KQL Search

Query Details

HomeAI ToolsDevice Query

Identity First Party Apps

Query

//Create a temporary table of first party apps from the following sources which are updated daily in the following order
//        1. Microsoft Graph (apps where appOwnerOrganizationId is Microsoft)
//        2. Microsoft Learn doc (https://learn.microsoft.com/troubleshoot/azure/active-directory/verify-first-party-apps-sign-in)
//        3. Custom list of apps (./customdata/MysteryApps.csv) - Community contributed list of Microsoft apps and their app ids
//You can then look up / join this to any data that does not have the friendly name or just use it as a reference
//See https://github.com/merill/microsoft-info for the reference source

let FirstPartyApps = externaldata (AppId:guid,AppDisplayName:string,AppOwnerOrganizationId:guid,Source:string) [
    h@'https://raw.githubusercontent.com/merill/microsoft-info/main/_info/MicrosoftApps.json'
    ] with(format='multijson');
FirstPartyApps

Explanation

The query creates a temporary table called "FirstPartyApps" that contains information about first-party apps from different sources. These sources include Microsoft Graph, a Microsoft Learn document, and a custom list of apps from a CSV file. The table is updated daily in the specified order. The purpose of this table is to provide a reference or join it with other data that does not have the friendly name of the apps. The query also includes a link to a GitHub repository for further reference.

Details

Matt Zorich profile picture

Matt Zorich

Released: August 8, 2023

Tables

FirstPartyApps

Keywords

Microsoft,Graph,MicrosoftLearn,Customlist,Community,Microsoftapps,appids,referencesource

Operators

whereappOwnerOrganizationIdisMicrosoftunionexternaldata(AppId:guid,AppDisplayName:string,AppOwnerOrganizationId:guid,Source:string)[h@'https://raw.githubusercontent.com/merill/microsoft-info/main/_info/MicrosoftApps.json']with(format='multijson')

Actions