azure_rm_adapplication

Manage Azure Active Directory application

Collection: azure.azcollection

Full Name: azure.azcollection.azure_rm_adapplication

Synopsis

Manage Azure Active Directory application

Parameters

Name	Type	Required	Default	Description
ad_user	string			Active Directory username. Use when authenticating with an Active Directory user rather than service principal.
adfs_authority_url	string			Azure AD authority url. Use when authenticating with Username/password, and has your own ADFS authority.
allow_guests_sign_in	bool			A property on the application to indicate if the application accepts other IDPs or not or partially accepts.
api_profile	string		`latest`	Selects an API profile to use when communicating with Azure services. Default value of C(latest) is appropriate for public clouds; future values will allow use with Azure Stack.
app_id	string			Application ID.
app_roles	list			Declare the roles you want to associate with your application.
auth_source	string		`auto`	Controls the source of the credentials to use for authentication.
Can also be set via the C(ANSIBLE_AZURE_AUTH_SOURCE) environment variable.
When set to C(auto) (the default) the precedence is module parameters -> C(env) -> C(credential_file) -> C(cli).
When set to C(env), the credentials will be read from the environment variables.
When set to C(credential_file), it will read the profile from C(~/.azure/credentials).
When set to C(cli), the credentials will be sources from the Azure CLI profile. C(subscription_id) or the environment variable C(AZURE_SUBSCRIPTION_ID) can be used to identify the subscription ID if more than one is present otherwise the default az cli subscription is used.
When set to C(msi), the host machine must be an azure resource with an enabled MSI extension. C(subscription_id) or the environment variable C(AZURE_SUBSCRIPTION_ID) can be used to identify the subscription ID if the resource is granted access to more than one subscription, otherwise the first subscription is chosen.
The C(msi) was added in Ansible 2.6.
cert_validation_mode	string			Controls the certificate validation behavior for Azure endpoints. By default, all modules will validate the server certificate, but when an HTTPS proxy is in use, or against Azure Stack, it may be necessary to disable this behavior by passing C(ignore). Can also be set via credential file profile or the C(AZURE_CERT_VALIDATION) environment variable.
client_id	string			Azure client ID. Use when authenticating with a Service Principal or Managed Identity (msi).
Can also be set via the C(AZURE_CLIENT_ID) environment variable.
cloud_environment	string		`AzureCloud`	For cloud environments other than the US public cloud, the environment name (as defined by Azure Python SDK, eg, C(AzureChinaCloud), C(AzureUSGovernment)), or a metadata discovery endpoint URL (required for Azure Stack). Can also be set via credential file profile or the C(AZURE_CLOUD_ENVIRONMENT) environment variable.
credential_description	string			The description of the password.
disable_instance_discovery	bool		`false`	Determines whether or not instance discovery is performed when attempting to authenticate. Setting this to true will completely disable both instance discovery and authority validation. This functionality is intended for use in scenarios where the metadata endpoint cannot be reached such as in private clouds or Azure Stack. The process of instance discovery entails retrieving authority metadata from https://login.microsoft.com/ to validate the authority. By setting this to True, the validation of the authority is disabled. As a result, it is crucial to ensure that the configured authority host is valid and trustworthy.
Set via credential file profile or the C(AZURE_DISABLE_INSTANCE_DISCOVERY) environment variable.
display_name	string	yes		The display name of the application.
end_date	string			Date or datetime after which credentials expire(e.g. ‘2017-12-31’).
Default value is one year after current time.
homepage	string			The url where users can sign in and use your app.
identifier_uris	list			Space-separated unique URIs that Azure AD can use for this app.
key_display_name	string			Name for the certificate credential created on the new application.
Used together with C(key_value).
key_type	string		`AsymmetricX509Cert`	The type of the key credentials associated with the application.
key_usage	string		`Verify`	The usage of the key credentials associated with the application.
key_value	string			The value for the key credentials associated with the application.
log_mode	string			Parent argument.
log_path	string			Parent argument.
native_app	bool			An application which can be installed on a user’s device or computer.
notes	string			Notes relevant for the management of the application.
oauth2_allow_implicit_flow	bool			Whether to allow implicit grant flow for OAuth2.
oidc_token	string			Direct OpenID Connect (OIDC) token (JWT) used for workload identity authentication.
This token is exchanged with Azure AD using OIDC federated identity.
Useful in CI systems (for example GitHub Actions, Azure DevOps) where an OIDC token is provided directly by the platform.
Can also be set via the C(AZURE_FEDERATED_TOKEN) environment variable.
oidc_token_file_path	string			Path to a file containing an OpenID Connect (OIDC) token (JWT) used for workload identity authentication.
The file must contain only raw token.
This method is commonly used in platforms that materialize OIDC tokens as files
Can also be set via the C(AZURE_FEDERATED_TOKEN_FILE) environment variable.
optional_claims	dict			Declare the optional claims for the application.
password	string			(Deprecated). Microsoft Graph generates client secrets server-side and rejects client-supplied values.
When set, the supplied value is ignored and a server-generated secret is created instead.
Prefer C(request_password=true) with C(password_display_name). The generated secret appears in the registered result under C(generated_password_credentials[0].secret_text).
For ongoing rotation/management of secrets, use I(azure.azcollection.azure_rm_adpassword).
password_display_name	string			Name for the client secret created on the new application.
Used together with C(request_password=true) (or legacy C(password)).
profile	string			Security profile found in ~/.azure/credentials file.
public_client_reply_urls	list			The public client redirect urls.
Space-separated URIs to which Azure AD will redirect in response to an OAuth 2.0 request.
The value does not need to be a physical endpoint, but must be a valid URI.
request_password	bool		`false`	When C(true), ask Microsoft Graph to generate a client secret for the new application.
The generated secret is returned in C(generated_password_credentials[0].secret_text) and is only retrievable from that response; there is no way to fetch it later.
Mutually exclusive with C(key_value).
Has no effect when C(state=absent) or C(native_app=true).
On an update, this parameter is ignored with a warning. Microsoft Graph does not allow adding password credentials via PATCH /applications. For ongoing secret rotation, use I(azure.azcollection.azure_rm_adpassword).
required_resource_accesses	list			Resource scopes and roles the application requires access to.
Should be in manifest json format.
secret	string			Azure client secret. Use when authenticating with a Service Principal.
sign_in_audience	string			The application can be used from any Azure AD tenants.
Microsoft Graph SDK deprecate I(available_to_other_tenants), replace by I(sign_in_audience).
Refer to link U(https://learn.microsoft.com/en-us/graph/migrate-azure-ad-graph-property-differences#application-property-differences)
spa_reply_urls	list			The spa redirect urls.
Space-separated URIs to which Azure AD will redirect in response to an OAuth 2.0 request.
The value does not need to be a physical endpoint, but must be a valid URI.
start_date	string			Date or datetime at which credentials become valid, such as ‘2017-01-01’.
Default value is current time.
state	string		`present`	Assert the state of Active Dirctory service principal.
Use C(present) to create or update a Password and use C(absent) to delete.
subscription_id	string			Your Azure subscription Id.
tenant	string			Azure tenant ID. Use when authenticating with a Service Principal.
thumbprint	string			The thumbprint of the private key specified in I(x509_certificate_path).
Use when authenticating with a Service Principal.
Required if I(x509_certificate_path) is defined.
web_reply_urls	list			The web redirect urls.
Space-separated URIs to which Azure AD will redirect in response to an OAuth 2.0 request.
The value does not need to be a physical endpoint, but must be a valid URI.
x509_certificate_path	string			Path to the X509 certificate used to create the service principal in PEM format.
The certificate must be appended to the private key.
Use when authenticating with a Service Principal.

