - The audience that can sign in to the application.
- **PublisherDomain** (String) - The domain of the publisher of the application.

#### Response Example
```json
[
  {
    "DisplayName": "test app",
    "Id": "aaaaaaaa-0000-1111-2222-bbbbbbbbbbbb",
    "AppId": "bbbbbbbb-1111-2222-3333-cccccccccccc",
    "SignInAudience": "AzureADandPersonalMicrosoftAccount",
    "PublisherDomain": "contoso.com"
  },
  {
    "DisplayName": "ToGraph_443DEM",
    "Id": "cccccccc-4444-5555-6666-dddddddddddd",
    "AppId": "dddddddd-5555-6666-7777-eeeeeeeeeeee",
    "SignInAudience": "AzureADMyOrg",
    "PublisherDomain": "contoso.com"
  }
]
```
```

--------------------------------

### Get an application by ApplicationId

Source: https://github.com/microsoftdocs/entra-powershell-docs/blob/main/docs/reference/v1.0/Microsoft.Entra.Applications/Get-EntraApplication.md

This example demonstrates how to retrieve a specific application by providing its ApplicationId.

```APIDOC
## Get-EntraApplication -ApplicationId

### Description
Retrieves a specific Microsoft Entra ID application using its unique Application ID.

### Method
GET

### Endpoint
/applications/{application-id}

### Parameters
#### Path Parameters
- **ApplicationId** (String) - Required - The unique identifier of the application.

#### Query Parameters
- **Property** (String[]) - Optional - Specifies the properties to retrieve for the application.

### Request Example
```powershell
Connect-Entra -Scopes 'Application.Read.All'
Get-EntraApplication -ApplicationId 'aaaaaaaa-0000-1111-2222-bbbbbbbbbbbb'
```

### Response
#### Success Response (200)
- **DisplayName** (String) - The display name of the application.
- **Id** (String) - The unique identifier of the application.
- **AppId** (String) - The application's client ID.
- **SignInAudience** (String) - The audience that can sign in to the application.
- **PublisherDomain** (String) - The domain of the publisher of the application.

#### Response Example
```json
{
  "DisplayName": "ToGraph_443democc3c",
  "Id": "aaaaaaaa-0000-1111-2222-bbbbbbbbbbbb",
  "AppId": "bbbbbbbb-1111-2222-3333-cccccccccccc",
  "SignInAudience": "AzureADMyOrg",
  "PublisherDomain": "contoso.com"
}
```
```

--------------------------------

### Get a device by display name

Source: https://github.com/microsoftdocs/entra-powershell-docs/blob/main/docs/reference/v1.0/Microsoft.Entra.DirectoryManagement/Get-EntraDevice.md

This example demonstrates how to retrieve a device using its display name.

```APIDOC
## Get-EntraDevice -Filter "DisplayName eq 'Woodgrove Desktop'"

### Description
Retrieves a device from Microsoft Entra ID using its display name.

### Parameters
#### Query Parameters
- **Filter** (string) - Required - OData filter to search for devices by display name.

### Request Example
```powershell
Connect-Entra -Scopes 'Device.Read.All'
Get-EntraDevice -Filter "DisplayName eq 'Woodgrove Desktop'"
```

### Response
#### Success Response (200)
Returns a collection containing the device that matches the display name.

#### Response Example
```json
[
  {
    "DeletedDateTime": null,
    "Id": "bbbbbbbb-1111-2222-3333-cccccccccccc",
    "AccountEnabled": true,
    "ApproximateLastSignInDateTime": null,
    "ComplianceExpirationDateTime": null,
    "DeviceCategory": null,
    "DeviceId": "eeeeeeee-4444-5555-6666-ffffffffffff",
    "DeviceMetadata": "MetaData",
    "DeviceOwnership": null
  }
]
```
```

--------------------------------

### Get All Licenses in the Tenant

Source: https://github.com/microsoftdocs/entra-powershell-docs/blob/main/docs/reference/v1.0/Microsoft.Entra.DirectoryManagement/Get-EntraTenantDetail.md

This example shows how to retrieve all licenses available in the tenant. It pipes the output of Get-EntraTenantDetail to Select-Object to expand the ProvisionedPlans property.

```powershell
Connect-Entra -Scopes 'Organization.Read.All'
Get-EntraTenantDetail | Select-Object -ExpandProperty ProvisionedPlans
```

--------------------------------

### Create a group

Source: https://github.com/microsoftdocs/entra-powershell-docs/blob/main/docs/reference/v1.0/Microsoft.Entra.Groups/New-EntraGroup.md

This example demonstrates how to create the new group.

```powershell
Connect-Entra -Scopes 'Group.ReadWrite.All','Group.Create'
$params = @{
    DisplayName = 'HelpDesk admin group2'
    MailEnabled = $False
    MailNickname = 'helpDeskAdminGroup'
    SecurityEnabled = $True
}

New-EntraGroup @params
```

```powershell
DisplayName           Id                                   MailNickname       Description GroupTypes
-----------           --                                   ------------       ----------- ----------
HelpDesk admin group2 bbbbbbbb-5555-5555-0000-qqqqqqqqqqqq helpDeskAdminGroup             {}
```

--------------------------------

### Create a new Domain with specified services

Source: https://github.com/microsoftdocs/entra-powershell-docs/blob/main/docs/reference/v1.0/Microsoft.Entra.DirectoryManagement/New-EntraDomain.md

This example demonstrates how to create a new domain with specific services like 'Email' and 'OfficeCommunicationsOnline' enabled. Ensure you are connected with appropriate scopes.

