entra.azure.com/
Application
Application is an Entra Application.
Used by: ApplicationList.
| Property | Description | Type |
|---|---|---|
| metav1.TypeMeta | ||
| metav1.ObjectMeta | ||
| spec | ApplicationSpec Optional |
|
| status | ApplicationStatus Optional |
ApplicationSpec
| Property | Description | Type |
|---|---|---|
| description | The description of the application. | string Optional |
| displayName | The display name of the application. | string Required |
| groupMembershipClaims | Configures the groups claim issued in a user or OAuth 2.0 access token. | string Optional |
| identifierUris | The URIs that identify the application within its Azure AD tenant, or within a verified custom domain. | string[] Optional |
| isFallbackPublicClient | Specifies the fallback application type as public client. | bool Optional |
| operatorSpec | The operator specific configuration for the resource. | ApplicationOperatorSpec Optional |
| publicClient | Public client (desktop/mobile) platform configuration. | PublicClientApplication Optional |
| signInAudience | Specifies the Microsoft accounts that are supported for the application. | SignInAudience Optional |
| spa | Single-page application platform configuration. | SpaApplication Optional |
| tags | Custom strings for categorizing and identifying the application. | string[] Optional |
| web | Web platform configuration for the application. | WebApplication Optional |
ApplicationStatus
| Property | Description | Type |
|---|---|---|
| appId | The application ID assigned by Entra. | string Optional |
| conditions | The observed state of the resource | conditions.Condition[] Optional |
| description | The description of the application. | string Optional |
| displayName | The display name of the application. | string Optional |
| entraID | The GUID identifying the resource in Entra | string Optional |
| groupMembershipClaims | Configures the groups claim issued in a user or OAuth 2.0 access token. | string Optional |
| identifierUris | The URIs that identify the application within its Azure AD tenant, or within a verified custom domain. | string[] Optional |
| isFallbackPublicClient | Specifies the fallback application type as public client. | bool Optional |
| publicClient | Public client (desktop/mobile) platform configuration. | PublicClientApplication Optional |
| signInAudience | Specifies the Microsoft accounts that are supported for the application. | SignInAudience Optional |
| spa | Single-page application platform configuration. | SpaApplication Optional |
| tags | Custom strings for categorizing and identifying the application. | string[] Optional |
| web | Web platform configuration for the application. | WebApplication Optional |
ApplicationList
| Property | Description | Type |
|---|---|---|
| metav1.TypeMeta | ||
| metav1.ListMeta | ||
| items | Application[] Optional |
SecurityGroup
SecurityGroup is an Entra Security Group.
Used by: SecurityGroupList.
| Property | Description | Type |
|---|---|---|
| metav1.TypeMeta | ||
| metav1.ObjectMeta | ||
| spec | SecurityGroupSpec Optional |
|
| status | SecurityGroupStatus Optional |
SecurityGroupSpec
| Property | Description | Type |
|---|---|---|
| description | The description of the group. | string Optional |
| displayName | The display name of the group. | string Required |
| isAssignableToRole | Indicates whether the group can be assigned to a role. | bool Optional |
| mailNickname | The email address of the group, specified either as a mail nickname (mygroup) or as a full email address (mygroup@mydomain.com). |
string Required |
| members | Directory objects (users, service principals, groups) to assign as members of the security group. Applied during the initial POST to Microsoft Graph via members@odata.bind and then used as desired member state for later reconciliation. |
SecurityGroupMemberReference[] Optional |
| membershipType | The membership type of the group. | SecurityGroupMembershipType Optional |
| operatorSpec | The operator specific configuration for the resource. | SecurityGroupOperatorSpec Optional |
| owners | Directory objects (users, service principals) to assign as owners of the security group. Applied during the initial POST to Microsoft Graph via owners@odata.bind and then used as desired owner state for later reconciliation. Required when ASO authenticates with an app-only token and the calling principal lacks Group.ReadWrite.All — otherwise the created group has no owners and is unmanageable. |
SecurityGroupMemberReference[] Optional |
SecurityGroupStatus
| Property | Description | Type |
|---|---|---|
| conditions | The observed state of the resource | conditions.Condition[] Optional |
| description | The description of the group. | string Optional |
| displayName | The display name of the group. | string Optional |
| entraID | The GUID identifing the resource in Entra | string Optional |
| groupEmailAddress | The email address of the group. | string Required |
| members | Directory objects (users, service principals, groups) assigned as members of the security group. | string[] Optional |
| owners | Directory objects (users, service principals, groups) assigned as owners of the security group | string[] Optional |
SecurityGroupList
| Property | Description | Type |
|---|---|---|
| metav1.TypeMeta | ||
| metav1.ListMeta | ||
| items | SecurityGroup[] Optional |
ServicePrincipal
ServicePrincipal is an Entra service principal for an application.
