The authenticationBehaviors property of the application object lets you configure breaking change behaviors related to token issuance. Applications can adopt new breaking changes by enabling a behavior or continue using pre-existing behavior by disabling it.
You can configure the following behaviors:
Note
The authenticationBehaviors property of the application object is currently available in beta only.
Read the authenticationBehaviors setting for an application
The authenticationBehaviors property is returned only on $select requests.
To read the property and other specified properties of all apps in the tenant, run the following sample request. The request returns a 200 OK response code and a JSON representation of the application object that shows only the selected properties.
GET https://graph.microsoft.com/beta/applications?$select=id,displayName,appId,authenticationBehaviors
// Code snippets are only available for the latest version. Current version is 5.x
// To initialize your graphClient, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=csharp
var result = await graphClient.Applications.GetAsync((requestConfiguration) =>
{
requestConfiguration.QueryParameters.Select = new string []{ "id","displayName","appId","authenticationBehaviors" };
});
Read the SDK documentation for details on how to add the SDK to your project and create an authProvider instance.
// Code snippets are only available for the latest major version. Current major version is $v0.*
// Dependencies
import (
"context"
msgraphsdk "github.com/microsoftgraph/msgraph-beta-sdk-go"
graphapplications "github.com/microsoftgraph/msgraph-beta-sdk-go/applications"
//other-imports
)
requestParameters := &graphapplications.ApplicationsRequestBuilderGetQueryParameters{
Select: [] string {"id","displayName","appId","authenticationBehaviors"},
}
configuration := &graphapplications.ApplicationsRequestBuilderGetRequestConfiguration{
QueryParameters: requestParameters,
}
// To initialize your graphClient, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=go
applications, err := graphClient.Applications().Get(context.Background(), configuration)
Read the SDK documentation for details on how to add the SDK to your project and create an authProvider instance.
// Code snippets are only available for the latest version. Current version is 6.x
GraphServiceClient graphClient = new GraphServiceClient(requestAdapter);
ApplicationCollectionResponse result = graphClient.applications().get(requestConfiguration -> {
requestConfiguration.queryParameters.select = new String []{"id", "displayName", "appId", "authenticationBehaviors"};
});
Read the SDK documentation for details on how to add the SDK to your project and create an authProvider instance.
const options = {
authProvider,
};
const client = Client.init(options);
let applications = await client.api('/applications')
.version('beta')
.select('id,displayName,appId,authenticationBehaviors')
.get();
Read the SDK documentation for details on how to add the SDK to your project and create an authProvider instance.
<?php
use Microsoft\Graph\Beta\GraphServiceClient;
use Microsoft\Graph\Beta\Generated\Applications\ApplicationsRequestBuilderGetRequestConfiguration;
$graphServiceClient = new GraphServiceClient($tokenRequestContext, $scopes);
$requestConfiguration = new ApplicationsRequestBuilderGetRequestConfiguration();
$queryParameters = ApplicationsRequestBuilderGetRequestConfiguration::createQueryParameters();
$queryParameters->select = ["id","displayName","appId","authenticationBehaviors"];
$requestConfiguration->queryParameters = $queryParameters;
$result = $graphServiceClient->applications()->get($requestConfiguration)->wait();
Read the SDK documentation for details on how to add the SDK to your project and create an authProvider instance.
# Code snippets are only available for the latest version. Current version is 1.x
from msgraph_beta import GraphServiceClient
from msgraph_beta.generated.applications.applications_request_builder import ApplicationsRequestBuilder
from kiota_abstractions.base_request_configuration import RequestConfiguration
# To initialize your graph_client, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=python
query_params = ApplicationsRequestBuilder.ApplicationsRequestBuilderGetQueryParameters(
select = ["id","displayName","appId","authenticationBehaviors"],
)
request_configuration = RequestConfiguration(
query_parameters = query_params,
)
result = await graph_client.applications.get(request_configuration = request_configuration)
Read the SDK documentation for details on how to add the SDK to your project and create an authProvider instance.
To read only the authenticationBehaviors property for a single app, run the following sample request.
GET https://graph.microsoft.com/beta/applications/03ef14b0-ca33-4840-8f4f-d6e91916010e/authenticationBehaviors
const options = {
authProvider,
};
const client = Client.init(options);
let authenticationBehaviors = await client.api('/applications/03ef14b0-ca33-4840-8f4f-d6e91916010e/authenticationBehaviors')
.version('beta')
.get();
Read the SDK documentation for details on how to add the SDK to your project and create an authProvider instance.