```powershell
Connect-Entra -Scopes 'Domain.ReadWrite.All'
New-EntraDomain -Name testingDemo1.com -SupportedServices @('Email', 'OfficeCommunicationsOnline')
```

--------------------------------

### Get groups whose DisplayName starts with a search string

Source: https://github.com/microsoftdocs/entra-powershell-docs/blob/main/docs/reference/v1.0/Microsoft.Entra.Groups/Get-EntraGroup.md

This example demonstrates how to retrieve groups that include the text 'New' in their display names from Microsoft Entra ID.

```APIDOC
## Get-EntraGroup -SearchString

### Description
Retrieves groups where the DisplayName property starts with the specified search string.

### Method
GET

### Endpoint
/groups

### Parameters
#### Query Parameters
- **SearchString** (string) - Required - The string to search for in the DisplayName property.

### Request Example
```powershell
Connect-Entra -Scopes 'GroupMember.Read.All'
Get-EntraGroup -SearchString 'New'
```

### Response
#### Success Response (200)
Returns a collection of group objects that match the search criteria.

#### Response Example
```json
[
  {
    "DisplayName": "New Sparkling Deer",
    "Id": "bbbbbbbb-5555-5555-0000-qqqqqqqqqqqq",
    "MailNickname": "newsparklingdeer",
    "Description": "New Sparkling Deer",
    "GroupTypes": ["Unified"]
  },
  {
    "DisplayName": "New Golden Fox",
    "Id": "xxxxxxxx-8888-5555-9999-bbbbbbbbbbbb",
    "MailNickname": "newgoldenfox",
    "Description": null,
    "GroupTypes": ["DynamicMembership"]
  }
]
```
```

--------------------------------

### Get all permissions of the specified type

Source: https://github.com/microsoftdocs/entra-powershell-docs/blob/main/docs/reference/v1.0/Microsoft.Entra.Authentication/Find-EntraPermission.md

This example shows how to get all permissions of a specified type, for example, `Delegated` or `Application` permissions.

```APIDOC
## Find-EntraPermission

### Description
Retrieves permissions from Microsoft Entra ID.

### Parameters
#### -SearchString
Specifies the filter for the permissions, for example, domain and scope.

- Type: System.String
- Required: True
- Position: Named
- Default value: None
- Accept pipeline input: True
- Accept wildcard characters: False

#### -All
Sets if the cmdlet returns all parameters.

- Type: System.Management.Automation.SwitchParameter
- Required: False
- Position: Named
- Default value: False
- Accept pipeline input: False
- Accept wildcard characters: False

#### -ExactMatch
Sets if Search String should be an exact match.

- Type: System.Management.Automation.SwitchParameter
- Required: False
- Position: Named
- Default value: False
- Accept pipeline input: False
- Accept wildcard characters: False

#### -Online
Use the -Online parameter with -SearchString in Find-MgGraphPermission to fetch the latest permissions from Microsoft Graph before searching. This ensures Find-MgGraphPermission returns accurate results by including any new permissions added for recent APIs. The command uses the existing Microsoft Graph connection established by Connect-MgGraph. If your connection lacks permissions to access this data or if there’s no network connectivity, the command fails. Once updated, Find-MgGraphPermission will continue using the refreshed permission list for future searches, even without the -Online parameter.

- Type: System.Management.Automation.SwitchParameter
- Required: False
- Position: Named
- Default value: False
- Accept pipeline input: False
- Accept wildcard characters: False

#### -PermissionType
Specifies the type of Permission, for example, Delegated or Application.

- Type: System.String
- Required: False
- Position: Named
- Default value: Any
- Accept pipeline input: False
- Accept wildcard characters: False

### Example
```powershell
Find-EntraPermission -PermissionType 'Delegated'
```

### Output Example
```text
Id                                   Consent Name                                                    Description
--                                   ------- ----                                                    -----------
eb...                                  Admin   AccessReview.Read.All                                   Allows the app to read access re…
e4...                                  Admin   AccessReview.ReadWrite.All                              Allows the app to read, update, …
5a...                                  Admin   AccessReview.ReadWrite.Membership                       Allows the app to read,
```
```

--------------------------------

### Get all groups

Source: https://github.com/microsoftdocs/entra-powershell-docs/blob/main/docs/reference/v1.0/Microsoft.Entra.Groups/Get-EntraGroup.md

This example demonstrates how to get all groups from Microsoft Entra ID.

```APIDOC
## Get all groups

### Description
Retrieves all groups from Microsoft Entra ID.

### Method
GET

### Endpoint
/groups

### Parameters
#### Query Parameters
- **Top** (Int32) - Optional - Specifies the maximum number of groups to return.
- **All** - Optional - Retrieves all groups, bypassing default paging.
- **Filter** (String) - Optional - Filters the results based on a specified condition.
- **Property** (String[]) - Optional - Specifies the properties to retrieve for each group.
- **HasErrorsOnly** - Optional - Filters to show only groups with service provisioning errors.
- **HasLicenseErrorsOnly** - Optional - Filters to show only groups with license assignment errors.

