Set Up Microsoft Entra Application Management Policies Using Graph API

In Microsoft 365 organizations, various applications are registered and integrated to support different business needs. These applications authenticate using client secrets, symmetric keys, or certificates to request access tokens. Therefore, managing these credentials is crucial for securing access, as they can become a significant security risk if left unmanaged or allowed to exist for too long.

To address these risks, Microsoft Entra provides application management policies, which allow admins to enforce specific rules on how application credentials, such as secrets and keys, are created, stored, and maintained. By implementing these policies, you can ensure that credentials are properly managed, reducing the likelihood of unauthorized access and enhancing your overall security posture.

In this blog, let’s explore how to set up Microsoft Entra application management policies. These policies help enforce robust credential governance and enhance app security in Microsoft 365.

Application Management Policies in Microsoft Entra allow admins to enforce security best practices for applications, such as blocking passwords, disallowing custom secrets, and controlling their expiration based on the app’s creation date. By leveraging the creation date of applications or service principals, admins can not only ensure that new applications comply with strict security standards but also apply the same policies to existing applications over time.

These policies can be applied globally (tenant-wide) or specifically to individual applications. This approach helps organizations assess app security, enforce tailored controls, and strengthen control over application identities to reduce unauthorized access.

Tip: To ensure applications’ client secrets and certificates are renewed before they expire, you can export a list of all applications with expiring credentials using PowerShell.

• Tenant Default Policy
• App Management Policy

A tenant default policy is a single object that applies to all applications and service principals within the tenant.

It includes two key properties:

• applicationRestrictions: Targets applications owned by the tenant (application objects).
• servicePrincipalRestrictions: Targets service principals provisioned from another tenant (service principal objects).

These properties allow organizations to separately control the configuration of apps originating from their tenant and externally owned applications that their tenant interacts with.

App management policies in Microsoft Entra allow admins to create and customize restrictions for specific applications or service principals. These policies override the tenant default policy settings. Only one app management policy can be assigned to an application or service principal at a time.

Scenario	Outcome
Both the tenant default policy and app management policy define the same restriction.	App management policy takes precedence.
A restriction is disabled in the app management policy.	The restriction will not apply to linked apps, even if it’s enabled in the tenant default policy.
A restriction is not defined in the app management policy.	The restriction from the tenant default policy will apply.

Let’s explore how to configure app management policies in Microsoft Entra using the Graph API. Depending on your requirements, you can work with either the default tenant policy or create custom app policies.

• Configuring the default app management policies
• Setting up custom app management policies

Requirements: You need to be an Application Administrator or Cloud Application Administrator to manage authentication method policies.

By default, the tenant app management policy is disabled. You can follow the steps below to enable and update the default tenant policy using Graph Explorer.

View the Default Tenant App Management Policy

Before updating the default app management policy in Microsoft Entra, it’s crucial to first understand how it is currently configured. This helps ensure any changes align with your organization’s existing security posture and policy requirements.

You can view how the default tenant app management policy is set in your organization using the following steps.

1. Sign in to Microsoft Graph Explorer using your Microsoft 365 account.
2. Set the HTTP request method to GET.
3. Enter the following API in the HTTP request URL:
   https://graph.microsoft.com/v1.0/policies/defaultAppManagementPolicy
4. On the Modify Permissions tab, click Consent on the Policy.Read.All permissions.
5. Click Run Query to execute the request.

This retrieves how the default Microsoft Entra app management policy is configured for all your applications and service principals, allowing you to track the necessary updates needed for the policy.

Update the Tenant App Management Policy

Once you’ve reviewed the current settings, follow the steps below to enable and update the policy using the Graph API.

1. Sign in to Microsoft Graph Explorer using a M365 account.
2. In the HTTP request bar, set the HTTP method to PATCH.
3. Set the HTTP request URL to the following API:
   https://graph.microsoft.com/v1.0/policies/defaultAppManagementPolicy
4. Go to the “Modify Permissions” tab and click the “Consent ” button near the “Policy.Read.ApplicationConfiguration” to grant the required permission to Graph Explorer.
5. Enter the following JSON format in the Request Body and click Run query.

The above JSON format enables the tenant app management policy and applies various restrictions on passwords and key credentials. This includes setting a maximum lifetime of 90 days for password secrets, symmetric keys, and asymmetric keys for all applications created after January 21, 2024.

Note: You can modify the policy settings configuration as per your organization’s requirements.

If successful, this method returns a “204 No Content response” code. It doesn’t return anything in the response body.

Every application in your environment has unique security needs. While some applications may only require basic security settings, others may demand more specific, granular controls to meet compliance or organizational requirements. In these cases, Microsoft Entra allows you to create and assign custom app management policies tailored to the specific needs of each application, ensuring optimal security and control for your entire application landscape.

Now, let’s see how to create and assign app authorization policies in Microsoft Entra.

• Create an app management policy in Microsoft Entra
• Assign the policy to an application
• Update the app management policy
• Remove the policy from an application
• Delete the app management policy

1. Create an App Management Policy in Microsoft Entra

Follow the steps below to create an app management policy in Microsoft Entra.

1. Sign in to Microsoft Graph Explorer with a Microsoft 365 account.
2. In the HTTP request bar, set the HTTP method to POST.
3. Set the HTTP request URL to the following API:
   https://graph.microsoft.com/v1.0/policies/appManagementPolicies
4. Go to the “Modify Permissions” tab and click the “Consent” button near “Policy.Read.ApplicationConfiguration” to grant the required permission to Graph Explorer.
5. Enter the following JSON format in the Request Body and click Run query.

The above format creates a custom app management policy named “Custom App Management Policy” and sets the following restrictions:

• Blocks the creation of new passwords and symmetric keys.
• Limits the lifetime of passwords and symmetric keys to 30 days for applications created on or after October 19th, 2021, at 10:37 AM UTC.