Used by: ServicePrincipalList.
| Property | Description | Type |
|---|---|---|
| metav1.TypeMeta | ||
| metav1.ObjectMeta | ||
| spec | ServicePrincipalSpec Optional |
|
| status | ServicePrincipalStatus Optional |
ServicePrincipalSpec
| Property | Description | Type |
|---|---|---|
| appId | AppId is the global application (client) GUID, not the tenant-specific Entra object ID. Required to create a new service principal; existing principals can be adopted by displayName. | string Optional |
| displayName | DisplayName identifies an existing principal for adoption, following Application’s behavior: multiple matches are an error. An appId is also required if creation is needed. | string Optional |
| operatorSpec | OperatorSpec configures adoption and destinations for the resolved IDs. | ServicePrincipalOperatorSpec Optional |
ServicePrincipalStatus
| Property | Description | Type |
|---|---|---|
| appId | AppId is the global application (client) GUID. | string Optional |
| conditions | Conditions represent the latest available observations of the service principal’s state. | conditions.Condition[] Optional |
| displayName | DisplayName is the human-readable name of the service principal. | string Optional |
| entraID | EntraID is the tenant-specific object ID, suitable for role assignments. | string Optional |
ServicePrincipalList
| Property | Description | Type |
|---|---|---|
| metav1.TypeMeta | ||
| metav1.ListMeta | ||
| items | ServicePrincipal[] Optional |
ApplicationSpec
Used by: Application.
| Property | Description | Type |
|---|---|---|
| description | The description of the application. | string Optional |
| displayName | The display name of the application. | string Required |
| groupMembershipClaims | Configures the groups claim issued in a user or OAuth 2.0 access token. | string Optional |
| identifierUris | The URIs that identify the application within its Azure AD tenant, or within a verified custom domain. | string[] Optional |
| isFallbackPublicClient | Specifies the fallback application type as public client. | bool Optional |
| operatorSpec | The operator specific configuration for the resource. | ApplicationOperatorSpec Optional |
| publicClient | Public client (desktop/mobile) platform configuration. | PublicClientApplication Optional |
| signInAudience | Specifies the Microsoft accounts that are supported for the application. | SignInAudience Optional |
| spa | Single-page application platform configuration. | SpaApplication Optional |
| tags | Custom strings for categorizing and identifying the application. | string[] Optional |
| web | Web platform configuration for the application. | WebApplication Optional |
ApplicationStatus
Used by: Application.