### Request Example
```powershell
Connect-Entra -Scopes 'GroupMember.Read.All'
Get-EntraGroup
```

### Response
#### Success Response (200)
- **DisplayName** (String) - The display name of the group.
- **Id** (String) - The unique identifier of the group.
- **MailNickname** (String) - The mail nickname of the group.
- **Description** (String) - The description of the group.

#### Response Example
```json
[
  {
    "DisplayName": "SimpleTestGrp",
    "Id": "aaaaaaaa-0000-1111-2222-bbbbbbbbbbbb",
    "MailNickname": "NickName",
    "Description": null
  },
  {
    "DisplayName": "SimpleGroup",
    "Id": "bbbbbbbb-1111-2222-3333-cccccccccccc",
    "MailNickname": "NickName",
    "Description": null
  }
]
```
```

--------------------------------

### Create a basic application

Source: https://github.com/microsoftdocs/entra-powershell-docs/blob/main/docs/reference/v1.0/Microsoft.Entra.Applications/New-EntraApplication.md

Creates a basic application registration with default settings. Ensure you are connected to Microsoft Entra ID with appropriate scopes before running.

```powershell
Connect-Entra -Scopes 'Application.ReadWrite.All'
New-EntraApplication -DisplayName 'Contoso HR App'
```

--------------------------------

### Get Scoped Role Administrator

Source: https://github.com/microsoftdocs/entra-powershell-docs/blob/main/docs/reference/v1.0/Microsoft.Entra.DirectoryManagement/Get-EntraScopedRoleMembership.md

This example gets scoped role administrator. You can use the command Get-EntraAdministrativeUnit to get administrative unit Id.

```APIDOC
## Get-EntraScopedRoleMembership

### Description
Lists Microsoft Entra role assignments with administrative unit scope.

### Method
GET

### Endpoint
/roleManagement/directory/administrativeUnits/{administrativeUnitId}/scopedRoleMemberships/{scopedRoleMembershipId}

### Parameters
#### Path Parameters
- **administrativeUnitId** (string) - Required - The ID of the administrative unit.
- **scopedRoleMembershipId** (string) - Required - The ID of the scoped role membership.

#### Query Parameters
- **$filter** (string) - Optional - Filter the results using OData syntax.
- **$select** (string[]) - Optional - Select specific properties to return.

### Response
#### Success Response (200)
- **Id** (string) - The ID of the scoped role membership.
- **AdministrativeUnitId** (string) - The ID of the administrative unit.
- **RoleId** (string) - The ID of the role assigned.

### Request Example
```powershell
Connect-Entra -Scopes 'RoleManagement.Read.Directory'
$role = Get-EntraDirectoryRole -Filter "DisplayName eq 'Helpdesk Administrator'"
$administrativeUnit = Get-EntraAdministrativeUnit -Filter "DisplayName eq 'Pacific Administrative Unit'"
$roleMembership = Get-EntraScopedRoleMembership -AdministrativeUnitId $administrativeUnit.Id | Where-Object {$_.RoleId -eq $role.Id}
Get-EntraScopedRoleMembership -AdministrativeUnitId $administrativeUnit.Id -ScopedRoleMembershipId $roleMembership.Id
```

### Response Example
```json
{
  "Id": "dddddddddddd-bbbb-aaaa-bbbb-cccccccccccc",
  "AdministrativeUnitId": "aaaaaaaa-bbbb-aaaa-bbbb-cccccccccccc",
  "RoleId": "bbbbbbbb-1111-2222-3333-cccccccccccc"
}
```
```

--------------------------------

### Get a service principal by display name

Source: https://github.com/microsoftdocs/entra-powershell-docs/blob/main/docs/reference/v1.0/Microsoft.Entra.Applications/Get-EntraServicePrincipal.md

This example gets a service principal by its display name.

```APIDOC
## Get-EntraServicePrincipal -Filter

### Description
Retrieves a service principal using a filter based on its display name.

### Method
GET

### Endpoint
/servicePrincipals

### Parameters
#### Query Parameters
- **Filter** (string) - Required - Filter to search for service principals by display name. Example: "displayName eq 'Helpdesk Application'"

### Request Example
```powershell
Connect-Entra -Scopes 'Application.Read.All'
Get-EntraServicePrincipal -Filter "displayName eq 'Helpdesk Application'"
```

### Response
#### Success Response (200)
Returns a list of service principals matching the filter criteria.

#### Response Example
```json
{
  "value": [
    {
      "displayName": "Helpdesk Application",
      "id": "aaaaaaaa-0000-1111-2222-bbbbbbbbbbbb",
      "appId": "00001111-aaaa-2222-bbbb-3333cccc4444",
      "signInAudience": "AzureADMultipleOrgs",
      "servicePrincipalType": "Application"
    }
  ]
}
```
```

--------------------------------

### Create an application with a certificate credential

Source: https://github.com/microsoftdocs/entra-powershell-docs/blob/main/docs/reference/v1.0/Microsoft.Entra.Applications/New-EntraApplication.md

This example demonstrates how to create a new application with a certificate credential using the New-EntraApplication cmdlet.

