entra.azure.com/
Application
Application is an Entra Application.
Used by: ApplicationList.
| Property | Description | Type |
|---|---|---|
| metav1.TypeMeta | ||
| metav1.ObjectMeta | ||
| spec | ApplicationSpec Optional |
|
| status | ApplicationStatus Optional |
ApplicationSpec
| Property | Description | Type |
|---|---|---|
| description | The description of the application. | string Optional |
| displayName | The display name of the application. | string Required |
| groupMembershipClaims | Configures the groups claim issued in a user or OAuth 2.0 access token. | string Optional |
| identifierUris | The URIs that identify the application within its Azure AD tenant, or within a verified custom domain. | string[] Optional |
| isFallbackPublicClient | Specifies the fallback application type as public client. | bool Optional |
| operatorSpec | The operator specific configuration for the resource. | ApplicationOperatorSpec Optional |
| publicClient | Public client (desktop/mobile) platform configuration. | PublicClientApplication Optional |
| signInAudience | Specifies the Microsoft accounts that are supported for the application. | SignInAudience Optional |
| spa | Single-page application platform configuration. | SpaApplication Optional |
| tags | Custom strings for categorizing and identifying the application. | string[] Optional |
| web | Web platform configuration for the application. | WebApplication Optional |
ApplicationStatus
| Property | Description | Type |
|---|---|---|
| appId | The application ID assigned by Entra. | string Optional |
| conditions | The observed state of the resource | conditions.Condition[] Optional |
| description | The description of the application. | string Optional |
| displayName | The display name of the application. | string Optional |
| entraID | The GUID identifying the resource in Entra | string Optional |
| groupMembershipClaims | Configures the groups claim issued in a user or OAuth 2.0 access token. | string Optional |
| identifierUris | The URIs that identify the application within its Azure AD tenant, or within a verified custom domain. | string[] Optional |
| isFallbackPublicClient | Specifies the fallback application type as public client. | bool Optional |
| publicClient | Public client (desktop/mobile) platform configuration. | PublicClientApplication Optional |
| signInAudience | Specifies the Microsoft accounts that are supported for the application. | SignInAudience Optional |
| spa | Single-page application platform configuration. | SpaApplication Optional |
| tags | Custom strings for categorizing and identifying the application. | string[] Optional |
| web | Web platform configuration for the application. | WebApplication Optional |
ApplicationList
| Property | Description | Type |
|---|---|---|
| metav1.TypeMeta | ||
| metav1.ListMeta | ||
| items | Application[] Optional |
SecurityGroup
SecurityGroup is an Entra Security Group.
Used by: SecurityGroupList.
| Property | Description | Type |
|---|---|---|
| metav1.TypeMeta | ||
| metav1.ObjectMeta | ||
| spec | SecurityGroupSpec Optional |
|
| status | SecurityGroupStatus Optional |
SecurityGroupSpec
| Property | Description | Type |
|---|---|---|
| description | The description of the group. | string Optional |
| displayName | The display name of the group. | string Required |
| isAssignableToRole | Indicates whether the group can be assigned to a role. | bool Optional |
| mailNickname | The email address of the group, specified either as a mail nickname (mygroup) or as a full email address (mygroup@mydomain.com). |
string Required |
| members | Directory objects (users, service principals, groups) to assign as members of the security group. Applied during the initial POST to Microsoft Graph via members@odata.bind and then used as desired member state for later reconciliation. |
SecurityGroupMemberReference[] Optional |
| membershipType | The membership type of the group. | SecurityGroupMembershipType Optional |
| operatorSpec | The operator specific configuration for the resource. | SecurityGroupOperatorSpec Optional |
| owners | Directory objects (users, service principals) to assign as owners of the security group. Applied during the initial POST to Microsoft Graph via owners@odata.bind and then used as desired owner state for later reconciliation. Required when ASO authenticates with an app-only token and the calling principal lacks Group.ReadWrite.All — otherwise the created group has no owners and is unmanageable. |
SecurityGroupMemberReference[] Optional |
SecurityGroupStatus
| Property | Description | Type |
|---|---|---|
| conditions | The observed state of the resource | conditions.Condition[] Optional |
| description | The description of the group. | string Optional |
| displayName | The display name of the group. | string Optional |
| entraID | The GUID identifing the resource in Entra | string Optional |
| groupEmailAddress | The email address of the group. | string Required |
| members | Directory objects (users, service principals, groups) assigned as members of the security group. | string[] Optional |
| owners | Directory objects (users, service principals, groups) assigned as owners of the security group | string[] Optional |
SecurityGroupList
| Property | Description | Type |
|---|---|---|
| metav1.TypeMeta | ||
| metav1.ListMeta | ||
| items | SecurityGroup[] Optional |
ApplicationSpec
Used by: Application.