You can also use the appId property as follows:
GET https://graph.microsoft.com/beta/applications(appId='37bf1fd4-78b0-4fea-ac2d-6c82829e9365')/authenticationBehaviors
Control Cross-Origin-Opener-Policy enforcement
The coopEnforcement property controls whether Microsoft Entra authentication responses for an application include enforced Cross-Origin-Opener-Policy (COOP) headers. COOP isolates browser windows from cross-origin opener access and helps protect browser-based authentication flows. The service applies this per-app setting when per-app COOP override evaluation is available for the request.
Applications that use popup authentication should first adopt a COOP-compatible authentication flow. If your application uses MSAL.js, migrate to MSAL.js v5 or later and configure its supported redirect bridge. For more information, see Migrate from MSAL Browser v4 to v5 and Set up the redirect bridge page in MSAL Browser. If an SDK or hosting platform owns the popup and callback, update to a compatible platform release or report the issue to that platform's owner.
The property supports the following values:
true: Explicitly enforce COOP for the application.false: Explicitly suppress COOP enforcement as a temporary compatibility exception.null: Remove the explicit override and use the service default.
Note
coopEnforcement is available only in the global service and isn't available in national cloud deployments.
Important
Before setting coopEnforcement to true, test the application's complete authentication flow, including popup closure and delivery of the authentication result to the host application. Setting the property to false is a temporary compatibility exception while the application or owning platform is remediated; it isn't a security remediation. The exception doesn't expire automatically. Reset the property to null or set it to true after remediation.
Explicitly enable COOP enforcement
The following examples explicitly enable COOP enforcement for an application.
Option 1
This pattern for specifying the property in the request URL allows you to update only the specified property in the request.
PATCH https://graph.microsoft.com/beta/applications/03ef14b0-ca33-4840-8f4f-d6e91916010e/authenticationBehaviors
Content-Type: application/json
{
"coopEnforcement": true
}
Option 2
This pattern for specifying the property in the request body lets you update other peer properties in the same request.
PATCH https://graph.microsoft.com/beta/applications/03ef14b0-ca33-4840-8f4f-d6e91916010e
Content-Type: application/json
{
"authenticationBehaviors": {
"coopEnforcement": true
}
}
If successful, these requests return a 204 No Content response.
Temporarily suppress COOP enforcement
The following examples explicitly suppress COOP enforcement while the application owner remediates an incompatible authentication flow.
Option 1
This pattern for specifying the property in the request URL allows you to update only the specified property in the request.
PATCH https://graph.microsoft.com/beta/applications/03ef14b0-ca33-4840-8f4f-d6e91916010e/authenticationBehaviors
Content-Type: application/json
{
"coopEnforcement": false
}
Option 2
This pattern for specifying the property in the request body lets you update other peer properties in the same request.
PATCH https://graph.microsoft.com/beta/applications/03ef14b0-ca33-4840-8f4f-d6e91916010e
Content-Type: application/json
{
"authenticationBehaviors": {
"coopEnforcement": false
}
}
If successful, these requests return a 204 No Content response. A COOP Report-Only header might still be present. After the application or owning platform is remediated, set the property to true for controlled validation or reset it to null to use the service default.
Restore the service default
The following examples remove the explicit override.
Option 1
This pattern for specifying the property in the request URL allows you to update only the specified property in the request.
PATCH https://graph.microsoft.com/beta/applications/03ef14b0-ca33-4840-8f4f-d6e91916010e/authenticationBehaviors
Content-Type: application/json
{
"coopEnforcement": null
}
Option 2
This pattern for specifying the property in the request body lets you update other peer properties in the same request.
PATCH https://graph.microsoft.com/beta/applications/03ef14b0-ca33-4840-8f4f-d6e91916010e
Content-Type: application/json
{
"authenticationBehaviors": {
"coopEnforcement": null
}
}
If successful, these requests return a 204 No Content response. To confirm the reset state, read the application with $select=id,appId,authenticationBehaviors. If the application has no other explicit authentication behavior, authenticationBehaviors is null. If another authentication behavior is configured, the complex object remains present and coopEnforcement is omitted.