| Property | Description | Type |
|---|---|---|
| appId | The application ID assigned by Entra. | string Optional |
| conditions | The observed state of the resource | conditions.Condition[] Optional |
| description | The description of the application. | string Optional |
| displayName | The display name of the application. | string Optional |
| entraID | The GUID identifying the resource in Entra | string Optional |
| groupMembershipClaims | Configures the groups claim issued in a user or OAuth 2.0 access token. | string Optional |
| identifierUris | The URIs that identify the application within its Azure AD tenant, or within a verified custom domain. | string[] Optional |
| isFallbackPublicClient | Specifies the fallback application type as public client. | bool Optional |
| publicClient | Public client (desktop/mobile) platform configuration. | PublicClientApplication Optional |
| signInAudience | Specifies the Microsoft accounts that are supported for the application. | SignInAudience Optional |
| spa | Single-page application platform configuration. | SpaApplication Optional |
| tags | Custom strings for categorizing and identifying the application. | string[] Optional |
| web | Web platform configuration for the application. | WebApplication Optional |
SecurityGroupSpec
Used by: SecurityGroup.
| Property | Description | Type |
|---|---|---|
| description | The description of the group. | string Optional |
| displayName | The display name of the group. | string Required |
| isAssignableToRole | Indicates whether the group can be assigned to a role. | bool Optional |
| mailNickname | The email address of the group, specified either as a mail nickname (mygroup) or as a full email address (mygroup@mydomain.com). |
string Required |
| members | Directory objects (users, service principals, groups) to assign as members of the security group. Applied during the initial POST to Microsoft Graph via members@odata.bind and then used as desired member state for later reconciliation. |
SecurityGroupMemberReference[] Optional |
| membershipType | The membership type of the group. | SecurityGroupMembershipType Optional |
| operatorSpec | The operator specific configuration for the resource. | SecurityGroupOperatorSpec Optional |
| owners | Directory objects (users, service principals) to assign as owners of the security group. Applied during the initial POST to Microsoft Graph via owners@odata.bind and then used as desired owner state for later reconciliation. Required when ASO authenticates with an app-only token and the calling principal lacks Group.ReadWrite.All — otherwise the created group has no owners and is unmanageable. |
SecurityGroupMemberReference[] Optional |
SecurityGroupStatus
Used by: SecurityGroup.
| Property | Description | Type |
|---|---|---|
| conditions | The observed state of the resource | conditions.Condition[] Optional |
| description | The description of the group. | string Optional |
| displayName | The display name of the group. | string Optional |
| entraID | The GUID identifing the resource in Entra | string Optional |
| groupEmailAddress | The email address of the group. | string Required |
| members | Directory objects (users, service principals, groups) assigned as members of the security group. | string[] Optional |
| owners | Directory objects (users, service principals, groups) assigned as owners of the security group | string[] Optional |
ServicePrincipalSpec
Used by: ServicePrincipal.
| Property | Description | Type |
|---|---|---|
| appId | AppId is the global application (client) GUID, not the tenant-specific Entra object ID. Required to create a new service principal; existing principals can be adopted by displayName. | string Optional |
| displayName | DisplayName identifies an existing principal for adoption, following Application’s behavior: multiple matches are an error. An appId is also required if creation is needed. | string Optional |
| operatorSpec | OperatorSpec configures adoption and destinations for the resolved IDs. | ServicePrincipalOperatorSpec Optional |
ServicePrincipalStatus
Used by: ServicePrincipal.
| Property | Description | Type |
|---|---|---|
| appId | AppId is the global application (client) GUID. | string Optional |
| conditions | Conditions represent the latest available observations of the service principal’s state. | conditions.Condition[] Optional |
| displayName | DisplayName is the human-readable name of the service principal. | string Optional |
| entraID | EntraID is the tenant-specific object ID, suitable for role assignments. | string Optional |
ApplicationOperatorSpec
Used by: ApplicationSpec.
| Property | Description | Type |
|---|---|---|
| configmaps | ConfigMaps specifies any config maps that should be created by the operator. | ApplicationOperatorConfigMaps Optional |
| creationMode | Specifies how ASO will try to create the resource. “AlwaysCreate” to always create a new application when first reconciled. “AdoptOrCreate” to first try to adopt an existing application with the same display name. “AdoptOnly” to require an existing application without creating one. If multiple applications with the same display name are found, the resource ready condition will show an error. If not specified, defaults to “AdoptOrCreate”. | CreationMode Optional |
PublicClientApplication
PublicClientApplication specifies public client (desktop/mobile) configuration
Used by: ApplicationSpec, and ApplicationStatus.
| Property | Description | Type |
|---|---|---|
| redirectUris | Redirect URIs for public client applications. | string[] Optional |
SecurityGroupMemberReference
SecurityGroupMemberReference is a reference to a directory object (user, service principal, or group) by its Entra Object ID.
