Namespace: microsoft.graph
Create an identity provider object that is of the type specified in the request body.
Among the types of providers derived from identityProviderBase, you can currently create a socialIdentityProvider resource in Microsoft Entra ID. In Azure AD B2C, this operation can currently create a socialIdentityProvider, or an appleManagedIdentityProvider resource.
This API is available in the following national cloud deployments.
| Global service |
US Government L4 |
US Government L5 (DOD) |
China operated by 21Vianet |
| ✅ |
❌ |
❌ |
✅ |
Permissions
Choose the permission or permissions marked as least privileged for this API. Use a higher privileged permission or permissions only if your app requires it. For details about delegated and application permissions, see Permission types. To learn more about these permissions, see the permissions reference.
| Permission type |
Least privileged permissions |
Higher privileged permissions |
| Delegated (work or school account) |
IdentityProvider.ReadWrite.All |
Not available. |
| Delegated (personal Microsoft account) |
Not supported. |
Not supported. |
| Application |
IdentityProvider.ReadWrite.All |
Not available. |
Important
In delegated scenarios with work or school accounts, the signed-in user must be assigned a supported Microsoft Entra role or a custom role with a supported role permission. External Identity Provider Administrator is the least privileged role supported for this operation.
HTTP request
POST /identity/identityProviders
Request body
In the request body, provide a JSON representation of socialIdentityProvider object in Microsoft Entra ID.
In Azure AD B2C provide a JSON representation of socialIdentityProvider, or an appleManagedIdentityProvider object.
socialIdentityProvider object
| Property |
Type |
Description |
| clientId |
String |
The client identifier for the application obtained when registering the application with the identity provider. |
| clientSecret |
String |
The client secret for the application that is obtained when the application is registered with the identity provider. This is write-only. A read operation returns ****. |
| displayName |
String |
The display name of the identity provider. |
| identityProviderType |
String |
For a B2B scenario, possible values: Google, Facebook. For a B2C scenario, possible values: Microsoft, Google, Amazon, LinkedIn, Facebook, GitHub, Twitter, Weibo, QQ, WeChat. |
| scope |
String |
Scope defines the information and permissions you are looking to gather from your custom identity provider. |
appleIdentityProvider object
| Property |
Type |
Description |
| displayName |
String |
The display name of the identity provider. |
| developerId |
String |
The Apple developer identifier. |
| serviceId |
String |
The Apple service identifier. |
| keyId |
String |
The Apple key identifier. |
| certificateData |
String |
The certificate data which is a long string of text from the certificate, can be null. |
Response
If successful, this method returns a 201 Created response code and a JSON representation of a socialIdentityProvider object in the response body for a Microsoft Entra tenant.
For an Azure AD B2C tenant, this method returns a 201 Created response code and a JSON representation of a socialIdentityProvider, or an appleManagedIdentityProvider object in the response body.
If unsuccessful, a 4xx error will be returned with specific details.
Examples
Example 1: Create a specific social identity provider (Microsoft Entra ID and Azure AD B2C)
Request
The following example shows a request.
POST https://graph.microsoft.com/v1.0/identity/identityProviders
Content-type: application/json
{
"@odata.type": "microsoft.graph.socialIdentityProvider",
"displayName": "Login with Amazon",
"identityProviderType": "Amazon",
"clientId": "56433757-cadd-4135-8431-2c9e3fd68ae8",
"clientSecret": "000000000000"
}
// Code snippets are only available for the latest version. Current version is 5.x
// Dependencies
using Microsoft.Graph.Models;
var requestBody = new SocialIdentityProvider
{
OdataType = "microsoft.graph.socialIdentityProvider",
DisplayName = "Login with Amazon",
IdentityProviderType = "Amazon",
ClientId = "56433757-cadd-4135-8431-2c9e3fd68ae8",
ClientSecret = "000000000000",
};
// To initialize your graphClient, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=csharp
var result = await graphClient.Identity.IdentityProviders.PostAsync(requestBody);
For details about how to add the SDK to your project and create an authProvider instance, see the SDK documentation.
mgc identity identity-providers create --body '{\
"@odata.type": "microsoft.graph.socialIdentityProvider",\
"displayName": "Login with Amazon",\
"identityProviderType": "Amazon",\
"clientId": "56433757-cadd-4135-8431-2c9e3fd68ae8",\
"clientSecret": "000000000000"\
}\
\
'
For details about how to add the SDK to your project and create an authProvider instance, see the SDK documentation.