```APIDOC
## New-EntraApplication

### Description
Creates a new application in Microsoft Entra ID.

### Parameters

#### -DisplayName

The display name of the application in Microsoft Entra ID.

- **Type**: String
- **Required**: True
- **Position**: 0

#### -KeyCredentials

A collection of key credentials for the application, such as certificates.

- **Type**: `System.Collections.Generic.List<Microsoft.Graph.PowerShell.Models.MicrosoftGraphKeyCredential>`
- **Required**: False
- **Position**: Named

#### -SignInAudience

Defines which accounts are supported for this application. Valid values: `AzureADMyOrg`, `AzureADMultipleOrgs`, `AzureADandPersonalMicrosoftAccount`, `PersonalMicrosoftAccount`.

- **Type**: String
- **Required**: False
- **Position**: Named

#### -IdentifierUris

URIs that uniquely identify the application within Azure AD.

- **Type**: `System.Collections.Generic.List<System.String>`
- **Required**: False
- **Position**: Named

#### -Tags

Custom tags that can be used to categorize and identify the application.

- **Type**: `System.Collections.Generic.List<System.String>`
- **Required**: False
- **Position**: Named

#### -GroupMembershipClaims

Configures the groups claim issued in a user or OAuth 2.0 access token. Valid values: `None`, `SecurityGroup`, `All`.

- **Type**: String
- **Required**: False
- **Position**: Named

#### -TokenEncryptionKeyId

Specifies the keyId of a public key from the keyCredentials collection for token encryption.

- **Type**: String
- **Required**: False
- **Position**: Named

#### -IsDeviceOnlyAuthSupported

Specifies whether this application supports device authentication without a user.

- **Type**: `System.Nullable<System.Boolean>`
- **Required**: False
- **Position**: Named

#### -IsFallbackPublicClient

Specifies whether the application is a public client. If not set, the default behavior is `false`.

- **Type**: `System.Nullable<System.Boolean>`
- **Required**: False
- **Position**: Named

#### -AppRoles

The collection of application roles defined for the application.

- **Type**: `System.Collections.Generic.List<Microsoft.Graph.PowerShell.Models.MicrosoftGraphAppRole>`
- **Required**: False
- **Position**: Named

#### -RequiredResourceAccess

The API permissions required by the application to other resources such as Microsoft Graph.

- **Type**: `Microsoft.Graph.PowerShell.Models.MicrosoftGraphRequiredResourceAccess[]`
- **Required**: False
- **Position**: Named

#### -Api

The API settings for the application, including OAuth2 permission scopes and app roles.

- **Type**: `Microsoft.Graph.PowerShell.Models.MicrosoftGraphApiApplication`
- **Required**: False
- **Position**: Named

#### -PublicClient

Settings for a public client application (mobile or desktop).

- **Type**: `Microsoft.Graph.PowerShell.Models.MicrosoftGraphPublicClientApplication`
- **Required**: False
- **Position**: Named

### Example
```powershell
Connect-Entra -Scopes 'Application.ReadWrite.All'
$cert = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2("C:\Certificates\MyCertificate.cer")
$thumbprint = $cert.Thumbprint
$base64Cert = [Convert]::ToBase64String($cert.RawData)

$keyCred = @{
    CustomKeyIdentifier = $thumbprint
    Type = "AsymmetricX509Cert"
    Usage = "Verify"
    Key = $base64Cert
    DisplayName = "App Certificate"
    StartDateTime = [DateTime]::UtcNow
    EndDateTime = [DateTime]::UtcNow.AddYears(1)
}

New-EntraApplication -DisplayName "Contoso Certificate App" -KeyCredentials @($keyCred)
```
```

--------------------------------

### Create a new service principal by KeyCredentials

Source: https://github.com/microsoftdocs/entra-powershell-docs/blob/main/docs/reference/v1.0/Microsoft.Entra.Applications/New-EntraServicePrincipal.md

This example demonstrates how to create a new service principal using key credentials. It involves connecting to Entra ID, creating a KeyCredential object with specific properties, retrieving an application using Get-EntraApplication, and then creating the service principal with the application's AppId and the defined key credentials.

```APIDOC
## New-EntraServicePrincipal -AppId -KeyCredentials

### Description
Creates a new service principal using the provided application ID and key credentials.

### Parameters
#### Path Parameters
- **AppId** (string) - Required - The unique identifier for the associated application (its appId property).
- **KeyCredentials** (System.Collections.Generic.List<Microsoft.Open.AzureAD.Model.KeyCredential>) - Required - The collection of key credentials associated with the service principal.

