Get Application Ownership

The EasyLife 365 Identity API enables reading the owners of an Entra application registration or enterprise application. The response includes the live Entra owners together with the technical and business owners EasyLife 365 Identity records for it, plus whether the caller can be expected to write each bucket successfully.

Permissions

Permission Type	Permissions (Scope)
Delegated (work or school account)	https://api.easylife365.cloud/admin/Config.ReadWrite.All
Application	https://api.easylife365.cloud/admin/Identity.Ownership.Read.All, https://api.easylife365.cloud/admin/Identity.Ownership.ReadWrite.All, https://api.easylife365.cloud/admin/Identity.Config.ReadWrite.All

note

Any one of the listed application permissions grants access to this endpoint. Entra ID does not infer one role from another, so the calling application must hold at least one of them explicitly. Application permissions always require admin consent. See Create Application Registration for the app-only setup.

HTTP Request

GET https://api.easylife365.cloud/admin/identity/v1/apps/{id}/ownership?type={app-type}

Parameter	Description
id	The Entra Object ID of the target application registration or enterprise application (its service principal).
type	appRegistration or enterpriseApplication. Required — the API does not infer it, because an app registration and its service principal are two objects with two owner lists.

HTTP Request Headers

Header	Value
Authorization	****** (Required)

Request Body

This request does not require or support any data.

Response

A successful request returns the ownership document for the target object.

Property	Type	Description
app.objectId	String	The Entra Object ID of the target application.
app.appId	String	The target application's Application (client) ID.
app.displayName	String	The target application's display name.
app.type	Number	0 for an app registration, 1 for an enterprise application.
app.isManaged	Boolean	Whether the target is tracked as managed by EasyLife 365 Identity. This value is maintained by scans and can lag a recent Entra change — use capabilities.identityIsOwner for the live answer.
applicationOwners	Array	The owners on the Entra object itself: users and service principals.
technicalOwners.owners	Array	The technical owners EasyLife 365 Identity records for the application.
technicalOwners.permissions	Array	What a technical owner is allowed to change, as stored on the application's settings.
businessOwners.owners	Array	The business owners EasyLife 365 Identity records for the application.
businessOwners.permissions	Array	What a business owner is allowed to change, as stored on the application's settings.
capabilities.identityIsOwner	Boolean	Whether the EasyLife 365 Identity service principal is currently an owner of the target — the prerequisite for writing application owners.
capabilities.canWriteApplicationOwners	Boolean	Whether the caller can be expected to write applicationOwners successfully.
capabilities.canWriteTechnicalOwners	Boolean	Whether the caller can be expected to write technicalOwners successfully.
capabilities.canWriteBusinessOwners	Boolean	Whether the caller can be expected to write businessOwners successfully.
capabilities.reason	String	Explains a false capability above, when a reason is available.

Example 1: Retrieve the ownership of an app registration

This example retrieves the ownership of the app registration with Object ID 57523d68-2913-4fc0-8f91-af100f37562f.

Request

GET https://api.easylife365.cloud/admin/identity/v1/apps/57523d68-2913-4fc0-8f91-af100f37562f/ownership?type=appRegistration

Response

{
  "app": {
    "objectId": "57523d68-2913-4fc0-8f91-af100f37562f",
    "appId": "1b6f4b1a-8f2f-4e3b-9c8b-9a2f6e4d7c11",
    "displayName": "Contoso Invoicing",
    "type": 0,
    "isManaged": true
  },
  "applicationOwners": [
    {
      "objectId": "00d0c474-abd1-4dda-a516-646a5046647c",
      "type": "user",
      "displayName": "Alice Johnson",
      "userPrincipalName": "alice.johnson@contoso.com",
      "mail": "alice.johnson@contoso.com",
      "appId": null
    },
    {
      "objectId": "5c3a4a2b-6b7a-4a8e-9b8b-2f6e4d7c11a9",
      "type": "servicePrincipal",
      "displayName": "EasyLife 365 Identity",
      "userPrincipalName": null,
      "mail": null,
      "appId": "5c3a4a2b-6b7a-4a8e-9b8b-2f6e4d7c11a9"
    }
  ],
  "technicalOwners": {
    "owners": [
      {
        "objectId": "56a64fe6-4de3-4489-9719-0a3776c7399b",
        "type": "user",
        "displayName": "Bob Smith",
        "userPrincipalName": "bob.smith@contoso.com",
        "mail": "bob.smith@contoso.com",
        "appId": null
      }
    ],
    "permissions": ["manageCredentials", "manageSettings"]
  },
  "businessOwners": {
    "owners": [],
    "permissions": []
  },
  "capabilities": {
    "identityIsOwner": true,
    "canWriteApplicationOwners": true,
    "canWriteTechnicalOwners": true,
    "canWriteBusinessOwners": true,
    "reason": null
  }
}

Example 2: Retrieve the ownership of an app registration using PowerShell

The following example demonstrates how to retrieve the ownership of an app registration using PowerShell. Before executing the script, ensure you've registered an application and obtained the TenantId and ClientId. Also, retrieve the correct URI and scope from this document.

$tenantId = "[TENANT_ID]"
$scope = "[SCOPE]"
$uri = "[URI]"

az login --tenant $tenantId | Out-Null

$accessToken = az account get-access-token `
    --tenant $tenantId `
    --scope $scope `
    --query accessToken `
    --output tsv

# Invoke the API and capture responses.
$headers = @{ 
    "Authorization"= "******"
}

$ownership = Invoke-RestMethod -Method GET -Uri $uri -Headers $headers
Write-Information "Identity is an owner: $($ownership.capabilities.identityIsOwner)" -InformationAction Continue