New-EntraApplication

New-EntraApplication
    -DisplayName <String>
    [-SignInAudience <String>]
    [-IdentifierUris <List[String]>]
    [-IsDeviceOnlyAuthSupported <Boolean>]
    [-IsFallbackPublicClient <Boolean>]
    [-AppRoles <List[MicrosoftGraphAppRole]>]
    [-RequiredResourceAccess <MicrosoftGraphRequiredResourceAccess[]>]
    [-Api <MicrosoftGraphApiApplication>]
    [-PublicClient <MicrosoftGraphPublicClientApplication>]
    [-Web <MicrosoftGraphWebApplication>]
    [-InformationalUrl <MicrosoftGraphInformationalUrl>]
    [-ParentalControlSettings <MicrosoftGraphParentalControlSettings>]
    [-OptionalClaims <MicrosoftGraphOptionalClaims>]
    [-AddIns <Object[]>]
    [-KeyCredentials <Object[]>]
    [-PasswordCredentials <MicrosoftGraphPasswordCredential[]>]
    [-Tags <List[String]>]
    [-GroupMembershipClaims <String>]
    [-TokenEncryptionKeyId <String>]
    [-WhatIf]
    [-Confirm]
    [<CommonParameters>]

New-EntraApplication
    -AdditionalProperties <Hashtable>
    [-DisplayName <String>]
    [-WhatIf]
    [-Confirm]
    [<CommonParameters>]

该 New-EntraApplication cmdlet 在Microsoft Entra ID中创建新的应用程序注册。 可以为不同的身份验证方案（包括单租户或多租户）配置应用程序，并且可以使用各种凭据类型。

Connect-Entra -Scopes 'Application.ReadWrite.All'
New-EntraApplication -DisplayName 'Contoso HR App'

DisplayName               Id                                   AppId                                SignInAudience PublisherDomain
-----------               --                                   -----                                -------------- ---------------
Contoso HR Onboarding App dddd3333-ee44-5555-66ff-777777aaaaaa 22223333-cccc-4444-dddd-5555eeee6666 AzureADMyOrg   contoso.com

此命令使用默认设置创建基本应用程序注册。

Connect-Entra -Scopes 'Application.ReadWrite.All'
New-EntraApplication -DisplayName 'Contoso Partner API' -SignInAudience 'AzureADMultipleOrgs'

DisplayName               Id                                   AppId                                SignInAudience PublisherDomain
-----------               --                                   -----                                -------------- ---------------
Contoso Partner API   dddd3333-ee44-5555-66ff-777777aaaaaa 22223333-cccc-4444-dddd-5555eeee6666 AzureADMyOrg   contoso.com

此命令创建一个应用程序，该应用程序可由任何Microsoft Entra ID租户中的帐户使用。

Connect-Entra -Scopes 'Application.ReadWrite.All'
$passwordCred = [Microsoft.Graph.PowerShell.Models.MicrosoftGraphPasswordCredential]@{
    DisplayName = 'AI automation Cred'
    StartDateTime = [DateTime]::UtcNow
    EndDateTime = [DateTime]::UtcNow.AddYears(1)
}

$app = New-EntraApplication -DisplayName 'Contoso Automation App' -PasswordCredentials @($passwordCred)
$app.PasswordCredentials.SecretText

此命令使用密码凭据（客户端密码）创建应用程序。 机密值在响应中返回。

Connect-Entra -Scopes 'Application.ReadWrite.All'
$msGraphAccess = @{
    ResourceAppId = "00000003-0000-0000-c000-000000000000"  # Microsoft Graph
    ResourceAccess = @(
        @{
            Id = "e1fe6dd8-ba31-4d61-89e7-88639da4683d"  # User.Read
            Type = "Scope"
        },
        @{
            Id = "df021288-bdef-4463-88db-98f22de89214"  # User.ReadWrite.All
            Type = "Role"
        }
    )
}

New-EntraApplication -DisplayName "User Management App" -RequiredResourceAccess @($msGraphAccess)

此命令创建具有指定Microsoft 图形 API权限的应用程序。

Connect-Entra -Scopes 'Application.ReadWrite.All'
$addIn = @{
    Id         = "00000002-0000-0ff1-ce00-000000000000"  # Outlook's service principal ID
    Type       = "messageReadCommandSurface"          # UI surface
    Properties = @(
        @{ Key = "extensionId"; Value = "Contoso.EmailInsights" },
        @{ Key = "sourceLocation"; Value = "https://contoso.com/addin/home.html" },
        @{ Key = "supportedLocales"; Value = "en-US" }
    )
}

New-EntraApplication -DisplayName "Contoso Email Insights" -AddIns $addIn

此示例向 Microsoft Entra ID 注册 Contoso Email Insights 加载项，以便它可以与 Web 上的Outlook集成，并通过 AppSource 旁加载或发布。