### Request Example
```powershell
Connect-Entra -Scopes 'Application.ReadWrite.All','Application.ReadWrite.OwnedBy'
$creds = New-Object Microsoft.Open.AzureAD.Model.KeyCredential
$creds.CustomKeyIdentifier = [System.Text.Encoding]::UTF8.GetBytes('Test')
$startdate = Get-Date -Year 2023 -Month 10 -Day 23
$creds.StartDate = $startdate
$creds.Type = 'Symmetric'
$creds.Usage = 'Sign'
$creds.Value = [System.Text.Encoding]::UTF8.GetBytes('strong-cred-value')
$creds.EndDate = Get-Date -Year 2024 -Month 10 -Day 23
$application = Get-EntraApplication -Filter "DisplayName eq 'Helpdesk Application'"

New-EntraServicePrincipal -AppId $application.AppId -KeyCredentials $creds
```

### Response
#### Success Response (200)
- **DisplayName** (string) - The display name of the service principal.
- **Id** (string) - The unique identifier of the service principal.
- **AppId** (string) - The application ID of the associated application.
- **SignInAudience** (string) - The sign-in audience for the service principal.
- **ServicePrincipalType** (string) - The type of the service principal.
```

--------------------------------

### Get the owner of a service principal

Source: https://github.com/microsoftdocs/entra-powershell-docs/blob/main/docs/reference/v1.0/Microsoft.Entra.Applications/Get-EntraServicePrincipalOwner.md

This example gets the owners of a specified service principal. You can use the command `Get-EntraServicePrincipal` to get service principal object ID.

```APIDOC
## Get-EntraServicePrincipalOwner -ServicePrincipalId <String>

### Description
Gets the owner of a service principal.

### Method
GET

### Endpoint
/servicePrincipals/{id}/owners

### Parameters
#### Path Parameters
- **id** (string) - Required - The object ID of the service principal.

#### Query Parameters
- **-All** (boolean) - Optional - If specified, all owners are returned. Otherwise, only the first page of results is returned.
- **-Top** (int32) - Optional - The maximum number of owners to return. Use `-Limit` as an alias for `-Top`.
- **-Property** (string[]) - Optional - Specifies the properties to return for each owner. For example, `Id, userPrincipalName, DisplayName, '@odata.type'`.

### Request Example
```powershell
Connect-Entra -Scopes 'Application.Read.All'
$servicePrincipal = Get-EntraServicePrincipal -Filter "displayName eq 'Helpdesk Application'"
Get-EntraServicePrincipalOwner -ServicePrincipalId $servicePrincipal.Id | Select-Object Id, userPrincipalName, DisplayName, '@odata.type'
```

### Response
#### Success Response (200)
- **Id** (string) - The unique identifier of the owner.
- **userPrincipalName** (string) - The user principal name of the owner.
- **DisplayName** (string) - The display name of the owner.
- **@odata.type** (string) - The OData type of the owner object.

#### Response Example
```json
{
  "value": [
    {
      "id": "aaaaaaaa-0000-1111-2222-bbbbbbbbbbbb",
      "userPrincipalName": "AlexW@Contoso.com",
      "displayName": "Alex Wilber",
      "@odata.type": "#microsoft.graph.user"
    },
    {
      "id": "bbbbbbbb-1111-2222-3333-cccccccccccc",
      "userPrincipalName": "ChristieC@Contoso.com",
      "displayName": "Christie Cline",
      "@odata.type": "#microsoft.graph.user"
    }
  ]
}
```
```

--------------------------------

### Preview deletion with WhatIf

Source: https://github.com/microsoftdocs/entra-powershell-docs/blob/main/docs/reference/v1.0/Microsoft.Entra.Applications/Remove-EntraAgentIdentityBlueprint.md

This example shows which resources would be deleted without performing any deletions. Ensure you have the necessary scopes connected.

```powershell
Connect-Entra -Scopes 'AgentIdentityBlueprint.ReadWrite.All', 'AgentIdentity.DeleteRestore.All', 'AgentIdUser.ReadWrite.All'
Remove-EntraAgentIdentityBlueprint -BlueprintId "aaaaaaaa-0000-1111-2222-bbbbbbbbbbbb" -WhatIf
```

--------------------------------

### Get OAuth2 permission grants for a user in a service principal

Source: https://github.com/microsoftdocs/entra-powershell-docs/blob/main/docs/reference/v1.0/Microsoft.Entra.SignIns/Get-EntraOAuth2PermissionGrant.md

This example gets the OAuth2 permission grants for a user in a service principal.

```APIDOC
## Get-EntraOAuth2PermissionGrant

### Description
Retrieves OAuth2 permission grants for a user in a service principal.

### Method
GET

### Endpoint
/oauth2PermissionGrants

### Parameters
#### Query Parameters
- **-Filter** (string) - Required/Optional - Use to filter the results. For example, to filter by a specific user and service principal:
  `$_.ClientId -eq $servicePrincipal.Id -and $_.PrincipalId -eq $user.Id`
- **-Top** (int) - Required/Optional - Specifies the maximum number of records to return. Alias: `-Limit`.
- **-All** (boolean) - Required/Optional - List all pages.
- **-Property** (string[]) - Required/Optional - Specifies properties to be returned. Alias: `-Select`.

### Request Example
```powershell
Connect-Entra -Scopes 'Directory.Read.All'
$user = Get-EntraUser -UserId 'SawyerM@contoso.com'
$servicePrincipal = Get-EntraServicePrincipal -Filter "DisplayName eq 'Helpdesk Application'"
Get-EntraOAuth2PermissionGrant | Where-Object {$_.ClientId -eq $servicePrincipal.Id -and $_.PrincipalId -eq $user.Id} | Format-List
```

### Response
#### Success Response (200)
- **ObjectId** (string) - The object ID of the permission grant.
- **ClientId** (string) - The client ID of the service principal.
- **ConsentType** (string) - The type of consent granted.
- **Id** (string) - The unique identifier for the permission grant.
- **PrincipalId** (string) - The ID of the user or service principal.
- **ResourceId** (string) - The ID of the resource.
- **Scope** (string) - The granted scopes.

