How to use Azure CLI to Generate Documentation for Azure AD Applications?
Your organization likely has hundreds of Azure AD Applications. And with the constant addition, development and subset of new applications with various access points, it becomes imperative to use a script that streamlines the documentation process and helps creates technical documentation for every registered application. And that’s where the following script steps in.
What is Azure Active Directory?
Azure Active Directory is an Identity and Access Management (IAM) system. It provides a single place to store information about digital identities. You can configure your applications to use Azure AD as the place where user information is stored.
Advantages of generating documentation for Azure AD Applications
- Improves the experience for developers using your Azure AD Applications
- Decreases the amount of time spent on-boarding developers and application integration partners.
- Leads to good maintenance and quicker updates.
- API permissions, scopes, roles help developers and integration partners to understand the Azure AD Application and know what it can do
- Decreases the amount of time spent on decoding unexpected errors when using it.
In this article, I have attached a PowerShell script that takes the details of the given Azure AD Applications as input and creates readable markdown documentation that you can share with developers and integration partners using the simple use of Azure’s CLI commands.
Prerequisites
- Azure CLI
- Azure AD Applications registered in Azure tenant
- Azure Application Administrator / Developer role
- Login to Azure using Azure CLI before executing following script
Note - This code has not been optimized and is for demo purpose. You might need to modify the code as per your requirements.
PowerShell Script
function GetTenantId() {
    $accountDetails = az account list | ConvertFrom-Json
    return $accountDetails.tenantId
}
function GetAadApplications() {
    return (az ad app list --all) | ConvertFrom-Json 
}
function GenerateDocumentation($aadApplications) {
    $progressCountApp = 1;
    ForEach ($appInfo in $aadApplications) {
        Write-Progress -Id 0 -Activity "Generating Documentation for the App: $($appInfo.displayName)" -Status "App $progressCountApp of $($aadApplications.length)" -PercentComplete (($progressCountApp / $aadApplications.length) * 100)
        $outputDocumentPath = -join ($outputFolderPath, "\" , $appInfo.displayName, ".md")
        
        $fragments = @()
        $fragments += "# $($docTitle)`n"
        $fragments += "$($docDescription)`n"
        $fragments += "## App Details"
        $fragments += "| Property  | Value  |"
        $fragments += "| ------ | ------ |"
        $fragments += "|Display Name|$($appInfo.displayName)|"
        $fragments += "|App Id|$($appInfo.appId)|"
        $fragments += "|Publisher Domain|$($appInfo.publisherDomain)|"
        $fragments += "`n## Resource Access"
        ForEach ($resource in $appInfo.requiredResourceAccess) {
            $currentResource = (az ad sp show --id $resource.resourceAppId) | ConvertFrom-Json
            $resourceName = $currentResource.displayName
            if (![string]::IsNullOrEmpty($resourceName)) {
                $fragments += "`n### $($resourceName)"
            }
            if ($resource.resourceAccess) {
                $fragments += "`n_App Roles_"
                $fragments += "| Role  |"
                $fragments += "| ------ |"
    
                $appRoles = (az ad sp show --id $resource.resourceAppId --query "appRoles[].{Value:value, Id:id}") | ConvertFrom-Json
                ForEach ($access in $resource.resourceAccess) {
                    $appRole = ($appRoles | Where-Object { $_.Id -eq $access.id })
                    $appRoleName = $appRole.Value
                    if (![string]::IsNullOrEmpty($appRoleName)) {
                        if (![string]::IsNullOrEmpty($appRoleName)) {
                            $fragments += "|$($appRoleName)|"
                        }
                    }
                }
            }
            if ($resource.oauth2Permissions) {
                $fragments += "`n_OAuth2 Permissions_"
                $fragments += "| Permission  |"
                $fragments += "| ------ |"
                $oauth2Permissions = (az ad sp show --id $resource.resourceAppId --query "oauth2Permissions[].{Value:value, Id:id}") | ConvertFrom-Json    
                ForEach ($oauth2Permission in $resource.oauth2Permissions) {
                    $appOauth2Permission = ($oauth2Permissions | Where-Object { $_.Id -eq $oauth2Permission.id })
                    $appOauth2PermissionName = $appOauth2Permission.Value
                    if (![string]::IsNullOrEmpty($appOauth2PermissionName)) {
                        $fragments += "|$($appOauth2PermissionName)|"
                    }
                }
            }
        }
        $fragments += "`n_report run $(Get-Date)_"  
        $fragments | out-file -FilePath $outputDocumentPath
        $progressCountApp++
    }
    Write-Progress -Id 0 -Activity " " -Status " " -Completed
}
$docTitle = "Azure AD Application Details"
$docDescription = "This is a script generated documentation. For more details contact teamname_GDL@yourcompany.com"
$outputFolderPath = $PSScriptRoot
$aadApplications = GetAadApplications 
GenerateDocumentation $aadApplications
Output

I would like to thank Jayakumar Balasubramaniam for the support he provided to review and finalize this script.
Published on:
Learn moreRelated posts
Failures Happen in Cloud, but how Azure Cosmos DB keeps your Applications Online
The only thing that’s constant in distributed systems is failures. No cloud platform is immune to failures — from regional outages and transie...
The `azd` extension to configure GitHub Copilot coding agent integration with Azure
This post shares how to set up the GitHub Copilot coding agent integration with Azure resources and services by using the Azure Developer CLI ...
Announcing Azure MCP Server 1.0.0 Stable Release – A New Era for Agentic Workflows
Today marks a major milestone for agentic development on Azure: the stable release of the Azure MCP Server 1.0! The post Announcing Azure MCP ...
From Backup to Discovery: Veeam’s Search Engine Powered by Azure Cosmos DB
This article was co-authored by Zack Rossman, Staff Software Engineer, Veeam; Ashlie Martinez, Staff Software Engineer, Veeam; and James Nguye...
Azure SDK Release (October 2025)
Azure SDK releases every month. In this post, you'll find this month's highlights and release notes. The post Azure SDK Release (October 2025)...
Microsoft Copilot (Microsoft 365): [Copilot Extensibility] No-Code Publishing for Azure AI Foundry Agents to Microsoft 365 Copilot Agent Store
Developers can now publish Azure AI Foundry Agents directly to the Microsoft 365 Copilot Agent Store with a simplified, no-code experience. Pr...
Azure Marketplace and AppSource: A Unified AI Apps and Agents Marketplace
The Microsoft AI Apps and Agents Marketplace is set to transform how businesses discover, purchase, and deploy AI-powered solutions. This new ...
Episode 413 – Simplifying Azure Files with a new file share-centric management model
Welcome to Episode 413 of the Microsoft Cloud IT Pro Podcast. Microsoft has introduced a new file share-centric management model for Azure Fil...
Bringing Context to Copilot: Azure Cosmos DB Best Practices, Right in Your VS Code Workspace
Developers love GitHub Copilot for its instant, intelligent code suggestions. But what if those suggestions could also reflect your specific d...
