Identity First Party Apps

//Create a temporary table of first party apps from the following sources which are updated daily in the following order // 1. Microsoft Graph (apps where appOwnerOrganizationId is Microsoft) // 2. Microsoft Learn doc (https://learn.microsoft.com/troubleshoot/azure/active-directory/verify-first-party-apps-sign-in) // 3. Custom list of apps (./customdata/MysteryApps.csv) - Community contributed list of Microsoft apps and their app ids //You can then look up / join this to any data that does not have the friendly name or just use it as a reference //See https://github.com/merill/microsoft-info for the reference source

let FirstPartyApps = externaldata (AppId:guid,AppDisplayName:string,AppOwnerOrganizationId:guid,Source:string) [ h@'https://raw.githubusercontent.com/merill/microsoft-info/main/_info/MicrosoftApps.json' ] with(format='multijson'); FirstPartyApps

Explanation

The query creates a temporary table called "FirstPartyApps" that contains information about first-party apps from different sources. These sources include Microsoft Graph, a Microsoft Learn document, and a custom list of apps from a CSV file. The table is updated daily in the specified order. The purpose of this table is to provide a reference or join it with other data that does not have the friendly name of the apps. The query also includes a link to a GitHub repository for further reference.

Details

Matt Zorich

Released: August 8, 2023

Tables

FirstPartyApps

Keywords

MicrosoftGraphMicrosoft LearnCustom listCommunityMicrosoft appsapp idsreference source

Operators

whereappOwnerOrganizationIdisMicrosoftunionexternaldata(AppId:guidAppDisplayName:stringAppOwnerOrganizationId:guidSource:string)[h@'https://raw.githubusercontent.com/merill/microsoft-info/main/_info/MicrosoftApps.json']with(format='multijson')

KQL Search