Note
In the current beta, if coopEnforcement is already absent, another reset request might return 400 Request_BadRequest. Read the application first and treat an omitted property as already reset.
Prevent the issuance of email claims with unverified domain owners
As described in the Microsoft security advisory Potential Risk of Privilege Escalation in Microsoft Entra Applications, apps should never use the email claim for authorization purposes. If your application uses the email claim for authorization or primary user identification purposes, it's subject to account and privilege escalation attacks. This risk of unauthorized access is especially identified in the following scenarios:
- When the mail attribute of the user object contains an email address with an unverified domain owner
- For multitenant apps where a user from one tenant could escalate their privileges to access resources from another tenant through modification of their mail attribute
Today, the default behavior is to remove email addresses with unverified domain owners in claims, except for single-tenant apps and for multitenant apps with previous sign-in activity with unverified emails. If your app falls into either of these exceptions and you want to remove unverified email addresses, set the removeUnverifiedEmailClaim property of authenticationBehaviors to true as shown in the following examples. The request returns a 204 No Content response code.
Remove email addresses with unverified domain owners from claims
Option 1
This pattern for specifying the property in the request URL allows you to update only the specified property in the request.
PATCH https://graph.microsoft.com/beta/applications/03ef14b0-ca33-4840-8f4f-d6e91916010e/authenticationBehaviors
Content-Type: application/json
{
"removeUnverifiedEmailClaim": true
}
const options = {
authProvider,
};
const client = Client.init(options);
const authenticationBehaviors = {
removeUnverifiedEmailClaim: true
};
await client.api('/applications/03ef14b0-ca33-4840-8f4f-d6e91916010e/authenticationBehaviors')
.version('beta')
.update(authenticationBehaviors);
Read the SDK documentation for details on how to add the SDK to your project and create an authProvider instance.
Option 2
This pattern for specifying the property in the request body lets you update other peer properties in the same request.
PATCH https://graph.microsoft.com/beta/applications/03ef14b0-ca33-4840-8f4f-d6e91916010e
Content-Type: application/json
{
"authenticationBehaviors": {
"removeUnverifiedEmailClaim": true
}
}
// Code snippets are only available for the latest version. Current version is 5.x
// Dependencies
using Microsoft.Graph.Beta.Models;
var requestBody = new Application
{
AuthenticationBehaviors = new AuthenticationBehaviors
{
RemoveUnverifiedEmailClaim = true,
},
};
// To initialize your graphClient, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=csharp
var result = await graphClient.Applications["{application-id}"].PatchAsync(requestBody);
Read the SDK documentation for details on how to add the SDK to your project and create an authProvider instance.
// Code snippets are only available for the latest major version. Current major version is $v0.*
// Dependencies
import (
"context"
msgraphsdk "github.com/microsoftgraph/msgraph-beta-sdk-go"
graphmodels "github.com/microsoftgraph/msgraph-beta-sdk-go/models"
//other-imports
)
requestBody := graphmodels.NewApplication()
authenticationBehaviors := graphmodels.NewAuthenticationBehaviors()
removeUnverifiedEmailClaim := true
authenticationBehaviors.SetRemoveUnverifiedEmailClaim(&removeUnverifiedEmailClaim)
requestBody.SetAuthenticationBehaviors(authenticationBehaviors)
// To initialize your graphClient, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=go
applications, err := graphClient.Applications().ByApplicationId("application-id").Patch(context.Background(), requestBody, nil)
Read the SDK documentation for details on how to add the SDK to your project and create an authProvider instance.
// Code snippets are only available for the latest version. Current version is 6.x
GraphServiceClient graphClient = new GraphServiceClient(requestAdapter);
Application application = new Application();
AuthenticationBehaviors authenticationBehaviors = new AuthenticationBehaviors();
authenticationBehaviors.setRemoveUnverifiedEmailClaim(true);
application.setAuthenticationBehaviors(authenticationBehaviors);
Application result = graphClient.applications().byApplicationId("{application-id}").patch(application);
Read the SDK documentation for details on how to add the SDK to your project and create an authProvider instance.
const options = {
authProvider,
};
const client = Client.init(options);
const application = {
authenticationBehaviors: {
removeUnverifiedEmailClaim: true
}
};
await client.api('/applications/03ef14b0-ca33-4840-8f4f-d6e91916010e')
.version('beta')
.update(application);
Read the SDK documentation for details on how to add the SDK to your project and create an authProvider instance.
