How to use Azure CLI to Generate Documentation for Azure AD Applications?
Your organization likely has hundreds of Azure AD Applications. And with the constant addition, development and subset of new applications with various access points, it becomes imperative to use a script that streamlines the documentation process and helps creates technical documentation for every registered application. And that’s where the following script steps in.
What is Azure Active Directory?
Azure Active Directory is an Identity and Access Management (IAM) system. It provides a single place to store information about digital identities. You can configure your applications to use Azure AD as the place where user information is stored.
Advantages of generating documentation for Azure AD Applications
- Improves the experience for developers using your Azure AD Applications
- Decreases the amount of time spent on-boarding developers and application integration partners.
- Leads to good maintenance and quicker updates.
- API permissions, scopes, roles help developers and integration partners to understand the Azure AD Application and know what it can do
- Decreases the amount of time spent on decoding unexpected errors when using it.
In this article, I have attached a PowerShell script that takes the details of the given Azure AD Applications as input and creates readable markdown documentation that you can share with developers and integration partners using the simple use of Azure’s CLI commands.
Prerequisites
- Azure CLI
- Azure AD Applications registered in Azure tenant
- Azure Application Administrator / Developer role
- Login to Azure using Azure CLI before executing following script
Note - This code has not been optimized and is for demo purpose. You might need to modify the code as per your requirements.
PowerShell Script
function GetTenantId() {
$accountDetails = az account list | ConvertFrom-Json
return $accountDetails.tenantId
}
function GetAadApplications() {
return (az ad app list --all) | ConvertFrom-Json
}
function GenerateDocumentation($aadApplications) {
$progressCountApp = 1;
ForEach ($appInfo in $aadApplications) {
Write-Progress -Id 0 -Activity "Generating Documentation for the App: $($appInfo.displayName)" -Status "App $progressCountApp of $($aadApplications.length)" -PercentComplete (($progressCountApp / $aadApplications.length) * 100)
$outputDocumentPath = -join ($outputFolderPath, "\" , $appInfo.displayName, ".md")
$fragments = @()
$fragments += "# $($docTitle)`n"
$fragments += "$($docDescription)`n"
$fragments += "## App Details"
$fragments += "| Property | Value |"
$fragments += "| ------ | ------ |"
$fragments += "|Display Name|$($appInfo.displayName)|"
$fragments += "|App Id|$($appInfo.appId)|"
$fragments += "|Publisher Domain|$($appInfo.publisherDomain)|"
$fragments += "`n## Resource Access"
ForEach ($resource in $appInfo.requiredResourceAccess) {
$currentResource = (az ad sp show --id $resource.resourceAppId) | ConvertFrom-Json
$resourceName = $currentResource.displayName
if (![string]::IsNullOrEmpty($resourceName)) {
$fragments += "`n### $($resourceName)"
}
if ($resource.resourceAccess) {
$fragments += "`n_App Roles_"
$fragments += "| Role |"
$fragments += "| ------ |"
$appRoles = (az ad sp show --id $resource.resourceAppId --query "appRoles[].{Value:value, Id:id}") | ConvertFrom-Json
ForEach ($access in $resource.resourceAccess) {
$appRole = ($appRoles | Where-Object { $_.Id -eq $access.id })
$appRoleName = $appRole.Value
if (![string]::IsNullOrEmpty($appRoleName)) {
if (![string]::IsNullOrEmpty($appRoleName)) {
$fragments += "|$($appRoleName)|"
}
}
}
}
if ($resource.oauth2Permissions) {
$fragments += "`n_OAuth2 Permissions_"
$fragments += "| Permission |"
$fragments += "| ------ |"
$oauth2Permissions = (az ad sp show --id $resource.resourceAppId --query "oauth2Permissions[].{Value:value, Id:id}") | ConvertFrom-Json
ForEach ($oauth2Permission in $resource.oauth2Permissions) {
$appOauth2Permission = ($oauth2Permissions | Where-Object { $_.Id -eq $oauth2Permission.id })
$appOauth2PermissionName = $appOauth2Permission.Value
if (![string]::IsNullOrEmpty($appOauth2PermissionName)) {
$fragments += "|$($appOauth2PermissionName)|"
}
}
}
}
$fragments += "`n_report run $(Get-Date)_"
$fragments | out-file -FilePath $outputDocumentPath
$progressCountApp++
}
Write-Progress -Id 0 -Activity " " -Status " " -Completed
}
$docTitle = "Azure AD Application Details"
$docDescription = "This is a script generated documentation. For more details contact teamname_GDL@yourcompany.com"
$outputFolderPath = $PSScriptRoot
$aadApplications = GetAadApplications
GenerateDocumentation $aadApplications
Output

I would like to thank Jayakumar Balasubramaniam for the support he provided to review and finalize this script.
Published on:
Learn moreRelated posts
Vasanam Studio: How I Built a Bible Verse Video Generator for My Church as a Hobby Project
Every morning at 5 AM, the women of my church gather for prayer. At the end of the session, our pastor’s wife shares a Bible verse and sends a...
The demo worked. That was the problem.
Over a weekend I built a small Kubernetes demo to play with zero trust. Three little services calling each other in a chain, a login page in f...
Notes from building an agent on AgentCore end to end
I wanted a reason to use AgentCore end to end. Runtime, memory, guardrails, identity, the whole thing. A Bible Q&A agent felt like a good ...
Building a Rust gRPC AI Security Gateway for LLM Traffic
I wanted a small, honest implementation of the GenAI governance shape in code: a component on every LLM call that applies policy first, option...
Claude Code Security: The Smart Way to Integrate AI
Anthropic just dropped Claude Code Security, and if you’re anywhere near AppSec or DevSecOps, you’ve probably already seen the debate lighting...
How I Built a Semantic Cache Using Only AWS Services
LLM calls are expensive and slow, but here’s the thing - users ask the same questions in different ways all the time. “What’s your refund poli...
How to Build Better AI Agent Tools: Cut Costs by 70% (MCP Server Case Study)
Building tools for AI agents isn’t the same as building regular APIs. This guide shows you how to design tools that reduce token costs by 60-7...
Building a DevSecOps Pipeline on AWS (And You Can Too)
I have been working with CI/CD pipelines for a while now, and honestly, most of them just focus on getting code deployed fast. But what about ...
AWS DevOps Agent: AI-Powered Incident Investigation in Seconds
Stop spending 30 minutes investigating incidents. Let AI do it in seconds. Here is a hands-on demo you can practice in 15 minutes. The Proble...
DynamoDB Just Made Your Life Easier: Multi-Attribute Composite Keys Explained
AWS just dropped a feature on November 19, 2025 that is going to save you from one of DynamoDB’s most annoying workarounds: multi-attribute co...