M365 PowerShell

Get-MgApplicationOwner: How to Retrieve Application Owners in Microsoft 365

This guide explains how to use the Get-MgApplicationOwner cmdlet in Microsoft Graph PowerShell to retrieve the owners of Azure AD applications. Learn how to fetch owner details, handle multiple applications, and troubleshoot common issues.

The Get-MgApplicationOwner cmdlet in Microsoft Graph PowerShell allows administrators to retrieve the owners of a specified application, enabling them to manage and monitor who has access to control these applications. This article will provide a comprehensive guide to using the Get-MgApplicationOwner cmdlet, including its syntax, practical usage examples, tips, common errors with solutions, and relevant use cases.

Note: You need Application Ids to work with this cmdlet. Use Get-MgApplication to get the application id.

Cmdlet Syntax

Get-MgApplicationOwner -ApplicationId <String>

-ApplicationId: The unique identifier (GUID) of the application whose owners you want to retrieve.

Usage Examples

Example 1: Retrieve Owner of a Specific Application

This example retrieves owner of an application with a specified ApplicationId and outputs user marked as application owner (identified by the provided ApplicationId) and displays Displayname and UserId of application owner using Get-MgUser cmdlet..

Get-MgApplicationOwner -ApplicationId "2a1b3c4d-5678-90ab-cdef-1234567890ab"

Example 2: Retrieve Owners of a Specific Application

This example retrieves multiple owners of an application with a specified ApplicationId, loops through the owners list, and outputs the DisplayName, UserPrincipalName, and User ID of the application owners using Get-MgUser cmdlet.

Get-MgApplicationOwner -ApplicationId "2a1b3c4d-5678-90ab-cdef-1234567890ab" -Select "Id DisplayName"

Cmdlet Tips

Use the -Select Parameter: Use the -Select parameter to limit the data returned to only the properties you need. This can improve performance and readability, especially when working with large datasets.
Combine -Filter and -Select: Combine -Filter and -Select parameters for more targeted results. This combination allows you to efficiently query and display only relevant information.
Consider Pagination: Consider pagination when dealing with applications that have a large number of owners. Microsoft Graph API typically limits the number of results returned by a single query, so ensure you handle paging where necessary.

Possible Errors & Solutions

Error 1: ApplicationNotFound

Cause: The specified ApplicationId does not exist in the directory.

Solution: Verify the ApplicationId by checking the application in the Azure portal or using the Get-MgApplication cmdlet to ensure the ID is correct.

Get-MgApplicationOwner : ApplicationNotFound - The application with ID '2a1b3c4d-5678-90ab-cdef-1234567890ab' could not be found.

Error 2: Authorization_RequestDenied

Cause: The user running the cmdlet does not have sufficient permissions to access the application owners.

Solution: Ensure the account running the cmdlet has the appropriate roles, such as Application Administrator or Global Administrator, and that the necessary permissions (e.g., Application.Read.All) are granted in the Azure AD App Registration.

Get-MgApplicationOwner : Authorization_RequestDenied - Insufficient privileges to complete the operation.

Error 3: BadRequest

Cause: The -Filter or -Select query is malformed or contains invalid parameters.

Solution: Double-check the syntax and ensure that the parameters are used correctly according to the Microsoft Graph API documentation.

Get-MgApplicationOwner : BadRequest - Invalid filter clause.

Use Cases

Auditing Application Ownership for Security Compliance:

Scenario: IT administrators need to regularly audit Azure AD applications to ensure that each application has a responsible owner, especially in large organizations with multiple registered applications.
Implementation: Use Get-MgApplicationOwner to retrieve the list of owners for each application. This helps verify that every application has a designated owner, making it easier to track ownership in the event of security incidents or audits.
Benefit: Ensures that applications are properly managed and that there is clear accountability for each app, helping to maintain compliance with security policies and regulations.

Identifying Orphaned Applications:

Scenario: Over time, some applications may lose their owners due to employees leaving or changing roles, resulting in "orphaned" applications that no one is actively managing.
Implementation: Use Get-MgApplicationOwner to identify applications that do not have any assigned owners. These orphaned apps can then be reviewed, reassigned, or removed if no longer necessary.
Benefit: Prevents security risks associated with unmanaged applications and ensures that all apps are actively maintained by designated owners.