<?php
use Microsoft\Graph\Beta\GraphServiceClient;
use Microsoft\Graph\Beta\Generated\Models\Application;
use Microsoft\Graph\Beta\Generated\Models\AuthenticationBehaviors;
$graphServiceClient = new GraphServiceClient($tokenRequestContext, $scopes);
$requestBody = new Application();
$authenticationBehaviors = new AuthenticationBehaviors();
$authenticationBehaviors->setRemoveUnverifiedEmailClaim(true);
$requestBody->setAuthenticationBehaviors($authenticationBehaviors);
$result = $graphServiceClient->applications()->byApplicationId('application-id')->patch($requestBody)->wait();
Read the SDK documentation for details on how to add the SDK to your project and create an authProvider instance.
Import-Module Microsoft.Graph.Beta.Applications
$params = @{
authenticationBehaviors = @{
removeUnverifiedEmailClaim = $true
}
}
Update-MgBetaApplication -ApplicationId $applicationId -BodyParameter $params
Read the SDK documentation for details on how to add the SDK to your project and create an authProvider instance.
# Code snippets are only available for the latest version. Current version is 1.x
from msgraph_beta import GraphServiceClient
from msgraph_beta.generated.models.application import Application
from msgraph_beta.generated.models.authentication_behaviors import AuthenticationBehaviors
# To initialize your graph_client, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=python
request_body = Application(
authentication_behaviors = AuthenticationBehaviors(
remove_unverified_email_claim = True,
),
)
result = await graph_client.applications.by_application_id('application-id').patch(request_body)
Read the SDK documentation for details on how to add the SDK to your project and create an authProvider instance.
Accept email addresses with unverified domain owners in claims
Option 1
PATCH https://graph.microsoft.com/beta/applications/03ef14b0-ca33-4840-8f4f-d6e91916010e/authenticationBehaviors
Content-Type: application/json
{
"removeUnverifiedEmailClaim": false
}
const options = {
authProvider,
};
const client = Client.init(options);
const authenticationBehaviors = {
removeUnverifiedEmailClaim: false
};
await client.api('/applications/03ef14b0-ca33-4840-8f4f-d6e91916010e/authenticationBehaviors')
.version('beta')
.update(authenticationBehaviors);
Read the SDK documentation for details on how to add the SDK to your project and create an authProvider instance.
Option 2
PATCH https://graph.microsoft.com/beta/applications/03ef14b0-ca33-4840-8f4f-d6e91916010e
Content-Type: application/json
{
"authenticationBehaviors": {
"removeUnverifiedEmailClaim": false
}
}
// Code snippets are only available for the latest version. Current version is 5.x
// Dependencies
using Microsoft.Graph.Beta.Models;
var requestBody = new Application
{
AuthenticationBehaviors = new AuthenticationBehaviors
{
RemoveUnverifiedEmailClaim = false,
},
};
// To initialize your graphClient, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=csharp
var result = await graphClient.Applications["{application-id}"].PatchAsync(requestBody);
Read the SDK documentation for details on how to add the SDK to your project and create an authProvider instance.
// Code snippets are only available for the latest major version. Current major version is $v0.*
// Dependencies
import (
"context"
msgraphsdk "github.com/microsoftgraph/msgraph-beta-sdk-go"
graphmodels "github.com/microsoftgraph/msgraph-beta-sdk-go/models"
//other-imports
)
requestBody := graphmodels.NewApplication()
authenticationBehaviors := graphmodels.NewAuthenticationBehaviors()
removeUnverifiedEmailClaim := false
authenticationBehaviors.SetRemoveUnverifiedEmailClaim(&removeUnverifiedEmailClaim)
requestBody.SetAuthenticationBehaviors(authenticationBehaviors)
// To initialize your graphClient, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=go
applications, err := graphClient.Applications().ByApplicationId("application-id").Patch(context.Background(), requestBody, nil)
Read the SDK documentation for details on how to add the SDK to your project and create an authProvider instance.
