Terraform Provider

Create governed Microsoft Entra application requests as code while retaining AZExecute approval, metadata, permission, registration, and deletion policy. The product guide explains the supported lifecycle and links to the complete official provider reference on the Terraform Registry.

MCP for AI agents

Authorized AI agents can connect to the remote MCP endpoint and use the supported customer API through the same Microsoft Entra identity, tenant boundary, and API roles used by REST clients.

For assistants used by people, start with delegated MCP access in each user's context. The guide covers creating the OAuth connection, adding it as an agent tool, each user's sign-in, access verification, and automatic client secret rotation. Use an agent identity when you deliberately want a shared operational role.

MCP provides searchable operation discovery, detailed input contracts, dedicated automation-task tools, and safe invocation of documented operations. Agents can also create and configure saved tasks using typed step schemas and enabled integration references. Publication is optional; see workflow authoring with integrations.

Authentication Model

The API uses Microsoft Entra ID with OAuth 2.0 / OpenID Connect. Clients authenticate against Entra ID and call API endpoints with a bearer token in the Authorization header.

How To Call the API

For endpoint-specific examples and role requirements, continue with the API documentation pages in this section.

Explore the Public API

The live Swagger documentation is the authoritative reference for supported endpoints, HTTP methods, parameters, request bodies, response schemas, and required roles.

Start with Authenticate to obtain a token, then use Swagger to select an operation and inspect its exact contract before calling it.

Application identifiers

For /api/v1/Application/{applicationId} and its application-scoped subroutes, the route parameter accepts any of these GUIDs from the application list. The same rule applies to reads, updates, and deletion, including calls through MCP.

A servicePrincipalId identifies the enterprise application's service principal and is not an accepted alias. Names and old integer IDs are not accepted. Other parameters, such as targetApplicationEntityId, targetExternalApiAppId, and IDs in import or Terraform contracts, retain their documented meanings.

Find the application with GET /api/v1/Application?search=test12, then verify its name and identifiers with GET /api/v1/Application/<identifier> before changing it. ID matching stays within the authenticated tenant and caller's visibility. A 404 means no visible match, not proof of deletion. A 409 with code ambiguous_application_identifier means more than one visible application matched; no action is performed. Use another unambiguous identifier from a fresh read.

DELETE /api/v1/Application/<identifier> defaults to hardDelete=false, which marks the application deleted. Only use hardDelete=true when you intend to delete the application and its Azure objects. Removing an already deleted AZExecute record uses the separate TenantAdmin-only /Purge operation. Resolving an ID does not grant deletion permission: the existing TenantAdmin or owner-and-tenant-setting checks still apply.