🔐 Recipe · Entra ID & Identity

List Users Assigned to an Enterprise Application in Entra ID

Enumerate every user (and group) granted access to a specific enterprise app via the service principal's app role assignments

Complexity

Beginner

Impact

access-review + audit + read-only + identity

Context

Why This Matters

Why this matters

Enterprise applications in Entra ID (such as Workday, Salesforce, ServiceNow, or any SAML/OIDC SaaS app) are exposed to end users through app role assignments on the application's service principal. Knowing exactly who is assigned to an app is a foundational access review task.

Common triggers

Access reviews and audit/compliance evidence (SOX, SOC 2, ISO 27001).
License reconciliation — matching Entra assignments to SaaS vendor seat counts.
Offboarding verification — confirming a departing user has been removed from sensitive apps.
Troubleshooting "I can't see the app in My Apps" complaints.
Pre-migration inventory before changing group-based assignment or SSO configuration.

Because many tenants have multiple service principals with similar names (e.g. several Workday entries for SSO, provisioning, and companion apps), a correct listing first requires disambiguating which service principal you mean.

Expected Outcomes

After running this recipe you will have

The objectId (service principal ID) and appId of the target enterprise application.
A complete list of directly assigned principals — users, groups, and service principals — with display name, principal type, and object ID.
Optionally, the fully expanded roster of users when groups are assigned (by recursively expanding group membership).
Exportable output (CSV/JSON) suitable for access-review evidence or ticket attachments.

Risks & Considerations

Warnings and gotchas

Group assignments hide users. appRoleAssignedTo returns the assigned principal. If a group is assigned, you will see the group — not its members. Expand group membership separately if you need the user-level roster.
"Assignment required" setting matters. If the service principal has appRoleAssignmentRequired = false, users may sign in without an explicit assignment. The assignment list is then not an authoritative list of actual users.
Multiple service principals with similar names. Gallery apps often create companion service principals (e.g. Workday, Workday - Absence Calendar Integration, Workday Peakon Employee Voice). Confirm the appId before assuming you've picked the right one.
Deleted/orphaned principals. Assignments may reference principals that no longer exist; handle gracefully.
Do not modify assignments while enumerating. Treat this as a read-only task; any cleanup should be a separate, reviewed change.
Data sensitivity. Assignment rosters can reveal org structure — store exports per your data-handling policy.

Required Permissions

Permission	Why It's Needed
Application.Read.All	Read service principal and app role assignment data for all enterprise applications.
Directory.Read.All	Resolve assigned principals (users, groups, service principals) and expand group membership.
User.Read.All	Retrieve user details (UPN, mail, accountEnabled) when enriching the output.
GroupMember.Read.All	Expand group-based assignments to the underlying user roster (optional).

The fastest way to get this done: just ask Dex. Copy the prompt below and paste it into your Dex conversation.

For IT Admins

Paste into Dex Pro

List every user assigned to the {app_name} enterprise application in Entra ID. Disambiguate if multiple service principals match the name, expand any assigned groups to their user members, and return a deduplicated roster with UPN, mail, account status, and whether the assignment is direct or via a group.

Try in Dex Pro

List assigned users via the Entra admin center

Sign in to the Microsoft Entra admin center as a Cloud Application Administrator (or higher).
Navigate to Identity → Applications → Enterprise applications.
In the Application type filter choose All Applications, then search for the app name (e.g. Workday).
If multiple results appear, open each row and compare the Application ID on the Overview blade against the vendor's expected app ID to select the correct service principal.
On the chosen application, select Manage → Users and groups.
Review the assignments list — each row shows Display name, Object type (User / Group), and the assigned app role.
Click Download assignments in the command bar to export the list as CSV for audit or ticketing evidence.
If any row is a group and you need the user-level list, click the group name, then open Members from the group blade (or use the API/script approach for recursive expansion).

Check assignment enforcement

On the same app, open Manage → Properties and confirm Assignment required? is set to Yes. If it is No, the list on the Users and groups blade may not reflect everyone who can actually use the app.

Enumerate assignments with Microsoft Graph

Step 1 — Find the service principal

Filter by display name. Because gallery apps often create multiple service principals, always review the full result set.

GET https://graph.microsoft.com/v1.0/servicePrincipals?$filter=startsWith(displayName,'{appName}')&$select=id,displayName,appId,appRoleAssignmentRequired

Example response:

{
  "value": [
    { "id": "4038b01e-1d4a-48a2-a238-ae70644fdd39", "displayName": "Workday", "appId": "22bc5557-4764-432e-b39c-0fe76d2a0fd6", "appRoleAssignmentRequired": true },
    { "id": "d723c975-bba5-40a1-8cd3-8fd1ee6a9d17", "displayName": "Workday - Absence Calendar Integration", "appId": "ef604b03-3b2e-4a0b-bf9a-c7993e6b7e19", "appRoleAssignmentRequired": false }
  ]
}

Step 2 — List app role assignments

Use appRoleAssignedTo on the chosen service principal's id:

GET https://graph.microsoft.com/v1.0/servicePrincipals/{sp-id}/appRoleAssignedTo?$select=principalDisplayName,principalType,principalId,appRoleId,createdDateTime

Example response:

{
  "value": [
    { "principalDisplayName": "Cliff DuPuy", "principalType": "User", "principalId": "315230ee-a11e-4d1c-8009-21e5152ecad3" },
    { "principalDisplayName": "Dean Bott",  "principalType": "User", "principalId": "7d6e495a-6170-45e7-8fd8-a0c160409a6a" },
    { "principalDisplayName": "Finance-Workday-Users", "principalType": "Group", "principalId": "c7e0..." }
  ]
}

Step 3 (optional) — Expand groups to users

For any row where principalType == "Group", list transitive members:

GET https://graph.microsoft.com/v1.0/groups/{group-id}/transitiveMembers/microsoft.graph.user?$select=id,displayName,userPrincipalName,accountEnabled

Step 4 (optional) — Enrich user detail

GET https://graph.microsoft.com/v1.0/users/{user-id}?$select=id,displayName,userPrincipalName,mail,accountEnabled,jobTitle,department

Paging

Large tenants will page results. Follow @odata.nextLink until it is absent.

Enumerate assignments with Microsoft Graph PowerShell

The Microsoft.Graph module wraps the Graph endpoints above. The script below disambiguates by name, filters the correct service principal by AppId when provided, lists assignments, and optionally expands groups to their user members.

Install and connect

Install-Module Microsoft.Graph -Scope CurrentUser
Connect-MgGraph -Scopes "Application.Read.All","Directory.Read.All","GroupMember.Read.All"

Quick one-liner

# Find service principal(s) by name
Get-MgServicePrincipal -Filter "startswith(displayName,'Workday')" | Select Id,DisplayName,AppId

# List direct assignments
Get-MgServicePrincipalAppRoleAssignedTo -ServicePrincipalId '4038b01e-1d4a-48a2-a238-ae70644fdd39' -All |
  Select PrincipalDisplayName,PrincipalType,PrincipalId

For larger enterprise apps use the downloadable script below, which handles paging, group expansion, deduplication, and CSV export.

Next steps

More Entra ID & Identity recipes

Browse the rest of this category in the Dex Cookbook.

Automate this with Dex Pro

Let the autonomous IT engineer run this task under your policies.

Start free

Point Dex at a tenant and try it for 30 days, no credit card.