// Code snippets are only available for the latest version. Current version is 6.x
GraphServiceClient graphClient = new GraphServiceClient(requestAdapter);
Application application = new Application();
AuthenticationBehaviors authenticationBehaviors = new AuthenticationBehaviors();
authenticationBehaviors.setRemoveUnverifiedEmailClaim(false);
application.setAuthenticationBehaviors(authenticationBehaviors);
Application result = graphClient.applications().byApplicationId("{application-id}").patch(application);
Read the SDK documentation for details on how to add the SDK to your project and create an authProvider instance.
const options = {
authProvider,
};
const client = Client.init(options);
const application = {
authenticationBehaviors: {
removeUnverifiedEmailClaim: false
}
};
await client.api('/applications/03ef14b0-ca33-4840-8f4f-d6e91916010e')
.version('beta')
.update(application);
Read the SDK documentation for details on how to add the SDK to your project and create an authProvider instance.
<?php
use Microsoft\Graph\Beta\GraphServiceClient;
use Microsoft\Graph\Beta\Generated\Models\Application;
use Microsoft\Graph\Beta\Generated\Models\AuthenticationBehaviors;
$graphServiceClient = new GraphServiceClient($tokenRequestContext, $scopes);
$requestBody = new Application();
$authenticationBehaviors = new AuthenticationBehaviors();
$authenticationBehaviors->setRemoveUnverifiedEmailClaim(false);
$requestBody->setAuthenticationBehaviors($authenticationBehaviors);
$result = $graphServiceClient->applications()->byApplicationId('application-id')->patch($requestBody)->wait();
Read the SDK documentation for details on how to add the SDK to your project and create an authProvider instance.
Import-Module Microsoft.Graph.Beta.Applications
$params = @{
authenticationBehaviors = @{
removeUnverifiedEmailClaim = $false
}
}
Update-MgBetaApplication -ApplicationId $applicationId -BodyParameter $params
Read the SDK documentation for details on how to add the SDK to your project and create an authProvider instance.
# Code snippets are only available for the latest version. Current version is 1.x
from msgraph_beta import GraphServiceClient
from msgraph_beta.generated.models.application import Application
from msgraph_beta.generated.models.authentication_behaviors import AuthenticationBehaviors
# To initialize your graph_client, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=python
request_body = Application(
authentication_behaviors = AuthenticationBehaviors(
remove_unverified_email_claim = False,
),
)
result = await graph_client.applications.by_application_id('application-id').patch(request_body)
Read the SDK documentation for details on how to add the SDK to your project and create an authProvider instance.
Restore the default behavior
Option 1
PATCH https://graph.microsoft.com/beta/applications/03ef14b0-ca33-4840-8f4f-d6e91916010e/authenticationBehaviors
Content-Type: application/json
{
"removeUnverifiedEmailClaim": null
}
const options = {
authProvider,
};
const client = Client.init(options);
const authenticationBehaviors = {
removeUnverifiedEmailClaim: null
};
await client.api('/applications/03ef14b0-ca33-4840-8f4f-d6e91916010e/authenticationBehaviors')
.version('beta')
.update(authenticationBehaviors);
Read the SDK documentation for details on how to add the SDK to your project and create an authProvider instance.
Option 2
PATCH https://graph.microsoft.com/beta/applications/03ef14b0-ca33-4840-8f4f-d6e91916010e/
Content-Type: application/json
{
"authenticationBehaviors": {
"removeUnverifiedEmailClaim": null
}
}
// Code snippets are only available for the latest version. Current version is 5.x
// Dependencies
using Microsoft.Graph.Beta.Models;
var requestBody = new Application
{
AuthenticationBehaviors = new AuthenticationBehaviors
{
RemoveUnverifiedEmailClaim = null,
},
};
// To initialize your graphClient, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=csharp
var result = await graphClient.Applications["{application-id}"].PatchAsync(requestBody);
Read the SDK documentation for details on how to add the SDK to your project and create an authProvider instance.
// Code snippets are only available for the latest major version. Current major version is $v0.*
// Dependencies
import (
"context"
msgraphsdk "github.com/microsoftgraph/msgraph-beta-sdk-go"
graphmodels "github.com/microsoftgraph/msgraph-beta-sdk-go/models"
//other-imports
)
requestBody := graphmodels.NewApplication()
authenticationBehaviors := graphmodels.NewAuthenticationBehaviors()
removeUnverifiedEmailClaim := null
authenticationBehaviors.SetRemoveUnverifiedEmailClaim(&removeUnverifiedEmailClaim)
requestBody.SetAuthenticationBehaviors(authenticationBehaviors)
// To initialize your graphClient, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=go
applications, err := graphClient.Applications().ByApplicationId("application-id").Patch(context.Background(), requestBody, nil)
Read the SDK documentation for details on how to add the SDK to your project and create an authProvider instance.
