|
| 1 | +--- |
| 2 | +title: Add an Owner to an Application Using Microsoft Graph |
| 3 | +description: Introduces how to add an owner (service principle) to an application using Microsoft Graph. |
| 4 | +ms.date: 04/03/2025 |
| 5 | +ms.reviewer: willfid, v-weizhu |
| 6 | +ms.service: entra-id |
| 7 | +ms.custom: sap:Getting access denied errors (Authorization) |
| 8 | +--- |
| 9 | +# Add an owner to an application using Microsoft Graph |
| 10 | + |
| 11 | +When an application is authenticated, you might want to be able to update its own properties such as the client secret or certificate. To do so, the application must be an owner of itself. You can implement this using the [Microsoft Graph API - Add owner](/graph/api/application-post-owners). |
| 12 | + |
| 13 | +This article outlines the required permission and step-by-step instructions to add a service principal associated with an application as an owner of the application using Microsoft Graph. |
| 14 | + |
| 15 | +## Required permission |
| 16 | + |
| 17 | +The least privileged permissions for adding an owner to an application are described in the [Add owner - Permissions](/graph/api/application-post-owners#permissions) table. These permissions, such as `Application.ReadWrite.OwnedBy`, allow an application to manage applications of which it is an owner. |
| 18 | + |
| 19 | +## Add an owner |
| 20 | + |
| 21 | +Application owners can be individual users, the associated service principal, or another service principal. The following sections describe how to add the related service principal to an application as an owner. |
| 22 | + |
| 23 | +### Step 1: Get the application's Object ID |
| 24 | + |
| 25 | +To get the **Object ID** of the application you want to add an owner to, follow these steps: |
| 26 | + |
| 27 | +1. Sign in to the [Azure portal](https://portal.azure.com). |
| 28 | +2. Navigate to the Microsoft Entra admin center. |
| 29 | +3. Browse to **Identity** > **Applications** > **App registrations**. |
| 30 | +4. Locate the application and copy its **Object ID**. |
| 31 | + |
| 32 | + :::image type="content" source="media/add-owner-for-application-microsoft-graph/application-object-id.png" alt-text="Screenshot that shows an application's Object ID."::: |
| 33 | + |
| 34 | +### Step 2: Get the owner (service principal's Object ID) |
| 35 | + |
| 36 | +To get the **Object ID** of the service principal associated with the application, follow these steps: |
| 37 | + |
| 38 | +1. Sign in to the [Azure portal](https://portal.azure.com). |
| 39 | +2. Navigate to the Microsoft Entra admin center. |
| 40 | +3. Browse to **Identity** > **Applications** > **Enterprise registrations**. |
| 41 | +4. Locate the application and copy its **Object ID**. |
| 42 | + |
| 43 | + :::image type="content" source="media/add-owner-for-application-microsoft-graph/service-principle-object-id.png" alt-text="Screenshot that shows an service principal's Object ID."::: |
| 44 | + |
| 45 | +### Step 3: Add the owner to the application |
| 46 | + |
| 47 | +Here're two methods to do this: |
| 48 | + |
| 49 | +- [Method 1: Using Microsoft Graph Explorer](#method-1-using-microsoft-graph-explorer) |
| 50 | +- [Method 2: Using Microsoft Graph PowerShell](#method-2-using-microsoft-graph-powershell) |
| 51 | + |
| 52 | +#### Method 1: Using Microsoft Graph Explorer |
| 53 | + |
| 54 | +1. Navigate to [Microsoft Graph Explorer](https://developer.microsoft.com/graph/graph-explorer). |
| 55 | +2. Sign in with a user account that has the necessary permissions to update application owners, such as a Global Administrator or Application Administrator. |
| 56 | +3. Use the following request: |
| 57 | + |
| 58 | + ```msgraph-interactive |
| 59 | + POST https://graph.microsoft.com/v1.0/applications/{application-object-id}/owners/$ref |
| 60 | +
|
| 61 | + Content-Type: application/json |
| 62 | +
|
| 63 | + { |
| 64 | + "@odata.id": "https://graph.microsoft.com/v1.0/directoryObjects/{service-principal-id}" |
| 65 | + } |
| 66 | + ``` |
| 67 | +
|
| 68 | + > [!NOTE] |
| 69 | + > Replace `{application-object-id}` with the **Object ID** of your application and `{service-principal-id}` with the **Object ID** of the service principal. |
| 70 | +
|
| 71 | + Here's an example of what it looks like in Microsoft Graph Explorer: |
| 72 | +
|
| 73 | + :::image type="content" source="media/add-owner-for-application-microsoft-graph/microsoft-graph-api-call.png" alt-text="Screenshot that shows a request in Microsoft Graph Explorer." lightbox="media/add-owner-for-application-microsoft-graph/microsoft-graph-api-call.png"::: |
| 74 | +
|
| 75 | +
|
| 76 | +##### Troubleshoot Forbidden (403) error |
| 77 | +
|
| 78 | +You might encounter the following error during this process: |
| 79 | +
|
| 80 | +```output |
| 81 | +"error": { |
| 82 | +"code": "Authorization_RequestDenied", |
| 83 | +"message": "Insufficient privileges to complete the operation.", |
| 84 | +"innerError": { |
| 85 | +"date": "2021-12-09T17:41:54", |
| 86 | +"request-id": "b1909fc0-aa5c-4b43-8a1f-xxxxxxxxxxxx", |
| 87 | +"client-request-id": "836e08bb-a12d-4ade-c761-xxxxxxxxxxxx" |
| 88 | +} |
| 89 | +} |
| 90 | +``` |
| 91 | + |
| 92 | +To resolve the issue, consent to the API permission **Application.ReadWrite.All** for Microsoft Graph Explorer under the **Modify permissions** tab. |
| 93 | + |
| 94 | +:::image type="content" source="media/add-owner-for-application-microsoft-graph/modify-permissions.png" alt-text="Screenshot that shows how to modify permission in Microsoft Graph Explorer." lightbox="media/add-owner-for-application-microsoft-graph/modify-permissions.png"::: |
| 95 | + |
| 96 | +#### Method 2: Using Microsoft Graph PowerShell |
| 97 | + |
| 98 | +Here's an example of Microsoft Graph PowerShell scripts to add an owner to an application: |
| 99 | + |
| 100 | +```powershell |
| 101 | +Connect-MgGraph -Scopes Application.ReadWrite.All |
| 102 | +
|
| 103 | +# Owner |
| 104 | +$OwnerServicePrincipalObjectId = "96858eb3-xxxx-xxxx-xxxx-33a6b0dc2430" |
| 105 | +
|
| 106 | +# Application to add owner to |
| 107 | +$ApplicationObjectId = "b7463aa1-xxxx-xxxx-xxxx-0963d6c00485" |
| 108 | +
|
| 109 | +$Owner = @{ |
| 110 | + "@odata.id" = "https://graph.microsoft.com/v1.0/directoryObjects/$($OwnerServicePrincipalObjectId)" |
| 111 | +} |
| 112 | +
|
| 113 | +New-MgApplicationOwnerByRef -ApplicationId $ApplicationObjectId -BodyParameter $Owner |
| 114 | +``` |
| 115 | + |
| 116 | +[!INCLUDE [Azure Help Support](../../../includes/azure-help-support.md)] |
0 commit comments