#### Response Example
```json
{
  "ObjectId": "E3fH4iJ5kL6mN7oP8qR9sT0uV1wX2",
  "ClientId": "22223333-cccc-4444-dddd-5555eeee6666",
  "ConsentType": "Principal",
  "Id": "E3fH4iJ5kL6mN7oP8qR9sT0uV1wX2",
  "PrincipalId": "aaaaaaaa-bbbb-cccc-1111-222222222222",
  "ResourceId": "c2c2c2c2-dddd-eeee-ffff-a3a3a3a3a3a3",
  "Scope": " User.Read.All openid profile offline_access Organization.Read.All User.ReadWrite.All Device.Read.All Device.ReadWrite.All Directory.Read.All User.Read RoleManagement.ReadWrite.Directory Group.ReadWrite.All",
  "AdditionalProperties": {}
}
```
```

--------------------------------

### Start Interactive Agent Identity Configuration

Source: https://github.com/microsoftdocs/entra-powershell-docs/blob/main/docs/reference/v1.0/Microsoft.Entra.Applications/Invoke-EntraAgentIdInteractive.md

This example initiates the interactive workflow for configuring Agent Identities. Ensure you are connected to Microsoft Entra with the necessary scopes before running.

```powershell
Connect-Entra -Scopes 'AgentIdentity.Create.All', 'AgentIdentityBlueprint.UpdateAuthProperties.All', 'AgentIdUser.ReadWrite.All', 'User.ReadBasic.All', 'AgentIdentityBlueprint.AddRemoveCreds.All', 'AgentIdentityBlueprint.ReadWrite.All' -TenantId <tenant ID>
Invoke-EntraAgentIdInteractive
```

--------------------------------

### List managed devices

Source: https://github.com/microsoftdocs/entra-powershell-docs/blob/main/docs/reference/v1.0/Microsoft.Entra.DirectoryManagement/Get-EntraDevice.md

This example demonstrates how to list devices that are managed.

```APIDOC
## Get-EntraDevice -Filter "isManaged eq true"

### Description
Retrieves a list of devices from Microsoft Entra ID that are marked as managed.

### Parameters
#### Query Parameters
- **Filter** (string) - Required - OData filter to select devices where 'isManaged' is true.

### Request Example
```powershell
Connect-Entra -Scopes 'Device.Read.All'
Get-EntraDevice -Filter "isManaged eq true"
```

### Response
#### Success Response (200)
Returns a collection of managed device objects.

#### Response Example
```json
[
  {
    "DeletedDateTime": null,
    "Id": "bbbbbbbb-1111-2222-3333-cccccccccccc",
    "AccountEnabled": true,
    "ApproximateLastSignInDateTime": null,
    "ComplianceExpirationDateTime": null,
    "DeviceCategory": null,
    "DeviceId": "eeeeeeee-4444-5555-6666-ffffffffffff",
    "DeviceMetadata": "MetaData",
    "DeviceOwnership": null,
    "isManaged": true
  }
]
```
```

--------------------------------

### Create a web application with support and marketing URIs

Source: https://github.com/microsoftdocs/entra-powershell-docs/blob/main/docs/reference/v1.0/Microsoft.Entra.Applications/New-EntraApplication.md

This command creates an application with support and marketing URLs to help users and admins identify and trust the app during consent or in the Microsoft Entra portal.

```powershell
Connect-Entra -Scopes 'Application.ReadWrite.All'

$informationalUrl = @{
    marketingUrl = "https://contoso.com/marketing"
    privacyStatementUrl = "https://contoso.com/privacy"
    supportUrl = "https://contoso.com/support"
    termsOfServiceUrl = "https://contoso.com/terms"
}

New-EntraApplication -DisplayName "Contoso Pay Portal" -InformationalUrl $informationalUrl
```

--------------------------------

### Get a single result

Source: https://github.com/microsoftdocs/entra-powershell-docs/blob/main/docs/reference/v1.0/Microsoft.Entra.Reports/Get-EntraAuthenticationMethodUserRegistrationDetailReport.md

This example shows how to get a single detail about the user's registered authentication methods. You can use `-Limit` as an alias for `-Top`.

```APIDOC
## Get-EntraAuthenticationMethodUserRegistrationDetailReport -Top

### Description
Retrieves a single user authentication method registration detail.

### Method
GET

### Endpoint
/users/{id}/authentication/methods

### Parameters
#### Query Parameters
- **top** (int) - Required: False - Specifies the maximum number of records to return. Alias: `-Limit`.