// Code snippets are only available for the latest version. Current version is 6.x
GraphServiceClient graphClient = new GraphServiceClient(requestAdapter);
Application application = new Application();
AuthenticationBehaviors authenticationBehaviors = new AuthenticationBehaviors();
authenticationBehaviors.setRemoveUnverifiedEmailClaim(null);
application.setAuthenticationBehaviors(authenticationBehaviors);
Application result = graphClient.applications().byApplicationId("{application-id}").patch(application);
Read the SDK documentation for details on how to add the SDK to your project and create an authProvider instance.
const options = {
authProvider,
};
const client = Client.init(options);
const application = {
authenticationBehaviors: {
removeUnverifiedEmailClaim: null
}
};
await client.api('/applications/03ef14b0-ca33-4840-8f4f-d6e91916010e/')
.version('beta')
.update(application);
Read the SDK documentation for details on how to add the SDK to your project and create an authProvider instance.
<?php
use Microsoft\Graph\Beta\GraphServiceClient;
use Microsoft\Graph\Beta\Generated\Models\Application;
use Microsoft\Graph\Beta\Generated\Models\AuthenticationBehaviors;
$graphServiceClient = new GraphServiceClient($tokenRequestContext, $scopes);
$requestBody = new Application();
$authenticationBehaviors = new AuthenticationBehaviors();
$authenticationBehaviors->setRemoveUnverifiedEmailClaim(null);
$requestBody->setAuthenticationBehaviors($authenticationBehaviors);
$result = $graphServiceClient->applications()->byApplicationId('application-id')->patch($requestBody)->wait();
Read the SDK documentation for details on how to add the SDK to your project and create an authProvider instance.
Import-Module Microsoft.Graph.Beta.Applications
$params = @{
authenticationBehaviors = @{
removeUnverifiedEmailClaim = $null
}
}
Update-MgBetaApplication -ApplicationId $applicationId -BodyParameter $params
Read the SDK documentation for details on how to add the SDK to your project and create an authProvider instance.
# Code snippets are only available for the latest version. Current version is 1.x
from msgraph_beta import GraphServiceClient
from msgraph_beta.generated.models.application import Application
from msgraph_beta.generated.models.authentication_behaviors import AuthenticationBehaviors
# To initialize your graph_client, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=python
request_body = Application(
authentication_behaviors = AuthenticationBehaviors(
remove_unverified_email_claim = None,
),
)
result = await graph_client.applications.by_application_id('application-id').patch(request_body)
Read the SDK documentation for details on how to add the SDK to your project and create an authProvider instance.
Allow extended Azure AD Graph access until August 31, 2025
By default, applications created after August 31, 2024 receive a 403 Unauthorized error when making requests to Azure AD Graph APIs, unless you configure them to allow extended Azure AD Graph access. Additionally, you must configure existing apps created before August 31, 2024 and making requests to Azure AD Graph APIs to allow extended Azure AD Graph access by February 1, 2025. This extended access is available only until June 30, 2025, when Azure AD Graph is fully retired. After this date, all apps receive a 403 Unauthorized error when making requests to Azure AD Graph APIs, regardless of their extended access configuration. For more information, see June 2024 update on Azure AD Graph API retirement.
The following request shows how to update an app to enable extended Azure AD Graph access. The ID used in this example is the object ID of the application, not the application ID. The request returns a 204 No Content response code.
Option 1
PATCH https://graph.microsoft.com/beta/applications/5c142e6f-0bd3-4e58-b510-8a106704f44f/authenticationBehaviors
Content-Type: application/json
{
"blockAzureADGraphAccess": false
}
const options = {
authProvider,
};
const client = Client.init(options);
const authenticationBehaviors = {
blockAzureADGraphAccess: false
};
await client.api('/applications/5c142e6f-0bd3-4e58-b510-8a106704f44f/authenticationBehaviors')
.version('beta')
.update(authenticationBehaviors);
Read the SDK documentation for details on how to add the SDK to your project and create an authProvider instance.
