Microsoft Entra Application and Service Principal Discovery

From an Internet-connected host, use an explicitly authorized delegated Microsoft Graph session to discover application registrations and service principals in the in-scope Microsoft Entra tenant with read-only Application.Read.All. These commands call Microsoft's public Graph service; tenant consent, permissions, and access policy still apply, and no internal network access or execution foothold is required when tenant policy permits the connection. This is a focused MITRE ATT&CK T1526 Cloud Service Discovery procedure. Each listing command is capped at 25 objects per invocation; user-account and cloud-group discovery are separate behaviors.