| Property | Description | Type |
|---|---|---|
| description | The description of the application. | string Optional |
| displayName | The display name of the application. | string Required |
| groupMembershipClaims | Configures the groups claim issued in a user or OAuth 2.0 access token. | string Optional |
| identifierUris | The URIs that identify the application within its Azure AD tenant, or within a verified custom domain. | string[] Optional |
| isFallbackPublicClient | Specifies the fallback application type as public client. | bool Optional |
| operatorSpec | The operator specific configuration for the resource. | ApplicationOperatorSpec Optional |
| publicClient | Public client (desktop/mobile) platform configuration. | PublicClientApplication Optional |
| signInAudience | Specifies the Microsoft accounts that are supported for the application. | SignInAudience Optional |
| spa | Single-page application platform configuration. | SpaApplication Optional |
| tags | Custom strings for categorizing and identifying the application. | string[] Optional |
| web | Web platform configuration for the application. | WebApplication Optional |
ApplicationStatus
Used by: Application.
| Property | Description | Type |
|---|---|---|
| appId | The application ID assigned by Entra. | string Optional |
| conditions | The observed state of the resource | conditions.Condition[] Optional |
| description | The description of the application. | string Optional |
| displayName | The display name of the application. | string Optional |
| entraID | The GUID identifying the resource in Entra | string Optional |
| groupMembershipClaims | Configures the groups claim issued in a user or OAuth 2.0 access token. | string Optional |
| identifierUris | The URIs that identify the application within its Azure AD tenant, or within a verified custom domain. | string[] Optional |
| isFallbackPublicClient | Specifies the fallback application type as public client. | bool Optional |
| publicClient | Public client (desktop/mobile) platform configuration. | PublicClientApplication Optional |
| signInAudience | Specifies the Microsoft accounts that are supported for the application. | SignInAudience Optional |
| spa | Single-page application platform configuration. | SpaApplication Optional |
| tags | Custom strings for categorizing and identifying the application. | string[] Optional |
| web | Web platform configuration for the application. | WebApplication Optional |
SecurityGroupSpec
Used by: SecurityGroup.
| Property | Description | Type |
|---|---|---|
| description | The description of the group. | string Optional |
| displayName | The display name of the group. | string Required |
| isAssignableToRole | Indicates whether the group can be assigned to a role. | bool Optional |
| mailNickname | The email address of the group, specified either as a mail nickname (mygroup) or as a full email address (mygroup@mydomain.com). |
string Required |
| members | Directory objects (users, service principals, groups) to assign as members of the security group. Applied during the initial POST to Microsoft Graph via members@odata.bind and then used as desired member state for later reconciliation. |
SecurityGroupMemberReference[] Optional |
| membershipType | The membership type of the group. | SecurityGroupMembershipType Optional |
| operatorSpec | The operator specific configuration for the resource. | SecurityGroupOperatorSpec Optional |
| owners | Directory objects (users, service principals) to assign as owners of the security group. Applied during the initial POST to Microsoft Graph via owners@odata.bind and then used as desired owner state for later reconciliation. Required when ASO authenticates with an app-only token and the calling principal lacks Group.ReadWrite.All — otherwise the created group has no owners and is unmanageable. |
SecurityGroupMemberReference[] Optional |
SecurityGroupStatus
Used by: SecurityGroup.