Option 2
PATCH https://graph.microsoft.com/beta/applications/5c142e6f-0bd3-4e58-b510-8a106704f44f
Content-Type: application/json
{
"authenticationBehaviors": {
"blockAzureADGraphAccess": false
}
}
// Code snippets are only available for the latest version. Current version is 5.x
// Dependencies
using Microsoft.Graph.Beta.Models;
var requestBody = new Application
{
AuthenticationBehaviors = new AuthenticationBehaviors
{
BlockAzureADGraphAccess = false,
},
};
// To initialize your graphClient, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=csharp
var result = await graphClient.Applications["{application-id}"].PatchAsync(requestBody);
Read the SDK documentation for details on how to add the SDK to your project and create an authProvider instance.
// Code snippets are only available for the latest major version. Current major version is $v0.*
// Dependencies
import (
"context"
msgraphsdk "github.com/microsoftgraph/msgraph-beta-sdk-go"
graphmodels "github.com/microsoftgraph/msgraph-beta-sdk-go/models"
//other-imports
)
requestBody := graphmodels.NewApplication()
authenticationBehaviors := graphmodels.NewAuthenticationBehaviors()
blockAzureADGraphAccess := false
authenticationBehaviors.SetBlockAzureADGraphAccess(&blockAzureADGraphAccess)
requestBody.SetAuthenticationBehaviors(authenticationBehaviors)
// To initialize your graphClient, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=go
applications, err := graphClient.Applications().ByApplicationId("application-id").Patch(context.Background(), requestBody, nil)
Read the SDK documentation for details on how to add the SDK to your project and create an authProvider instance.
// Code snippets are only available for the latest version. Current version is 6.x
GraphServiceClient graphClient = new GraphServiceClient(requestAdapter);
Application application = new Application();
AuthenticationBehaviors authenticationBehaviors = new AuthenticationBehaviors();
authenticationBehaviors.setBlockAzureADGraphAccess(false);
application.setAuthenticationBehaviors(authenticationBehaviors);
Application result = graphClient.applications().byApplicationId("{application-id}").patch(application);
Read the SDK documentation for details on how to add the SDK to your project and create an authProvider instance.
const options = {
authProvider,
};
const client = Client.init(options);
const application = {
authenticationBehaviors: {
blockAzureADGraphAccess: false
}
};
await client.api('/applications/5c142e6f-0bd3-4e58-b510-8a106704f44f')
.version('beta')
.update(application);
Read the SDK documentation for details on how to add the SDK to your project and create an authProvider instance.
<?php
use Microsoft\Graph\Beta\GraphServiceClient;
use Microsoft\Graph\Beta\Generated\Models\Application;
use Microsoft\Graph\Beta\Generated\Models\AuthenticationBehaviors;
$graphServiceClient = new GraphServiceClient($tokenRequestContext, $scopes);
$requestBody = new Application();
$authenticationBehaviors = new AuthenticationBehaviors();
$authenticationBehaviors->setBlockAzureADGraphAccess(false);
$requestBody->setAuthenticationBehaviors($authenticationBehaviors);
$result = $graphServiceClient->applications()->byApplicationId('application-id')->patch($requestBody)->wait();
Read the SDK documentation for details on how to add the SDK to your project and create an authProvider instance.
Import-Module Microsoft.Graph.Beta.Applications
$params = @{
authenticationBehaviors = @{
blockAzureADGraphAccess = $false
}
}
Update-MgBetaApplication -ApplicationId $applicationId -BodyParameter $params
Read the SDK documentation for details on how to add the SDK to your project and create an authProvider instance.
# Code snippets are only available for the latest version. Current version is 1.x
from msgraph_beta import GraphServiceClient
from msgraph_beta.generated.models.application import Application
from msgraph_beta.generated.models.authentication_behaviors import AuthenticationBehaviors
# To initialize your graph_client, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=python
request_body = Application(
authentication_behaviors = AuthenticationBehaviors(
block_azure_a_d_graph_access = False,
),
)
result = await graph_client.applications.by_application_id('application-id').patch(request_body)
Read the SDK documentation for details on how to add the SDK to your project and create an authProvider instance.
Related content