Example

yaml

- name: Create ad application
  azure.azcollection.azure_rm_adapplication:
    display_name: "{{ display_name }}"

- name: Create ad application with multi redirect urls
  azure.azcollection.azure_rm_adapplication:
    display_name: "{{ display_name }}"
    web_reply_urls:
      - https://web01.com
    spa_reply_urls:
      - https://spa01.com
      - https://spa02.com
    public_client_reply_urls:
      - https://public01.com
      - https://public02.com

- name: Create application with more parameter
  azure.azcollection.azure_rm_adapplication:
    display_name: "{{ display_name }}"
    sign_in_audience: AzureADandPersonalMicrosoftAccount
    credential_description: "for test"
    end_date: 2021-10-01
    start_date: 2021-05-18
    identifier_uris: fredtest02.com

- name: delete ad application
  azure.azcollection.azure_rm_adapplication:
    app_id: "{{ app_id }}"
    state: absent

- name: Add certificate credential when creating ad application
  azure.azcollection.azure_rm_adapplication:
    display_name: "{{ display_name }}"
    key_type: AsymmetricX509Cert
    key_usage: Verify
    key_value: "{{ cert_file.content }}" # slurp gives base64 of the file; module normalizes to DER bytes
    tenant: "{{ tenant_id }}"
    subscription_id: "{{ subscription_id }}"

- name: Create ad application and request a server-generated client secret
  azure.azcollection.azure_rm_adapplication:
    display_name: "{{ display_name }}"
    request_password: true
    password_display_name: "ansible-managed-secret"
  register: app
  no_log: true

- name: Show the generated secret (only available on this create response)
  ansible.builtin.debug:
    msg: "{{ app.generated_password_credentials[0].secret_text }}"
  no_log: true