There is a command group 'az_ad_app'. This group of commands could 'manage microsoft entra applications'. The group of commands has global parameter '--debug' which means 'Increase logging verbosity to show all debug logs.'. The group of commands has global parameter '--help -h' which means 'Show this help message and exit.'. The group of commands has global parameter '--only-show-errors' which means 'Only show errors, suppressing warnings.'. The group of commands has global parameter '--output -o' which means 'Output format.'. The group of commands has global parameter '--query' which means 'JMESPath query string. See <a href="http://jmespath.org/">http://jmespath.org/</a> for more information and examples.'. The group of commands has global parameter '--subscription' which means 'Name or ID of subscription. You can configure the default subscription using `az account set -s NAME_OR_ID`.'. The group of commands has global parameter '--verbose' which means 'Increase logging verbosity. Use --debug for full debug logs.'. This group contains a child command 'az_ad_app_update'.The syntax is: az ad app update --id
                 [--add]
                 [--app-roles]
                 [--display-name]
                 [--enable-access-token-issuance {false, true}]
                 [--enable-id-token-issuance {false, true}]
                 [--end-date]
                 [--force-string]
                 [--identifier-uris]
                 [--is-fallback-public-client {false, true}]
                 [--key-display-name]
                 [--key-type {asymmetricx509cert, password, symmetric}]
                 [--key-usage {sign, verify}]
                 [--key-value]
                 [--optional-claims]
                 [--public-client-redirect-uris]
                 [--remove]
                 [--required-resource-accesses]
                 [--set]
                 [--sign-in-audience {azureadmultipleorgs, azureadmyorg, azureadandpersonalmicrosoftaccount, personalmicrosoftaccount}]
                 [--start-date]
                 [--web-home-page-url]
                 [--web-redirect-uris]. The 1th example of the child command would be to use it to 'update an application with microsoft graph delegated permission user read', the syntax is: az ad app update --id e042ec79-34cd-498f-9d9f-123456781234 --required-resource-accesses @manifest.json
("manifest.json" contains the following content)
[{
    "resourceAppId": "00000003-0000-0000-c000-000000000000",
    "resourceAccess": [
        {
            "id": "e1fe6dd8-ba31-4d61-89e7-88639da4683d",
            "type": "Scope"
        }
   ]
}]. The 2th example of the child command would be to use it to 'declare an application role', the syntax is: az ad app update --id e042ec79-34cd-498f-9d9f-123456781234 --app-roles @manifest.json
("manifest.json" contains the following content)
[{
    "allowedMemberTypes": [
      "User"
    ],
    "description": "Approvers can mark documents as approved",
    "displayName": "Approver",
    "isEnabled": "true",
    "value": "approver"
}]. The 3th example of the child command would be to use it to 'update optional claims', the syntax is: az ad app update --id e042ec79-34cd-498f-9d9f-123456781234 --optional-claims @manifest.json
("manifest.json" contains the following content)
{
    "idToken": [
        {
            "name": "auth_time",
            "essential": false
        }
    ],
    "accessToken": [
        {
            "name": "ipaddr",
            "essential": false
        }
    ],
    "saml2Token": [
        {
            "name": "upn",
            "essential": false
        },
        {
            "name": "extension_ab603c56068041afb2f6832e2a17e237_skypeId",
            "source": "user",
            "essential": false
        }
    ]
}. The 4th example of the child command would be to use it to 'update an application s group membership claims to  all', the syntax is: az ad app update --id e042ec79-34cd-498f-9d9f-123456781234 --set groupMembershipClaims=All. The parameter '--id' is required. It is used to identifier uri, application id, or object id.. The parameter '--add' is optional. add an object to a list of objects by specifying a path and key value pairs.  example: `--add property.listproperty <key=value, string or json string>`.. The parameter '--app-roles' is optional. the collection of roles assigned to the application. with app role assignments, these roles can be assigned to users, groups, or service principals associated with other applications. should be json file path or in-line json string. see examples for details.. The parameter '--display-name' is optional. the display name of the application.. The parameter '--enable-access-token-issuance' is optional. specifies whether this web application can request an access token using the oauth 2.0 implicit flow.. The parameter '--enable-id-token-issuance' is optional. specifies whether this web application can request an id token using the oauth 2.0 implicit flow.. The parameter '--end-date' is optional. date or datetime after which credentials expire (e.g. '2017-12-31t11:59:59+00:00' or '2017-12-31'). default value is one year after current time.. The parameter '--force-string' is optional. when using 'set' or 'add', preserve string literals instead of attempting to convert to json.. The parameter '--identifier-uris' is optional. space-separated values. also known as app id uri, this value is set when an application is used as a resource app. the identifieruris acts as the prefix for the scopes you'll reference in your api's code, and it must be globally unique. you can use the default value provided, which is in the form api://<application-client-id>, or specify a more readable uri like https://contoso.com/api.. The parameter '--is-fallback-public-client' is optional. specifies the fallback application type as public client, such as an installed application running on a mobile device. the default value is false which means the fallback application type is confidential client such as a web app.. The parameter '--key-display-name' is optional. friendly name for the key.. The parameter '--key-type' is optional. the type of the key credentials associated with the application.. The parameter '--key-usage' is optional. the usage of the key credentials associated with the application.. The parameter '--key-value' is optional. the value for the key credentials associated with the application.. The parameter '--optional-claims' is optional. application developers can configure optional claims in their microsoft entra applications to specify the claims that are sent to their application by the microsoft security token service. for more information, see https://docs.microsoft.com/azure/active-directory/develop/active-directory-optional-claims. should be json file path or in-line json string. see examples for details.. The parameter '--public-client-redirect-uris' is optional. space-separated values. specifies the urls where user tokens are sent for sign-in, or the redirect uris where oauth 2.0 authorization codes and access tokens are sent.. The parameter '--remove' is optional. remove a property or an element from a list.  example: `--remove property.list <indextoremove>` or `--remove propertytoremove`.. The parameter '--required-resource-accesses' is optional. specifies the resources that the application needs to access. this property also specifies the set of delegated permissions and application roles that it needs for each of those resources. this configuration of access to the required resources drives the consent experience. should be json file path or in-line json string. see examples for details.. The parameter '--set' is optional. update an object by specifying a property path and value to set.  example: `--set property1.property2=<value>`.. The parameter '--sign-in-audience' is optional. specifies the microsoft accounts that are supported for the current application.. The parameter '--start-date' is optional. date or datetime at which credentials become valid (e.g. '2017-01-01t01:00:00+00:00' or '2017-01-01'). default value is current time.. The parameter '--web-home-page-url' is optional. home page or landing page of the application.. The parameter '--web-redirect-uris' is optional. space-separated values. specifies the urls where user tokens are sent for sign-in, or the redirect uris where oauth 2.0 authorization codes and access tokens are sent.. 