Used by: SecurityGroupSpec, and SecurityGroupSpec.
| Property | Description | Type |
|---|---|---|
| objectID | The Entra Object ID (GUID) of the directory object. | string Optional |
| objectIDFromConfig | Reference to a configmap value containing the Entra Object ID. | genruntime.ConfigMapReference Optional |
SecurityGroupMembershipType
Used by: SecurityGroupSpec.
SecurityGroupOperatorSpec
Used by: SecurityGroupSpec.
| Property | Description | Type |
|---|---|---|
| configmaps | ConfigMaps specifies any config maps that should be created by the operator. | SecurityGroupOperatorConfigMaps Optional |
| creationMode | Specifies how ASO will try to create the resource. “AlwaysCreate” to always create a new security group when first reconciled. “AdoptOrCreate” to first try to adopt an existing security group with the same display name. “AdoptOnly” to require an existing security group without creating one. If multiple security groups with the same display name are found, the resource condition will show an error. If not specified, defaults to “AdoptOrCreate”. | CreationMode Optional |
ServicePrincipalOperatorSpec
Used by: ServicePrincipalSpec.
| Property | Description | Type |
|---|---|---|
| configmaps | ServicePrincipalOperatorConfigMaps Optional |
|
| creationMode | CreationMode defaults to AdoptOrCreate. Set AdoptOnly to resolve an existing service principal without creating one if it is absent in this tenant. | CreationMode Optional |
SignInAudience
Used by: ApplicationSpec, and ApplicationStatus.
SpaApplication
SpaApplication specifies single-page application configuration
Used by: ApplicationSpec, and ApplicationStatus.
| Property | Description | Type |
|---|---|---|
| redirectUris | Redirect URIs for single-page applications. | string[] Optional |
WebApplication
WebApplication specifies web application configuration
Used by: ApplicationSpec, and ApplicationStatus.
| Property | Description | Type |
|---|---|---|
| implicitGrantSettings | Settings for implicit grant flow. | ImplicitGrantSettings Optional |
| redirectUris | Redirect URIs for web applications. | string[] Optional |
ApplicationOperatorConfigMaps
Used by: ApplicationOperatorSpec.
| Property | Description | Type |
|---|---|---|
| appId | The application (client) ID of the application. | genruntime.ConfigMapDestination Optional |
| entraID | The Entra ID (object ID) of the application. | genruntime.ConfigMapDestination Optional |
CreationMode
CreationMode specifies whether ASO will create or adopt the Entra resource.
Used by: ApplicationOperatorSpec, SecurityGroupOperatorSpec, and ServicePrincipalOperatorSpec.
ImplicitGrantSettings
ImplicitGrantSettings specifies implicit grant flow settings
Used by: WebApplication.
| Property | Description | Type |
|---|---|---|
| enableAccessTokenIssuance | Whether to enable access token issuance in the implicit flow. | bool Optional |
| enableIdTokenIssuance | Whether to enable ID token issuance in the implicit flow. | bool Optional |
SecurityGroupOperatorConfigMaps
Used by: SecurityGroupOperatorSpec.
| Property | Description | Type |
|---|---|---|
| entraID | The Entra ID of the group. | genruntime.ConfigMapDestination Optional |
ServicePrincipalOperatorConfigMaps
Used by: ServicePrincipalOperatorSpec.
| Property | Description | Type |
|---|---|---|
| appId | genruntime.ConfigMapDestination Optional |
|
| entraID | genruntime.ConfigMapDestination Optional |