---
title: "PATCH /{tenantID}/applications/{applicationObjectId}"
method: PATCH
path: "/{tenantID}/applications/{applicationObjectId}"
tags: ["Application"]
---

# PATCH /{tenantID}/applications/{applicationObjectId}

`PATCH /{tenantID}/applications/{applicationObjectId}`

Update an existing application.

## Path parameters

- `applicationObjectId` string, required
- `tenantID` string, required

## Query parameters

- `api-version` string, required

## Request body

- ApplicationUpdateParameters — Active Directive Application common properties shared among GET, POST and PATCH
  - `allowGuestsSignIn` boolean — A property on the application to indicate if the application accepts other IDPs or not or partially accepts.
  - `allowPassthroughUsers` boolean — Indicates that the application supports pass through users who have no presence in the resource tenant.
  - `appLogoUrl` string — The url for the application logo image stored in a CDN.
  - `appRoles` AppRole[] — The collection of application roles that an application may declare. These roles can be assigned to users, groups or service principals.
    - `id` string — Unique role identifier inside the appRoles collection.
    - `allowedMemberTypes` string[] — Specifies whether this app role definition can be assigned to users and groups by setting to 'User', or to other applications (that are accessing this application in daemon service scenarios) by setting to 'Application', or to both.
    - `description` string — Permission help text that appears in the admin app assignment and consent experiences.
    - `displayName` string — Display name for the permission that appears in the admin consent and app assignment experiences.
    - `isEnabled` boolean — When creating or updating a role definition, this must be set to true (which is the default). To delete a role, this must first be set to false. At that point, in a subsequent call, this role may be removed.
    - `value` string — Specifies the value of the roles claim that the application should expect in the authentication and access tokens.
  - `appPermissions` string[] — The application permissions.
  - `availableToOtherTenants` boolean — Whether the application is available to other tenants.
  - `errorUrl` string — A URL provided by the author of the application to report errors when using the application.
  - `groupMembershipClaims` 'None' | 'SecurityGroup' | 'All' — Configures the groups claim issued in a user or OAuth 2.0 access token that the app expects.
  - `homepage` string — The home page of the application.
  - `informationalUrls` InformationalUrl — Represents a group of URIs that provide terms of service, marketing, support and privacy policy information about an application. The default value for each string is null.
    - `termsOfService` string — The terms of service URI
    - `marketing` string — The marketing URI
    - `privacy` string — The privacy policy URI
    - `support` string — The support URI
  - `isDeviceOnlyAuthSupported` boolean — Specifies whether this application supports device authentication without a user. The default is false.
  - `keyCredentials` KeyCredential[] — A collection of KeyCredential objects.
    - `startDate` string, date-time — Start date.
    - `endDate` string, date-time — End date.
    - `value` string — Key value.
    - `keyId` string — Key ID.
    - `usage` string — Usage. Acceptable values are 'Verify' and 'Sign'.
    - `type` string — Type. Acceptable values are 'AsymmetricX509Cert' and 'Symmetric'.
    - `customKeyIdentifier` string — Custom Key Identifier
  - `knownClientApplications` string[] — Client applications that are tied to this resource application. Consent to any of the known client applications will result in implicit consent to the resource application through a combined consent dialog (showing the OAuth permission scopes required by the client and the resource).
  - `logoutUrl` string — the url of the logout page
  - `oauth2AllowImplicitFlow` boolean — Whether to allow implicit grant flow for OAuth2
  - `oauth2AllowUrlPathMatching` boolean — Specifies whether during a token Request Azure AD will allow path matching of the redirect URI against the applications collection of replyURLs. The default is false.
  - `oauth2Permissions` OAuth2Permission[] — The collection of OAuth 2.0 permission scopes that the web API (resource) application exposes to client applications. These permission scopes may be granted to client applications during consent.
    - `adminConsentDescription` string — Permission help text that appears in the admin consent and app assignment experiences.
    - `adminConsentDisplayName` string — Display name for the permission that appears in the admin consent and app assignment experiences.
    - `id` string — Unique scope permission identifier inside the oauth2Permissions collection.