Connect-Entra -Scopes 'Application.ReadWrite.All'
$appRoles = @(
    @{
        id = [Guid]::NewGuid()
        allowedMemberTypes = @("User", "Application")
        description = "Read-only access to HR data"
        displayName = "HR Reader"
        isEnabled = $true
        value = "HRReader"
        origin = "Application"
    },
    @{
        id = [Guid]::NewGuid()
        allowedMemberTypes = @("User", "Application")
        description = "Manage HR data"
        displayName = "HR Manager"
        isEnabled = $true
        value = "HRManager"
        origin = "Application"
    }
)

# Create the new application registration with AppRoles
New-EntraApplication -DisplayName "Contoso Sandbox" -AppRoles $appRoles

此示例注册调用的多租户 API Contoso Sandbox 并定义两个自定义角色：HRReader用于read-only访问和HRManagerfull access访问员工数据。

Connect-Entra -Scopes 'Application.ReadWrite.All'
New-EntraApplication -DisplayName 'Contoso App' -IdentifierUris 'https://myselfserve.contoso.com'

此命令使用标识符 URI 创建应用程序。

Connect-Entra -Scopes 'Application.ReadWrite.All'
$props = @{
    displayName = "Advanced Configuration App"
    signInAudience = "AzureADMyOrg"
    api = @{
        oauth2PermissionScopes = @(
            @{
                id = [Guid]::NewGuid().ToString("D")
                adminConsentDescription = "Allow the app to access resources on user's behalf"
                adminConsentDisplayName = "Access resources"
                isEnabled = $true
                type = "Admin"
                value = "access"
            }
        )
    }
}

New-EntraApplication -AdditionalProperties $props

此命令使用 AdditionalProperties 参数为高级配置创建应用程序。

Connect-Entra -Scopes 'Application.ReadWrite.All'
New-EntraApplication -DisplayName "Contoso Tagged App" `
    -SignInAudience "AzureADMultipleOrgs" `
    -Tags @(
        "WindowsAzureActiveDirectoryIntegratedApp",
        "HideApp",
        "CertifiedApp"
    )

此示例创建多租户企业应用，并添加标记以支持Microsoft 合作伙伴中心发现和管理员同意筛选。

Connect-Entra -Scopes 'Application.ReadWrite.All'

# Define the PublicClient object with redirect URIs
$publicClient = @{
    redirectUris = @("https://login.microsoftonline.com/common/oauth2/nativeclient")
}

New-EntraApplication -DisplayName "Contoso PowerShell Client" `
    -SignInAudience "AzureADMyOrg" `
    -PublicClient $publicClient

此示例演示如何使用重定向 URI 注册公共客户端应用进行本地测试，例如用于以交互方式对用户进行身份验证的 Android 或 iOS 应用。

Connect-Entra -Scopes 'Application.ReadWrite.All'

# Define custom scopes for the API
$api = @{
    oauth2PermissionScopes = @(
        @{
            id = [Guid]::NewGuid()
            adminConsentDescription = "Allow the app to read user profiles."
            adminConsentDisplayName = "Read user profiles"
            isEnabled = $true
            type = "User"
            value = "Employee.Read"
        },
        @{
            id = [Guid]::NewGuid()
            adminConsentDescription = "Allow the app to write user profiles."
            adminConsentDisplayName = "Write user profiles"
            isEnabled = $true
            type = "User"
            value = "Employee.Write"
        }
    )
}

New-EntraApplication -DisplayName "Contoso API App" -Api $api

此示例演示如何使用参数注册应用程序并定义其可用权限 -Api 。

Connect-Entra -Scopes 'Application.ReadWrite.All'
# Define the RequiredResourceAccess for Microsoft Graph API
$graphResourceAccess = @{
    ResourceAppId = '00000003-0000-0000-c000-000000000000'  # Microsoft Graph API AppID
    ResourceAccess = @(
        @{
            Id = 'e1fe6dd8-ba31-4d61-89e7-88639da4683d'  # GUID for 'User.Read' permission
            Type = 'Scope'  # Type of permission
        }
    )
}

# Define the RequiredResourceAccess for Azure Service Management API
$serviceManagementResourceAccess = @{
    ResourceAppId = '797f4846-ba00-4fd7-ba43-dac1f8f63013'  # Azure Service Management API ID
    ResourceAccess = @(
        @{
            Id = '41094075-9dad-400e-a0bd-54e686782033'  # GUID for 'user_impersonation'
            Type = 'Scope'  # Type of permission
        }
    )
}

# Combine both resource accesses into an array
$RequiredResourceAccess = @($graphResourceAccess, $serviceManagementResourceAccess)

