How to use Azure CLI to Generate Documentation for Azure AD Applications?
Your organization likely has hundreds of Azure AD Applications. And with the constant addition, development and subset of new applications with various access points, it becomes imperative to use a script that streamlines the documentation process and helps creates technical documentation for every registered application. And that’s where the following script steps in.
What is Azure Active Directory?
Azure Active Directory is an Identity and Access Management (IAM) system. It provides a single place to store information about digital identities. You can configure your applications to use Azure AD as the place where user information is stored.
Advantages of generating documentation for Azure AD Applications
- Improves the experience for developers using your Azure AD Applications
- Decreases the amount of time spent on-boarding developers and application integration partners.
- Leads to good maintenance and quicker updates.
- API permissions, scopes, roles help developers and integration partners to understand the Azure AD Application and know what it can do
- Decreases the amount of time spent on decoding unexpected errors when using it.
In this article, I have attached a PowerShell script that takes the details of the given Azure AD Applications as input and creates readable markdown documentation that you can share with developers and integration partners using the simple use of Azure’s CLI commands.
Prerequisites
- Azure CLI
- Azure AD Applications registered in Azure tenant
- Azure Application Administrator / Developer role
- Login to Azure using Azure CLI before executing following script
Note - This code has not been optimized and is for demo purpose. You might need to modify the code as per your requirements.
PowerShell Script
function GetTenantId() {
$accountDetails = az account list | ConvertFrom-Json
return $accountDetails.tenantId
}
function GetAadApplications() {
return (az ad app list --all) | ConvertFrom-Json
}
function GenerateDocumentation($aadApplications) {
$progressCountApp = 1;
ForEach ($appInfo in $aadApplications) {
Write-Progress -Id 0 -Activity "Generating Documentation for the App: $($appInfo.displayName)" -Status "App $progressCountApp of $($aadApplications.length)" -PercentComplete (($progressCountApp / $aadApplications.length) * 100)
$outputDocumentPath = -join ($outputFolderPath, "\" , $appInfo.displayName, ".md")
$fragments = @()
$fragments += "# $($docTitle)`n"
$fragments += "$($docDescription)`n"
$fragments += "## App Details"
$fragments += "| Property | Value |"
$fragments += "| ------ | ------ |"
$fragments += "|Display Name|$($appInfo.displayName)|"
$fragments += "|App Id|$($appInfo.appId)|"
$fragments += "|Publisher Domain|$($appInfo.publisherDomain)|"
$fragments += "`n## Resource Access"
ForEach ($resource in $appInfo.requiredResourceAccess) {
$currentResource = (az ad sp show --id $resource.resourceAppId) | ConvertFrom-Json
$resourceName = $currentResource.displayName
if (![string]::IsNullOrEmpty($resourceName)) {
$fragments += "`n### $($resourceName)"
}
if ($resource.resourceAccess) {
$fragments += "`n_App Roles_"
$fragments += "| Role |"
$fragments += "| ------ |"
$appRoles = (az ad sp show --id $resource.resourceAppId --query "appRoles[].{Value:value, Id:id}") | ConvertFrom-Json
ForEach ($access in $resource.resourceAccess) {
$appRole = ($appRoles | Where-Object { $_.Id -eq $access.id })
$appRoleName = $appRole.Value
if (![string]::IsNullOrEmpty($appRoleName)) {
if (![string]::IsNullOrEmpty($appRoleName)) {
$fragments += "|$($appRoleName)|"
}
}
}
}
if ($resource.oauth2Permissions) {
$fragments += "`n_OAuth2 Permissions_"
$fragments += "| Permission |"
$fragments += "| ------ |"
$oauth2Permissions = (az ad sp show --id $resource.resourceAppId --query "oauth2Permissions[].{Value:value, Id:id}") | ConvertFrom-Json
ForEach ($oauth2Permission in $resource.oauth2Permissions) {
$appOauth2Permission = ($oauth2Permissions | Where-Object { $_.Id -eq $oauth2Permission.id })
$appOauth2PermissionName = $appOauth2Permission.Value
if (![string]::IsNullOrEmpty($appOauth2PermissionName)) {
$fragments += "|$($appOauth2PermissionName)|"
}
}
}
}
$fragments += "`n_report run $(Get-Date)_"
$fragments | out-file -FilePath $outputDocumentPath
$progressCountApp++
}
Write-Progress -Id 0 -Activity " " -Status " " -Completed
}
$docTitle = "Azure AD Application Details"
$docDescription = "This is a script generated documentation. For more details contact teamname_GDL@yourcompany.com"
$outputFolderPath = $PSScriptRoot
$aadApplications = GetAadApplications
GenerateDocumentation $aadApplications
Output

I would like to thank Jayakumar Balasubramaniam for the support he provided to review and finalize this script.
Published on:
Learn moreRelated posts
Powering Real-Time Gaming Experiences with Azure Cosmos DB for NoSQL
Scenario: When Every Millisecond Counts in Gaming Imagine millions of players logging in at the exact moment a new game season launches. Leade...
Access Azure Virtual Desktop and Windows 365 Cloud PC from non-managed devices
Check out this article via web browser: Access Azure Virtual Desktop and Windows 365 Cloud PC from non-managed devices Many organizations use ...
Power Pages + Azure AD B2C: “The Provided Application Is Not Valid” Error
If you are new to configuring Azure AD B2C as Identity Provider in Power Pages, refer Power Pages : Set up Azure AD B2C After completing the s...
Semantic Reranking with Azure SQL, SQL Server 2025 and Cohere Rerank models
Supporting re‑ranking has been one of the most common requests lately. While not always essential, it can be a valuable addition to a solution...
How Azure Cosmos DB Powers ARM’s Federated Future: Scaling for the Next Billion Requests
The Cloud at Hyperscale: ARM’s Mission and Growth Azure Resource Manager (ARM) is the backbone of Azure’s resource provisioning and management...
Automating Business PDFs Using Azure Document Intelligence and Power Automate
In today’s data-driven enterprises, critical business information often arrives in the form of PDFs—bank statements, invoices, policy document...
Azure Developer CLI (azd) Dec 2025 – Extensions Enhancements, Foundry Rebranding, and Azure Pipelines Improvements
This post announces the December release of the Azure Developer CLI (`azd`). The post Azure Developer CLI (azd) Dec 2025 – Extensions En...