If successful, this method returns a “201 Created response code” with the new app management settings in the response payload.

After creating app management policies, you can list all the ones configured in your organization by following these steps.

1. Set the HTTP request method to GET.
2. Enter the following API in the HTTP request URL:
   https://graph.microsoft.com/v1.0/policies/appManagementPolicies
3. On the Modify Permissions tab, click “Consent ” next to the Policy.Read.All permission.
4. Click Run query to execute the request and retrieve the list of app management policies.

This retrieves detailed information about all created policies, including their IDs, and configuration settings.
Note: The policy ID retrieved in this method will be used for all the processes below.

Handy Tip: To view the settings of a specific app management policy, use the following API in the HTTP request URL.
https://graph.microsoft.com/v1.0/policies/appManagementPolicies/<id>
Replace <id> with the ID of the policy you want to view.

After creating a custom policy, you need to assign the app management policy object to a specific application to override the default tenant policy.

Follow the steps below to assign the policy to a Microsoft Entra ID application.

1. Sign in to Microsoft Graph Explorer using a Microsoft 365 account.
2. In the HTTP request bar, set the HTTP method to POST.
3. Set the request URL to the following API:
   https://graph.microsoft.com/v1.0/applications/<id>/appManagementPolicies/$ref
   Replace <id> with the object ID of the application to which you want to apply the policy.
4. Go to the Modify Permissions tab, then grant consent for the Policy.ReadWrite.ApplicationConfiguration and Application.ReadWrite.All permissions, if not already granted.
5. In the Request Body, enter the following JSON format. Replace <PolicyID> with the object ID of the app management policy you created.
   {
   “@odata.id”: “https://graph.microsoft.com/v1.0/policies/appManagementPolicies/<PolicyID>”
   }
6. Click Run query to assign the policy to the application.

If successful, this method returns a “204 No Content response” code. It doesn’t return anything in the response body.

Note: You can use the following API in the HTTP request URL to assign an appManagementPolicy to a service Principal.
https://graph.microsoft.com/v1.0/servicePrincipals/<ServicePrincipalObjectID>/appManagementPolicies/$ref

You can track all applications and service principals where a specific app management policy is applied by following the steps below.

1. Set the HTTP request method to GET.
2. Enter the following API in the HTTP request URL:
   https://graph.microsoft.com/v1.0/policies/appManagementPolicies/<id>/appliesTo
   Replace <id> with the ID of the app management policy you want to view.
3. On the Modify Permissions tab, click Consent next to Policy.Read.All if required.
4. Click Run query to execute the request.

If successful, this method returns a “200 OK response” along with a collection of application and service principal objects to which the policy is currently applied.

Note: Only one custom policy can be applied to a Microsoft Entra app.

As organizational requirements change over time, you may need to adjust the restrictions defined in your application management policies. Microsoft Entra allows you to update existing policies easily, helping you maintain strong security controls while adapting to evolving app governance needs.

Follow the steps below to update a custom app management policy.

1. Sign in to Microsoft Graph Explorer using a Microsoft 365 account.
2. In the HTTP request bar, set the HTTP method to PATCH.
3. Enter the following API in the HTTP request URL:
   https://graph.microsoft.com/v1.0/policies/appManagementPolicies/<id>
   Replace <id> with the ID of the app management policy you want to update.
4. On the Modify Permissions tab, click ” Consent ” next to the Policy.ReadWrite.ApplicationConfiguration permission.
5. In the Request Body, supply only the values for properties to update and click Run query.

If successful, the request returns a “204 No Content response”.

If a custom app management policy is no longer needed for a specific application, you can unassign it using the Microsoft Graph API.

1. Sign in to Microsoft Graph Explorer with your Microsoft 365 account.
2. Set the HTTP method to DELETE.
3. Enter the following API in the HTTP request URL:
   https://graph.microsoft.com/v1.0/applications/<AppObjectID>/appManagementPolicies/<PolicyID>/$ref
   Replace <AppObjectID> and <PolicyID> with the IDs of the application and the app management policy you want to remove.
4. Click Run Query to execute the request.

If successful, this operation returns a “204 No Content response”, confirming that the policy has been removed from the application.

When an app management policy is no longer required, such as when it becomes outdated or does not match current security standards, it should be reviewed for removal. Deleting the policy is especially important in use cases like decommissioning legacy applications, eliminating redundant access paths, or tightening security during audits or organizational restructuring.

Follow the steps below to delete the app management policy using Microsoft Graph Explorer.

1. Sign in to Microsoft Graph Explorer with your Microsoft 365 account.
2. In the HTTP request bar, set the HTTP method to DELETE.
3. Set the HTTP request URL to the following API:
   https://graph.microsoft.com/v1.0/policies/appManagementPolicies/<id>
   Replace <id>with the ID of the policy you want to delete.
4. Go to the Modify Permissions tab and grant Consent to the Policy.Read.ApplicationConfiguration permission.
5. Click Run Query to delete the specified app management policy from Microsoft 365.

If successful, this operation returns a 204 No Content response, indicating that the policy was deleted. No response body is returned.

Note: Just like outdated application management policies, outdated app credentials, or unused applications pose a significant security risk. They can create loopholes for attackers and increase your organization’s attack surface. Therefore, it is recommended to remove unused credentials from applications and delete outdated apps in Microsoft Entra.

While these policies help you secure the Microsoft Entra application secrets, it is also important to manage user consent to applications, review app permissions, and follow Secure Score recommendations for stronger protection.

We hope this blog has provided valuable insights into setting up and managing app management policies in Microsoft Entra. If you have any questions or need further assistance, feel free to leave a comment below.