### Request Example
```powershell
Get-EntraAuthenticationMethodUserRegistrationDetailReport -Top 1
```

### Response
#### Success Response (200)
- **Id** (string) - The unique identifier for the authentication method registration.
- **IsAdmin** (boolean) - Indicates if the user is an administrator.
- **IsMfaCapable** (boolean) - Indicates if the user is capable of Multi-Factor Authentication.
- **IsMfaRegistered** (boolean) - Indicates if the user has Multi-Factor Authentication registered.
- **IsPasswordlessCapable** (boolean) - Indicates if the user has passwordless authentication capabilities.
- **IsSsprCapable** (boolean) - Indicates if the user has Self-Service Password Reset capabilities registered.
```

--------------------------------

### Get-EntraUser - Get top three users

Source: https://github.com/microsoftdocs/entra-powershell-docs/blob/main/docs/reference/v1.0/Microsoft.Entra.Users/Get-EntraUser.md

This example demonstrates how to get top three users from Microsoft Entra ID. You can use `-Limit` as an alias for `-Top`.

```APIDOC
## Get-EntraUser - Get top three users

### Description
Gets the top three users from Microsoft Entra ID.

### Method
GET

### Endpoint
/users

### Parameters
#### Query Parameters
- **Top** (Int32) - Optional - Specifies the maximum number of users to return.
- **Filter** (String) - Optional - Specifies a filter to apply to the user search.
- **All** - Optional - Retrieves all users, bypassing default pagination.
- **PageSize** (Int32) - Optional - Specifies the number of results per page.
- **Property** (String[]) - Optional - Specifies the properties to retrieve for each user.

### Request Example
```powershell
Connect-Entra -Scopes 'User.Read.All'
Get-EntraUser -Top 3
```

### Response
#### Success Response (200)
- **DisplayName** (String) - The display name of the user.
- **Id** (String) - The unique identifier of the user.
- **Mail** (String) - The email address of the user.
- **UserPrincipalName** (String) - The user principal name of the user.

#### Response Example
```json
{
  "example": "{\n  \"DisplayName\": \"Angel Brown\",\n  \"Id\": \"cccccccc-2222-3333-4444-dddddddddddd\",\n  \"Mail\": \"AngelB@contoso.com\",\n  \"UserPrincipalName\": \"AngelB@contoso.com\"\n}"
}
```
```

--------------------------------

### Create a policy with all conditions and controls

Source: https://github.com/microsoftdocs/entra-powershell-docs/blob/main/docs/reference/v1.0/Microsoft.Entra.SignIns/New-EntraConditionalAccessPolicy.md

This example demonstrates creating a conditional access policy with a comprehensive set of conditions and controls, including client application types, specific applications, users, and session controls like application enforced restrictions.

```powershell
Connect-Entra -Scopes 'Policy.ReadWrite.ConditionalAccess','Policy.Read.All'

$Condition = New-Object -TypeName Microsoft.Open.MSGraph.Model.ConditionalAccessConditionSet
$Condition.clientAppTypes = @("mobileAppsAndDesktopClients","browser")
$Condition.Applications = New-Object -TypeName Microsoft.Open.MSGraph.Model.ConditionalAccessApplicationCondition
$Condition.Applications.IncludeApplications = "00000002-0000-0ff1-ce00-000000000000"
$Condition.Users = New-Object -TypeName Microsoft.Open.MSGraph.Model.ConditionalAccessUserCondition
$Condition.Users.IncludeUsers = "all"

$Controls = New-Object -TypeName Microsoft.Open.MSGraph.Model.ConditionalAccessGrantControls
$Controls._Operator = "AND"
$Controls.BuiltInControls = @("mfa")

$SessionControls = New-Object -TypeName Microsoft.Open.MSGraph.Model.ConditionalAccessSessionControls
$ApplicationEnforcedRestrictions = New-Object Microsoft.Open.MSGraph.Model.ConditionalAccessApplicationEnforcedRestrictions
$ApplicationEnforcedRestrictions.IsEnabled = $true
$SessionControls.applicationEnforcedRestrictions = $ApplicationEnforcedRestrictions
New-EntraConditionalAccessPolicy -DisplayName 'MFA policy' -SessionControls $SessionControls -Conditions $conditions -GrantControls  $controls
```

--------------------------------

### Get a group by DisplayName

Source: https://github.com/microsoftdocs/entra-powershell-docs/blob/main/docs/reference/v1.0/Microsoft.Entra.Groups/Get-EntraGroup.md

This example retrieves a group using its Display Name.

```APIDOC
## Get a group by DisplayName

### Description
Retrieves a group by filtering on its Display Name.

### Method
GET

### Endpoint
/groups

### Parameters
#### Query Parameters
- **Filter** (String) - Required - Filters results where the Display Name equals the specified value (e.g., "DisplayName eq 'Azure Panda'").
- **All** - Optional - Retrieves all matching groups, bypassing default paging.
- **Top** (Int32) - Optional - Limits the number of returned groups.
- **Property** (String[]) - Optional - Specifies the properties to retrieve for the group.
- **HasErrorsOnly** - Optional - Filters to show only groups with service provisioning errors.
- **HasLicenseErrorsOnly** - Optional - Filters to show only groups with license assignment errors.

### Request Example
```powershell
Connect-Entra -Scopes 'GroupMember.Read.All'
Get-EntraGroup -Filter "DisplayName eq 'Azure Panda'"
```

### Response
#### Success Response (200)
- **DisplayName** (String) - The display name of the group.
- **Id** (String) - The unique identifier of the group.
- **MailNickname** (String) - The mail nickname of the group.
- **Description** (String) - The description of the group.
- **GroupTypes** (String[]) - The types of the group (e.g., 'Unified').

