🔐 Recipe · Entra ID & Identity

Remove an Enterprise Application and its Service Principals from Entra ID

Find all related app registrations and service principals by name, then cleanly delete them from your tenant

Complexity

Intermediate

Impact

security + access-control + app-lifecycle + cleanup

Context

Why This Matters

When you decommission a SaaS vendor, revoke a third-party integration, or respond to a security incident involving a rogue OAuth app, you need to remove its footprint from Entra ID. A single vendor often leaves behind multiple artifacts:

One or more App Registrations (the application object) in your tenant
One or more Enterprise Applications (service principals) — including the home-tenant service principal and any consented multi-tenant service principals pointing to the vendor's app
Variant naming (SaaS Alerts, SaaS Alerts Respond, SAAS_ALERTS_RESPOND) from different product lines or historical consents

Deleting only the Enterprise Application you see in the portal often leaves orphaned registrations or other related service principals behind, which can continue to hold permissions or reappear on next sign-in. This recipe shows the complete find-and-remove workflow.

Expected Outcomes

After completing this recipe you will have:

A full inventory of every application and service principal matching the vendor's name prefix
All selected service principals deleted from Entra ID (revoking their tokens and permissions)
All related App Registrations deleted (preventing re-instantiation)
Graph API audit entries for each deletion, suitable for compliance evidence

Risks & Considerations

⚠️ Before you delete

Deletion is soft for 30 days. App registrations and service principals move to the deleted items container and can be restored via /directory/deletedItems. After 30 days deletion is permanent.
Active dependencies break immediately. If any workflow, Conditional Access policy, app role assignment, or automation authenticates as or to this app, it will fail the moment the service principal is deleted.
Check for secrets and certificates on the App Registration before deletion — if the app holds keys used elsewhere, revoke them at the consuming system first.
Filter carefully. The Graph $filter operator does not support contains() on displayName. Use startswith() or fetch and filter client-side. A too-broad startswith() (e.g. startswith(displayName,'S')) can return hundreds of unrelated apps.
Microsoft-owned first-party service principals (e.g. Microsoft Graph, Office 365 SharePoint Online) cannot and should not be deleted, even if they match your filter.
Delete order matters only loosely: deleting the App Registration automatically cascades to its home-tenant service principal, but multi-tenant service principals in your directory must be deleted separately.

Required Permissions

Permission	Why It's Needed
Application.Read.All	List and search for applications and service principals to identify all items related to the vendor.
Application.ReadWrite.All	Delete service principals and application registrations from the tenant.
Directory.Read.All	Optional — read related directory objects (role assignments, owners) before deletion.

The fastest way to get this done: just ask Dex. Copy the prompt below and paste it into your Dex conversation.

For IT Admins

Paste into Dex Pro

Find every Entra ID application and service principal whose name starts with '{AppNamePrefix}' (e.g. SaaS Alerts), show me the full list, and after I confirm, delete all selected service principals and their App Registrations from the tenant.

Try in Dex Pro

Remove the app via the Entra admin center

Step 1 — Find every related Enterprise Application

Sign in to the Microsoft Entra admin center as a Cloud Application Administrator or Global Administrator.
Navigate to Identity → Applications → Enterprise applications → All applications.
In the Application type filter, choose All Applications (clear the default 'Enterprise Applications' scope so you see Microsoft-published and managed identity SPs too, if needed).
In the search box, type the vendor keyword (e.g. {AppName}). Note every match — variants with underscores, suffixes like Respond, or different casing.

Step 2 — Find every related App Registration

Navigate to Identity → Applications → App registrations → All applications.
Search for the same keyword and list the matches. These are the application objects that may be owned by your tenant.

Step 3 — Review dependencies for each match

Open each Enterprise Application and check Users and groups (who is assigned), Permissions (what API scopes are consented), and Sign-in logs (is it still being used?).
Open each App Registration and check Certificates & secrets for active credentials.

Step 4 — Delete the Enterprise Applications (service principals)

In each Enterprise Application blade, select Manage → Properties.
Click Delete at the top of the blade and confirm.
Repeat for every related service principal.

Step 5 — Delete the App Registrations

In each App Registration, click Delete at the top of the Overview blade and confirm.
Deleting an App Registration that has a home-tenant service principal will also delete that SP.

Step 6 — Verify

Return to Enterprise applications and App registrations, search the keyword again, and confirm zero results.
If you need to recover within 30 days, browse to App registrations → Deleted applications.

Remove the app via Microsoft Graph

1. Search for matching App Registrations

Graph does not support contains() on displayName. Use startswith():

GET https://graph.microsoft.com/v1.0/applications?$filter=startswith(displayName,'{AppNamePrefix}')&$select=id,displayName,appId

Example response:

{
  "value": [
    {
      "id": "c3765acb-9d38-413a-988f-47d81d0b7102",
      "displayName": "SAAS_ALERTS_RESPOND",
      "appId": "7dcfe5f7-4054-4a4c-b55a-3195101a8059"
    }
  ]
}

2. Search for matching Service Principals

GET https://graph.microsoft.com/v1.0/servicePrincipals?$filter=startswith(displayName,'{AppNamePrefix}')&$select=id,displayName,appId,servicePrincipalType

Review each result. Ignore servicePrincipalType == "ManagedIdentity" entries unless you intend to remove them.

3. (Optional) Inspect consented permissions before deletion

GET https://graph.microsoft.com/v1.0/servicePrincipals/{spId}/oauth2PermissionGrants
GET https://graph.microsoft.com/v1.0/servicePrincipals/{spId}/appRoleAssignments

4. Delete each service principal

DELETE https://graph.microsoft.com/v1.0/servicePrincipals/{spId}

// Success response
HTTP/1.1 204 No Content

5. Delete each App Registration

DELETE https://graph.microsoft.com/v1.0/applications/{appObjectId}

// Note: use the application's object id (id), NOT the appId (client id)
HTTP/1.1 204 No Content

6. Verify & (optional) purge from the deleted items container

// List soft-deleted applications (30-day retention)
GET https://graph.microsoft.com/v1.0/directory/deletedItems/microsoft.graph.application

// Permanently delete (optional — bypass 30-day restore window)
DELETE https://graph.microsoft.com/v1.0/directory/deletedItems/{id}

Automate with Microsoft Graph PowerShell

The Microsoft Graph PowerShell SDK provides Get-MgApplication, Get-MgServicePrincipal, Remove-MgApplication, and Remove-MgServicePrincipal. The workflow:

Connect with Application.ReadWrite.All scope.
Search using -Filter "startswith(displayName,'...')". Because contains() is not supported server-side, use startswith or pull a broader set and filter with Where-Object.
Preview the matches and require -Confirm or -WhatIf before any destructive call.
Delete service principals first, then their App Registrations.
Verify by re-running the search.

The downloadable script below wraps this pattern with confirmation prompts, a -WhatIf preview mode, and a run-log summary.

# Quick one-liner preview (no deletions)
Connect-MgGraph -Scopes "Application.ReadWrite.All"
Get-MgServicePrincipal -Filter "startswith(displayName,'SaaS Alerts')" |
    Select-Object Id, DisplayName, AppId

Next steps

More Entra ID & Identity recipes

Browse the rest of this category in the Dex Cookbook.

Automate this with Dex Pro

Let the autonomous IT engineer run this task under your policies.

Start free

Point Dex at a tenant and try it for 30 days, no credit card.