Transferring Application Ownership:

Scenario: When an employee who owns an Azure AD application leaves the organization or moves to a new role, ownership of their applications must be transferred to another person.
Implementation: Use Get-MgApplicationOwner to retrieve the current owner of an application, then assign a new owner using the appropriate cmdlet (Add-MgApplicationOwner). This ensures that critical applications remain under active management during personnel transitions.
Benefit: Maintains continuous application management and prevents gaps in responsibility when owners change roles or leave the company.

Generating Reports for Application Ownership:

Scenario: Organizations may need to generate periodic reports to provide visibility into who owns which applications, especially for governance or review purposes.
Implementation: Use Get-MgApplicationOwner to retrieve application ownership information and export it to CSV or other formats for reporting. These reports can be reviewed by security teams or compliance officers to ensure ownership is correctly assigned.
Benefit: Provides a clear and organized way to report on application ownership, which can be useful during audits or governance reviews to ensure that all applications are properly managed.

Frequently Asked Questions

1. What is Get-MgApplicationOwner used for?

Get-MgApplicationOwner is a Microsoft Graph PowerShell cmdlet used to retrieve the owners of Azure AD applications, helping administrators manage application ownership effectively.

2. How can I retrieve the owners of a specific application?

Use the following command to fetch the owners of an application:

Get-MgApplicationOwner -ApplicationId "<ApplicationId>"

3. Can I retrieve owners for multiple applications?

Yes, loop through application IDs to retrieve their owners. Example:

$Applications = Get-MgApplication -All
foreach ($App in $Applications) {
    $Owners = Get-MgApplicationOwner -ApplicationId $App.Id
    Write-Output "Application: $($App.DisplayName)"
    Write-Output $Owners
 }

4. How can I export application owners to a CSV file?

Use this script to export application owners:

$Results = @()
$Applications = Get-MgApplication -All
foreach ($App in $Applications) {
            $Owners = Get-MgApplicationOwner -ApplicationId $App.Id
            foreach ($Owner in $Owners) {
            $Results += [PSCustomObject]@{
                ApplicationName = $App.DisplayName
                OwnerName = $Owner.DisplayName
                OwnerEmail = $Owner.UserPrincipalName
        }
    }
}
$Results | Export-Csv -Path "C:\Path\To\ApplicationOwners.csv" -NoTypeInformation

5. What permissions are required to retrieve application owners?

You need the Application.Read.All or Application.ReadWrite.All permission in Microsoft Graph PowerShell. Ensure these permissions are granted before running the cmdlet.

Conclusion

The Get-MgApplicationOwner cmdlet is a powerful tool for administrators managing Azure AD applications. By retrieving and analyzing application owners, you can maintain tighter control over who has administrative privileges for critical applications. Whether you're auditing ownership, troubleshooting access issues, or ensuring compliance, this cmdlet provides the functionality needed to perform these tasks efficiently.

Additional Resources:

Graph PowerShell Get-MgApplicationOwner Cmdlet Documentation
Microsoft Graph PowerShell Module Documentation
Microsoft Graph API Documentation

Using Get-MgDirectoryRole in Graph PowerShell
Using Get-MgUserLicenseDetail in Graph PowerShell
Using Find-GraphMgCommand in Graph PowerShell
Connect to Microsoft 365 Using PowerShell
How to Create Bulk Users in Office 365 Using Graph PowerShell?
Create Microsoft 365 Group Using Microsoft Graph PowerShell
Block Microsoft 365 User Using Microsoft Graph PowerShell
Assign Microsoft 365 License Using Graph PowerShell
Microsoft 365 User Management Using Graph PowerShell
Checking Group Membership in Microsoft 365
Bulk Assign Microsoft 365 License
Find Inactive Users in Microsoft 365
Using Powershell Graph Search Query
Using Powershell Graph Filter Query
Using Where-Object In Graph PowerShell
Using Expand Property In Graph PowerShell
Using Select Object In Graph PowerShell
Using -Contains Operator In Graph PowerShell
Add User to Multiple Microsoft 365 Groups Using Graph PowerShell
Get Microsoft 365 User Location Using Graph PowerShell
Import Microsoft 365 Groups from CSV File Using Graph PowerShell
Microsoft 365 Group User Import Using Graph PowerShell