#### Response Example
```json
[
  {
    "DisplayName": "Azure Panda",
    "Id": "qqqqqqqq-5555-0000-1111-hhhhhhhhhhhh",
    "MailNickname": "azurepanda",
    "Description": "Azure Panda",
    "GroupTypes": ["Unified"]
  }
]
```
```

--------------------------------

### Create a group with Description parameter

Source: https://github.com/microsoftdocs/entra-powershell-docs/blob/main/docs/reference/v1.0/Microsoft.Entra.Groups/New-EntraGroup.md

This example demonstrates how to create the new group with description parameter.

```powershell
Connect-Entra -Scopes 'Group.ReadWrite.All','Group.Create'
$params = @{
    DisplayName = 'HelpDesk admin group'
    MailEnabled = $false
    MailNickname = 'helpDeskAdminGroup'
    SecurityEnabled = $true
    Description = 'Group assignable to role'
}

New-EntraGroup @params
```

```powershell

DisplayName          Id                                   MailNickname       Description              GroupTypes
-----------          --                                   ------------       -----------              ----------
HelpDesk admin group zzzzzzzz-6666-8888-9999-pppppppppppp helpDeskAdminGroup Group assignable to role {}
```

--------------------------------

### Create an administrative unit

Source: https://github.com/microsoftdocs/entra-powershell-docs/blob/main/docs/reference/v1.0/Microsoft.Entra.DirectoryManagement/New-EntraAdministrativeUnit.md

This example demonstrates how to create an administrative unit.

```APIDOC
## New-EntraAdministrativeUnit

### Description
Creates an administrative unit.

### Method
POST

### Endpoint
/administrativeUnits

### Parameters
#### Path Parameters
None

#### Query Parameters
None

#### Request Body
- **displayName** (String) - Required - The display name for the administrative unit object.
- **description** (String) - Optional - A description for the administrative unit object.
- **membershipType** (String) - Optional - The membership type of the administrative unit. Possible values are: dynamic and assigned. If not set, the default value is null, and the membership type defaults to assigned.
- **membershipRule** (String) - Optional - The dynamic membership rule applied to the administrative unit.
- **membershipRuleProcessingState** (String) - Optional - Controls if the dynamic membership rule is active. Set to `On` to enable it or `Paused` to stop updates.
- **visibility** (String) - Optional - Specifies the visibility of the administrative unit. Defaults to `public` if not set. Set to `HiddenMembership` to hide membership from nonmembers.

### Request Example
```json
{
  "displayName": "TestAU"
}
```

### Response
#### Success Response (201 Created)
- **id** (String) - The unique identifier for the administrative unit.
- **displayName** (String) - The display name of the administrative unit.
- **description** (String) - The description of the administrative unit.
- **membershipType** (String) - The type of membership for the administrative unit.
- **membershipRule** (String) - The rule used for dynamic membership.
- **membershipRuleProcessingState** (String) - The state of the membership rule processing.
- **visibility** (String) - The visibility of the administrative unit.

#### Response Example
```json
{
  "deletedDateTime": null,
  "id": "bbbbbbbb-1111-2222-3333-cccccccccccc",
  "description": "",
  "displayName": "TestAU",
  "visibility": "Public"
}
```
```

--------------------------------

### Create an Agent User with prompts

Source: https://github.com/microsoftdocs/entra-powershell-docs/blob/main/docs/reference/v1.0/Microsoft.Entra.Users/New-EntraAgentUserForAgentId.md

This example creates an Agent User. The cmdlet will prompt for the user principal name if not provided. Assumes Agent Identity Blueprint and Agent Identity are already created.

```powershell
Connect-Entra -Scopes 'AgentIdentityBlueprint.Create', 'AgentIdentityBlueprintPrincipal.Create', 'AgentIdentity.Create.All', 'AgentIdentityBlueprint.UpdateAuthProperties.All', 'AgentIdUser.ReadWrite.All'
# Assumes Agent Identity Blueprint and Agent Identity are already created
New-EntraAgentUserForAgentId -DisplayName "HR Agent User"
```

--------------------------------

### Get groups in which a contact is a member

Source: https://github.com/microsoftdocs/entra-powershell-docs/blob/main/docs/reference/v1.0/Microsoft.Entra.Groups/Select-EntraGroupIdsContactIsMemberOf.md

This example demonstrates how to get groups in which a contact is a member. It requires connecting to Entra ID with appropriate scopes and then specifying the contact and group IDs.

```powershell
Connect-Entra -Scopes 'OrgContact.Read.All,Group.Read.All'
$group = New-Object Microsoft.Open.AzureAD.Model.GroupIdsForMembershipCheck
$group.GroupIds = (Get-EntraGroup -Filter "displayName eq 'Sales and Marketing'").Id
$contact = Get-EntraContact -Filter "displayName eq 'Contoso Admin'"
Select-EntraGroupIdsContactIsMemberOf -OrgContactId $contact.Id -GroupIdsForMembershipCheck $group
```