| Property | Description | Type |
|---|---|---|
| conditions | The observed state of the resource | conditions.Condition[] Optional |
| description | The description of the group. | string Optional |
| displayName | The display name of the group. | string Optional |
| entraID | The GUID identifing the resource in Entra | string Optional |
| groupEmailAddress | The email address of the group. | string Required |
| members | Directory objects (users, service principals, groups) assigned as members of the security group. | string[] Optional |
| owners | Directory objects (users, service principals, groups) assigned as owners of the security group | string[] Optional |
ApplicationOperatorSpec
Used by: ApplicationSpec.
| Property | Description | Type |
|---|---|---|
| configmaps | ConfigMaps specifies any config maps that should be created by the operator. | ApplicationOperatorConfigMaps Optional |
| creationMode | Specifies how ASO will try to create the resource. Specify “AlwaysCreate” to always create a new application when first reconciled. Or specify “AdoptOrCreate” to first try to adopt an existing application with the same display name. If multiple applications with the same display name are found, the resource ready condition will show an error. If not specified, defaults to “AdoptOrCreate”. | CreationMode Optional |
PublicClientApplication
PublicClientApplication specifies public client (desktop/mobile) configuration
Used by: ApplicationSpec, and ApplicationStatus.
| Property | Description | Type |
|---|---|---|
| redirectUris | Redirect URIs for public client applications. | string[] Optional |
SecurityGroupMemberReference
SecurityGroupMemberReference is a reference to a directory object (user, service principal, or group) by its Entra Object ID.
Used by: SecurityGroupSpec, and SecurityGroupSpec.
| Property | Description | Type |
|---|---|---|
| objectID | The Entra Object ID (GUID) of the directory object. | string Optional |
| objectIDFromConfig | Reference to a configmap value containing the Entra Object ID. | genruntime.ConfigMapReference Optional |
SecurityGroupMembershipType
Used by: SecurityGroupSpec.
SecurityGroupOperatorSpec
Used by: SecurityGroupSpec.
| Property | Description | Type |
|---|---|---|
| configmaps | ConfigMaps specifies any config maps that should be created by the operator. | SecurityGroupOperatorConfigMaps Optional |
| creationMode | Specifies how ASO will try to create the resource. Specify “AlwaysCreate” to always create a new security group when first reconciled. Or specify “AdoptOrCreate” to first try to adopt an existing security group with the same display name. If multiple security groups with the same display name are found, the resource condition will show an error. If not specified, defaults to “AdoptOrCreate”. | CreationMode Optional |
SignInAudience
Used by: ApplicationSpec, and ApplicationStatus.
SpaApplication
SpaApplication specifies single-page application configuration
Used by: ApplicationSpec, and ApplicationStatus.
| Property | Description | Type |
|---|---|---|
| redirectUris | Redirect URIs for single-page applications. | string[] Optional |
WebApplication
WebApplication specifies web application configuration
Used by: ApplicationSpec, and ApplicationStatus.
| Property | Description | Type |
|---|---|---|
| implicitGrantSettings | Settings for implicit grant flow. | ImplicitGrantSettings Optional |
| redirectUris | Redirect URIs for web applications. | string[] Optional |
ApplicationOperatorConfigMaps
Used by: ApplicationOperatorSpec.
| Property | Description | Type |
|---|---|---|
| appId | The application (client) ID of the application. | genruntime.ConfigMapDestination Optional |
| entraID | The Entra ID (object ID) of the application. | genruntime.ConfigMapDestination Optional |
CreationMode
CreationMode specifies how ASO will try to create the Entra resource.
Used by: ApplicationOperatorSpec, and SecurityGroupOperatorSpec.
ImplicitGrantSettings
ImplicitGrantSettings specifies implicit grant flow settings
Used by: WebApplication.
| Property | Description | Type |
|---|---|---|
| enableAccessTokenIssuance | Whether to enable access token issuance in the implicit flow. | bool Optional |
| enableIdTokenIssuance | Whether to enable ID token issuance in the implicit flow. | bool Optional |
SecurityGroupOperatorConfigMaps
Used by: SecurityGroupOperatorSpec.
| Property | Description | Type |
|---|---|---|
| entraID | The Entra ID of the group. | genruntime.ConfigMapDestination Optional |