Skip to content

hide-application-from-user-portal.md

Latest commit

 

History

History
127 lines (88 loc) · 5.75 KB

hide-application-from-user-portal.md

File metadata and controls

127 lines (88 loc) · 5.75 KB
title Hide an enterprise application
description How to hide an Enterprise application from user's experience in Microsoft Entra ID access portals or Microsoft 365 launchers.
ms.topic how-to
ms.date 03/04/2025
ms.reviewer ergreenl, lenalepa
ms.collection M365-identity-device-management
zone_pivot_groups enterprise-apps-all
ms.custom enterprise-apps, no-azure-ad-ps-ref, sfi-ga-blocked

Hide an enterprise application

Learn how to hide enterprise applications in Microsoft Entra ID. When an application is hidden, users still have permissions to the application.

Prerequisites

To hide an application from the My Apps portal and Microsoft 365 launcher, you need:

  • A Microsoft Entra account with an active subscription. Create an account for free.
  • One of the following roles:
    • Cloud Application Administrator
    • Application Administrator.
    • Global Administrator is required to hide all Microsoft 365 applications.

Hide an application from the end user

:::zone pivot="portal"

Use the following steps to hide an application from My Apps portal and Microsoft 365 application launcher.

  1. Sign in to the Microsoft Entra admin center as at least a Cloud Application Administrator.
  2. Browse to Entra ID > Enterprise apps > All applications.
  3. Search for the application you want to hide, and select the application.
  4. In the left navigation pane, select Properties.
  5. Select No for the Visible to users? question.
  6. Select Save.

:::zone-end

Note

These instructions apply only to non-first-party Microsoft Enterprise Applications. To learn more about first-party Microsoft applications see First-party Microsoft applications in sign-in reports. Administrators also need to keep in mind that hiding the application from the users doesn't prevent them from signing into these applications via methods other than the My Apps portal, such as shared links or service dependencies.

:::zone pivot="entra-powershell"

To hide an application from the My Apps portal, using Microsoft Entra PowerShell, you need to connect to Microsoft Entra PowerShell and sign in as at least a Cloud Application Administrator. You can manually add the HideApp tag to the service principal for the application. Run the following Microsoft Entra PowerShell commands to set the application's Visible to Users? property to No.

Connect-Entra -scopes "Application.ReadWrite.All"

$objectId = "<objectId>"
$servicePrincipal = Get-EntraServicePrincipal -ObjectId $objectId
$tags = $servicePrincipal.tags
$tags += "HideApp"
Set-EntraServicePrincipal -ObjectId $objectId -Tags $tags

:::zone-end

:::zone pivot="ms-powershell"

To hide an application from the My Apps portal, using Microsoft Graph PowerShell, you need to connect to Microsoft Graph PowerShell and sign in as at least a Cloud Application Administrator. You can manually add the HideApp tag to the service principal for the application. Run the following Microsoft Graph PowerShell commands to set the application's Visible to Users? property to No.

Connect-MgGraph "Application.ReadWrite.All"
$tags = $servicePrincipal.tags
$tags += "HideApp"
Update-MgServicePrincipal -ServicePrincipalID  $objectId -Tags $tags

:::zone-end

:::zone pivot="ms-graph"

To hide an enterprise application using Graph Explorer, you need to sign in as at least a Cloud Application Administrator.

Ensure you consent to the Application.ReadWrite.All permission before running the queries.

Run the following queries.

  1. Get the application you want to hide.

    GET https://graph.microsoft.com/v1.0/servicePrincipals/00001111-aaaa-2222-bbbb-3333cccc4444

  2. Update the application to hide it from users.

    PATCH https://graph.microsoft.com/v1.0/servicePrincipals/00001111-aaaa-2222-bbbb-3333cccc4444/

    Supply the following request body.

    {
    "tags": [
    "HideApp"
    ]
}

    [!WARNING] If the application has other tags, you must include them in the request body. Otherwise, the query will overwrite them.

:::zone-end

:::zone pivot="portal"

Hide Microsoft 365 applications from the My Apps portal

Use the following steps to hide all Microsoft 365 applications from the My Apps portal. The applications are still visible in the Office 365 portal.

[!INCLUDE least-privilege-note]

  1. Sign in to the Microsoft Entra admin center as a Global Administrator.
  2. Browse to Entra ID > Enterprise apps.
  3. Select App launchers under Manage menu items.
  4. Select Settings.
  5. Enable the option of Users can only see Microsoft 365 apps in the Microsoft 365 portal.
  6. Select Save.

:::zone-end

Related content