    - `isEnabled` boolean — When creating or updating a permission, this property must be set to true (which is the default). To delete a permission, this property must first be set to false. At that point, in a subsequent call, the permission may be removed.
    - `type` string — Specifies whether this scope permission can be consented to by an end user, or whether it is a tenant-wide permission that must be consented to by a Company Administrator. Possible values are "User" or "Admin".
    - `userConsentDescription` string — Permission help text that appears in the end user consent experience.
    - `userConsentDisplayName` string — Display name for the permission that appears in the end user consent experience.
    - `value` string — The value of the scope claim that the resource application should expect in the OAuth 2.0 access token.
  - `oauth2RequirePostResponse` boolean — Specifies whether, as part of OAuth 2.0 token requests, Azure AD will allow POST requests, as opposed to GET requests. The default is false, which specifies that only GET requests will be allowed.
  - `orgRestrictions` string[] — A list of tenants allowed to access application.
  - `optionalClaims` OptionalClaims — Specifying the claims to be included in the token.
    - `idToken` OptionalClaim[] — Optional claims requested to be included in the id token.
      - `name` string — Claim name.
      - `source` string — Claim source.
      - `essential` boolean — Is this a required claim.
      - `additionalProperties` object
    - `accessToken` OptionalClaim[] — Optional claims requested to be included in the access token.
      - `name` string — Claim name.
      - `source` string — Claim source.
      - `essential` boolean — Is this a required claim.
      - `additionalProperties` object
    - `samlToken` OptionalClaim[] — Optional claims requested to be included in the saml token.
      - `name` string — Claim name.
      - `source` string — Claim source.
      - `essential` boolean — Is this a required claim.
      - `additionalProperties` object
  - `passwordCredentials` PasswordCredential[] — A collection of PasswordCredential objects
    - `startDate` string, date-time — Start date.
    - `endDate` string, date-time — End date.
    - `keyId` string — Key ID.
    - `value` string — Key value.
    - `customKeyIdentifier` string, byte — Custom Key Identifier
  - `preAuthorizedApplications` PreAuthorizedApplication[] — list of pre-authorized applications.
    - `appId` string — Represents the application id.
    - `permissions` PreAuthorizedApplicationPermission[] — Collection of required app permissions/entitlements from the resource application.
      - `directAccessGrant` boolean — Indicates whether the permission set is DirectAccess or impersonation.
      - `accessGrants` string[] — The list of permissions.
    - `extensions` PreAuthorizedApplicationExtension[] — Collection of extensions from the resource application.
      - `conditions` string[] — The extension's conditions.
  - `publicClient` boolean — Specifies whether this application is a public client (such as an installed application running on a mobile device). Default is false.
  - `publisherDomain` string — Reliable domain which can be used to identify an application.
  - `replyUrls` string[] — A collection of reply URLs for the application.
  - `requiredResourceAccess` RequiredResourceAccess[] — Specifies resources that this application requires access to and the set of OAuth permission scopes and application roles that it needs under each of those resources. This pre-configuration of required resource access drives the consent experience.
    - `resourceAccess` ResourceAccess[], required — The list of OAuth2.0 permission scopes and app roles that the application requires from the specified resource.
      - `id` string, required — The unique identifier for one of the OAuth2Permission or AppRole instances that the resource application exposes.
      - `type` string — Specifies whether the id property references an OAuth2Permission or an AppRole. Possible values are "scope" or "role".
    - `resourceAppId` string — The unique identifier for the resource that the application requires access to. This should be equal to the appId declared on the target resource application.
  - `samlMetadataUrl` string — The URL to the SAML metadata for the application.
  - `signInAudience` string — Audience for signing in to the application (AzureADMyOrganization, AzureADAllOrganizations, AzureADAndMicrosoftAccounts).
  - `wwwHomepage` string — The primary Web page.

## Response `204`

No Content

## Other responses

- `default` — Error response describing why the operation failed.

---

[API](https://skmtc.net/azure/apis/graphrbacmanagementclient.md) · [All operations](https://skmtc.net/azure/apis/graphrbacmanagementclient/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/azure/graphrbacmanagementclient/revisions/71d95005600e/schema)