// Code snippets are only available for the latest major version. Current major version is $v1.*
// Dependencies
import (
"context"
msgraphsdk "github.com/microsoftgraph/msgraph-sdk-go"
graphmodels "github.com/microsoftgraph/msgraph-sdk-go/models"
//other-imports
)
requestBody := graphmodels.NewIdentityProviderBase()
displayName := "Login with Amazon"
requestBody.SetDisplayName(&displayName)
identityProviderType := "Amazon"
requestBody.SetIdentityProviderType(&identityProviderType)
clientId := "56433757-cadd-4135-8431-2c9e3fd68ae8"
requestBody.SetClientId(&clientId)
clientSecret := "000000000000"
requestBody.SetClientSecret(&clientSecret)
// To initialize your graphClient, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=go
identityProviders, err := graphClient.Identity().IdentityProviders().Post(context.Background(), requestBody, nil)
For details about how to add the SDK to your project and create an authProvider instance, see the SDK documentation.
// Code snippets are only available for the latest version. Current version is 6.x
GraphServiceClient graphClient = new GraphServiceClient(requestAdapter);
SocialIdentityProvider identityProviderBase = new SocialIdentityProvider();
identityProviderBase.setOdataType("microsoft.graph.socialIdentityProvider");
identityProviderBase.setDisplayName("Login with Amazon");
identityProviderBase.setIdentityProviderType("Amazon");
identityProviderBase.setClientId("56433757-cadd-4135-8431-2c9e3fd68ae8");
identityProviderBase.setClientSecret("000000000000");
IdentityProviderBase result = graphClient.identity().identityProviders().post(identityProviderBase);
For details about how to add the SDK to your project and create an authProvider instance, see the SDK documentation.
const options = {
authProvider,
};
const client = Client.init(options);
const identityProviderBase = {
'@odata.type': 'microsoft.graph.socialIdentityProvider',
displayName: 'Login with Amazon',
identityProviderType: 'Amazon',
clientId: '56433757-cadd-4135-8431-2c9e3fd68ae8',
clientSecret: '000000000000'
};
await client.api('/identity/identityProviders')
.post(identityProviderBase);
For details about how to add the SDK to your project and create an authProvider instance, see the SDK documentation.
<?php
use Microsoft\Graph\GraphServiceClient;
use Microsoft\Graph\Generated\Models\SocialIdentityProvider;
$graphServiceClient = new GraphServiceClient($tokenRequestContext, $scopes);
$requestBody = new SocialIdentityProvider();
$requestBody->setOdataType('microsoft.graph.socialIdentityProvider');
$requestBody->setDisplayName('Login with Amazon');
$requestBody->setIdentityProviderType('Amazon');
$requestBody->setClientId('56433757-cadd-4135-8431-2c9e3fd68ae8');
$requestBody->setClientSecret('000000000000');
$result = $graphServiceClient->identity()->identityProviders()->post($requestBody)->wait();
For details about how to add the SDK to your project and create an authProvider instance, see the SDK documentation.
Import-Module Microsoft.Graph.Identity.SignIns
$params = @{
"@odata.type" = "microsoft.graph.socialIdentityProvider"
displayName = "Login with Amazon"
identityProviderType = "Amazon"
clientId = "56433757-cadd-4135-8431-2c9e3fd68ae8"
clientSecret = "000000000000"
}
New-MgIdentityProvider -BodyParameter $params
For details about how to add the SDK to your project and create an authProvider instance, see the SDK documentation.
# Code snippets are only available for the latest version. Current version is 1.x
from msgraph import GraphServiceClient
from msgraph.generated.models.social_identity_provider import SocialIdentityProvider
# To initialize your graph_client, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=python
request_body = SocialIdentityProvider(
odata_type = "microsoft.graph.socialIdentityProvider",
display_name = "Login with Amazon",
identity_provider_type = "Amazon",
client_id = "56433757-cadd-4135-8431-2c9e3fd68ae8",
client_secret = "000000000000",
)
result = await graph_client.identity.identity_providers.post(request_body)
For details about how to add the SDK to your project and create an authProvider instance, see the SDK documentation.
Response
The following example shows the response.
Note: The response object shown here might be shortened for readability.
HTTP/1.1 201 Created
Content-type: application/json
{
"@odata.type": "microsoft.graph.socialIdentityProvider",
"id": "Amazon-OAUTH",
"displayName": "Login with Amazon",
"identityProviderType": "Amazon",
"clientId": "56433757-cadd-4135-8431-2c9e3fd68ae8",
"clientSecret": "000000000000"
}
Example 2: Create Apple identity provider (only for Azure AD B2C)
Request
The following example shows a request.