# Create a new application with the required resource access
New-EntraApplication -DisplayName 'Contoso Service App' -RequiredResourceAccess $RequiredResourceAccess

此示例创建一个调用 Contoso Service App 的新应用程序，并通过在注册期间指定所需的资源访问来 Microsoft Graph 授予它调用（例如 User.Read）和 Azure Service Management API （user_impersonation）的委托权限。

Connect-Entra -Scopes 'Application.ReadWrite.All'
$web = @{
    redirectUris = @("https://contoso.com/auth", "https://contoso.com/auth/callback")
    implicitGrantSettings = @{
        enableAccessTokenIssuance = $true
        enableIdTokenIssuance = $true
    }
    logoutUrl = "https://contoso.com/logout"
}

New-EntraApplication -DisplayName "Contoso Web App" -Web $web

此命令使用重定向 URI 和隐式授予设置创建 Web 应用程序。

Connect-Entra -Scopes 'Application.ReadWrite.All'

$informationalUrl = @{
    marketingUrl = "https://contoso.com/marketing"
    privacyStatementUrl = "https://contoso.com/privacy"
    supportUrl = "https://contoso.com/support"
    termsOfServiceUrl = "https://contoso.com/terms"
}

New-EntraApplication -DisplayName "Contoso Pay Portal" -InformationalUrl $informationalUrl

此命令创建一个支持和营销 URL 的应用程序，以帮助用户和管理员在许可期间或在Microsoft Entra门户中识别和信任应用。

Connect-Entra -Scopes 'Application.ReadWrite.All'

$optionalClaims = @{
    idToken = @(
        @{
            name = "email"
            source = $null # user, directory, $null
            essential = $true
            additionalProperties = @{}
        }
    )
    accessToken = @(
        @{
            name = "roles"
            source = $null # user, directory, $null
            essential = $false
            additionalProperties = @{}
        }
    )
}

New-EntraApplication -DisplayName "Contoso Claims App" -OptionalClaims $optionalClaims

此命令创建一个应用程序，其中包含可选声明，例如 ID 令牌中的电子邮件、upn（userPrincipalName）声明，以及用于自定义会话跟踪和用户标识解析的访问令牌中的 sid（会话 ID）声明。

Connect-Entra -Scopes 'Application.ReadWrite.All'

# Define parental control settings
$parentalControlSettings = @{
    countriesBlockedForMinors = @("DE", "FR")   # ISO country codes
    legalAgeGroupRule = "RequireConsentForMinors"
}

# Create the app with parental control settings
New-EntraApplication -DisplayName "Contoso Kids Stream" `
    -SignInAudience "AzureADandPersonalMicrosoftAccount" `
    -ParentalControlSettings $parentalControlSettings

此命令使用家长控制设置创建应用程序。 例如，它可以限制对特定国家（如德国和法国）儿童“Contoso 儿童流”等流式处理应用的访问权限，以满足合规性要求。

Connect-Entra -Scopes 'Application.ReadWrite.All'
$cert = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2("C:\Certificates\MyCertificate.cer")
$thumbprint = $cert.Thumbprint
$base64Cert = [Convert]::ToBase64String($cert.RawData)

$keyCred = @{
    CustomKeyIdentifier = $thumbprint
    Type = "AsymmetricX509Cert"
    Usage = "Verify"
    Key = $base64Cert
    DisplayName = "App Certificate"
    StartDateTime = [DateTime]::UtcNow
    EndDateTime = [DateTime]::UtcNow.AddYears(1)
}

New-EntraApplication -DisplayName "Contoso Certificate App" -KeyCredentials @($keyCred)

此命令使用证书凭据创建应用程序。

此 cmdlet 支持通用参数：-Debug、-ErrorAction、-ErrorVariable、-InformationAction、-InformationVariable、-OutBuffer、-OutVariable、-PipelineVariable、-ProgressAction、-Verbose、-WarningAction 和 -WarningVariable。 有关详细信息，请参阅 about_CommonParameters。

此 cmdlet 不接受管道输入。

返回表示创建的Microsoft Entra应用程序的自定义对象。

• 此 cmdlet 需要“Application.ReadWrite.All”权限范围。
• 使用证书凭据时，请确保适当的证书管理做法：
  • 使用强密钥大小（RSA 2048 位或更高版本）
  • 安全地存储私钥
  • 在过期前实现证书轮换
• 仅当无法使用证书时，才应使用密码凭据（客户端密码）。
• 有关安全最佳做法，请考虑：
  • 分配 API 权限时使用最低特权原则
  • 将应用程序角色限制为仅必需角色
  • 对敏感应用程序使用条件访问策略
  • 实现正确的凭据轮换过程