Loading...

How to use Azure CLI to Generate Documentation for Azure AD Applications?

How to use Azure CLI to Generate Documentation for Azure AD Applications?

Your organization likely has hundreds of Azure AD Applications. And with the constant addition, development and subset of new applications with various access points, it becomes imperative to use a script that streamlines the documentation process and helps creates technical documentation for every registered application. And that’s where the following script steps in.

What is Azure Active Directory?

Azure Active Directory is an Identity and Access Management (IAM) system. It provides a single place to store information about digital identities. You can configure your applications to use Azure AD as the place where user information is stored.

Advantages of generating documentation for Azure AD Applications

  • Improves the experience for developers using your Azure AD Applications
  • Decreases the amount of time spent on-boarding developers and application integration partners.
  • Leads to good maintenance and quicker updates.
  • API permissions, scopes, roles help developers and integration partners to understand the Azure AD Application and know what it can do
  • Decreases the amount of time spent on decoding unexpected errors when using it.

In this article, I have attached a PowerShell script that takes the details of the given Azure AD Applications as input and creates readable markdown documentation that you can share with developers and integration partners using the simple use of Azure’s CLI commands.

Prerequisites

  • Azure CLI
  • Azure AD Applications registered in Azure tenant
  • Azure Application Administrator / Developer role
  • Login to Azure using Azure CLI before executing following script

Note - This code has not been optimized and is for demo purpose. You might need to modify the code as per your requirements.

PowerShell Script

function GetTenantId() {
    $accountDetails = az account list | ConvertFrom-Json
    return $accountDetails.tenantId
}
function GetAadApplications() {
    return (az ad app list --all) | ConvertFrom-Json 
}
function GenerateDocumentation($aadApplications) {
    $progressCountApp = 1;

    ForEach ($appInfo in $aadApplications) {
        Write-Progress -Id 0 -Activity "Generating Documentation for the App: $($appInfo.displayName)" -Status "App $progressCountApp of $($aadApplications.length)" -PercentComplete (($progressCountApp / $aadApplications.length) * 100)
        $outputDocumentPath = -join ($outputFolderPath, "\" , $appInfo.displayName, ".md")
        
        $fragments = @()

        $fragments += "# $($docTitle)`n"
        $fragments += "$($docDescription)`n"

        $fragments += "## App Details"
        $fragments += "| Property  | Value  |"
        $fragments += "| ------ | ------ |"
        $fragments += "|Display Name|$($appInfo.displayName)|"
        $fragments += "|App Id|$($appInfo.appId)|"
        $fragments += "|Publisher Domain|$($appInfo.publisherDomain)|"

        $fragments += "`n## Resource Access"

        ForEach ($resource in $appInfo.requiredResourceAccess) {
            $currentResource = (az ad sp show --id $resource.resourceAppId) | ConvertFrom-Json

            $resourceName = $currentResource.displayName
            if (![string]::IsNullOrEmpty($resourceName)) {
                $fragments += "`n### $($resourceName)"
            }

            if ($resource.resourceAccess) {
                $fragments += "`n_App Roles_"
                $fragments += "| Role  |"
                $fragments += "| ------ |"
    
                $appRoles = (az ad sp show --id $resource.resourceAppId --query "appRoles[].{Value:value, Id:id}") | ConvertFrom-Json
                ForEach ($access in $resource.resourceAccess) {
                    $appRole = ($appRoles | Where-Object { $_.Id -eq $access.id })
                    $appRoleName = $appRole.Value
                    if (![string]::IsNullOrEmpty($appRoleName)) {
                        if (![string]::IsNullOrEmpty($appRoleName)) {
                            $fragments += "|$($appRoleName)|"
                        }
                    }
                }
            }

            if ($resource.oauth2Permissions) {
                $fragments += "`n_OAuth2 Permissions_"
                $fragments += "| Permission  |"
                $fragments += "| ------ |"
                $oauth2Permissions = (az ad sp show --id $resource.resourceAppId --query "oauth2Permissions[].{Value:value, Id:id}") | ConvertFrom-Json    
                ForEach ($oauth2Permission in $resource.oauth2Permissions) {
                    $appOauth2Permission = ($oauth2Permissions | Where-Object { $_.Id -eq $oauth2Permission.id })
                    $appOauth2PermissionName = $appOauth2Permission.Value
                    if (![string]::IsNullOrEmpty($appOauth2PermissionName)) {
                        $fragments += "|$($appOauth2PermissionName)|"
                    }
                }
            }
        }

        $fragments += "`n_report run $(Get-Date)_"  
        $fragments | out-file -FilePath $outputDocumentPath

        $progressCountApp++
    }

    Write-Progress -Id 0 -Activity " " -Status " " -Completed
}

$docTitle = "Azure AD Application Details"
$docDescription = "This is a script generated documentation. For more details contact teamname_GDL@yourcompany.com"
$outputFolderPath = $PSScriptRoot
$aadApplications = GetAadApplications 
GenerateDocumentation $aadApplications

Output

document-aad-applications.png

I would like to thank Jayakumar Balasubramaniam for the support he provided to review and finalize this script.

Published on:

Learn more
Home | Joseph Velliah
Home | Joseph Velliah

Fulfilling God’s purpose for my life

Share post:

Related posts

Shrinking Azure Pipeline task extensions using esbuild

TL;DR We bundled an internal Azure Pipelines task extension into a single bundled JavaScript file using esbuild. The task package dropped from...

1 day ago

Building on Vercel’s eve + Azure Cosmos DB: An Agent That Remembers

Most “AI agent” demos forget everything the moment the process exits. That’s fine for a toy project, but useless for anythin...

3 days ago

Copilot Studio – Environment-level agent telemetry export to Azure Application Insights (Preview)

We are announcing the ability for administrators to export Copilot Studio agent telemetry at the environment level to Azure Application Insigh...

4 days ago

See our new Azure Cosmos DB Design Patterns

Design patterns are where good data modeling lives or dies. In a NoSQL database like Azure Cosmos DB, the difference between a schema that sca...

4 days ago

Need a different partition key in Azure Cosmos DB? Pick the right approach

Once you create a container, its partition key is fixed at creation, and you can’t change it in place. However, if your original key starts ca...

5 days ago

Azure SDK Release (June 2026)

Azure SDK releases every month. In this post, you'll find this month's highlights and release notes. The post Azure SDK Release (June 2026) ap...

5 days ago

Fundamentals of Azure DevOps with SQL projects

Building automated pipelines with your SQL database projects enables you to build a rich CI/CD ecosystem to ensure that your application is be...

9 days ago
Stay up to date with latest Microsoft Dynamics 365 and Power Platform news!
* Yes, I agree to the privacy policy