POST https://graph.microsoft.com/v1.0/identity/identityProviders
Content-type: application/json
{
"@odata.type": "microsoft.graph.appleManagedIdentityProvider",
"displayName": "Sign in with Apple",
"developerId": "UBF8T346G9",
"serviceId": "com.microsoft.rts.b2c.test.client",
"keyId": "99P6D879C4",
"certificateData": "******"
}
// Code snippets are only available for the latest version. Current version is 5.x
// Dependencies
using Microsoft.Graph.Models;
var requestBody = new AppleManagedIdentityProvider
{
OdataType = "microsoft.graph.appleManagedIdentityProvider",
DisplayName = "Sign in with Apple",
DeveloperId = "UBF8T346G9",
ServiceId = "com.microsoft.rts.b2c.test.client",
KeyId = "99P6D879C4",
CertificateData = "******",
};
// To initialize your graphClient, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=csharp
var result = await graphClient.Identity.IdentityProviders.PostAsync(requestBody);
For details about how to add the SDK to your project and create an authProvider instance, see the SDK documentation.
mgc identity identity-providers create --body '{\
"@odata.type": "microsoft.graph.appleManagedIdentityProvider",\
"displayName": "Sign in with Apple",\
"developerId": "UBF8T346G9",\
"serviceId": "com.microsoft.rts.b2c.test.client",\
"keyId": "99P6D879C4",\
"certificateData": "******"\
}\
'
For details about how to add the SDK to your project and create an authProvider instance, see the SDK documentation.
// Code snippets are only available for the latest major version. Current major version is $v1.*
// Dependencies
import (
"context"
msgraphsdk "github.com/microsoftgraph/msgraph-sdk-go"
graphmodels "github.com/microsoftgraph/msgraph-sdk-go/models"
//other-imports
)
requestBody := graphmodels.NewIdentityProviderBase()
displayName := "Sign in with Apple"
requestBody.SetDisplayName(&displayName)
developerId := "UBF8T346G9"
requestBody.SetDeveloperId(&developerId)
serviceId := "com.microsoft.rts.b2c.test.client"
requestBody.SetServiceId(&serviceId)
keyId := "99P6D879C4"
requestBody.SetKeyId(&keyId)
certificateData := "******"
requestBody.SetCertificateData(&certificateData)
// To initialize your graphClient, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=go
identityProviders, err := graphClient.Identity().IdentityProviders().Post(context.Background(), requestBody, nil)
For details about how to add the SDK to your project and create an authProvider instance, see the SDK documentation.
// Code snippets are only available for the latest version. Current version is 6.x
GraphServiceClient graphClient = new GraphServiceClient(requestAdapter);
AppleManagedIdentityProvider identityProviderBase = new AppleManagedIdentityProvider();
identityProviderBase.setOdataType("microsoft.graph.appleManagedIdentityProvider");
identityProviderBase.setDisplayName("Sign in with Apple");
identityProviderBase.setDeveloperId("UBF8T346G9");
identityProviderBase.setServiceId("com.microsoft.rts.b2c.test.client");
identityProviderBase.setKeyId("99P6D879C4");
identityProviderBase.setCertificateData("******");
IdentityProviderBase result = graphClient.identity().identityProviders().post(identityProviderBase);
For details about how to add the SDK to your project and create an authProvider instance, see the SDK documentation.
const options = {
authProvider,
};
const client = Client.init(options);
const identityProviderBase = {
'@odata.type': 'microsoft.graph.appleManagedIdentityProvider',
displayName: 'Sign in with Apple',
developerId: 'UBF8T346G9',
serviceId: 'com.microsoft.rts.b2c.test.client',
keyId: '99P6D879C4',
certificateData: '******'
};
await client.api('/identity/identityProviders')
.post(identityProviderBase);
For details about how to add the SDK to your project and create an authProvider instance, see the SDK documentation.
<?php
use Microsoft\Graph\GraphServiceClient;
use Microsoft\Graph\Generated\Models\AppleManagedIdentityProvider;
$graphServiceClient = new GraphServiceClient($tokenRequestContext, $scopes);
$requestBody = new AppleManagedIdentityProvider();
$requestBody->setOdataType('microsoft.graph.appleManagedIdentityProvider');
$requestBody->setDisplayName('Sign in with Apple');
$requestBody->setDeveloperId('UBF8T346G9');
$requestBody->setServiceId('com.microsoft.rts.b2c.test.client');
$requestBody->setKeyId('99P6D879C4');
$requestBody->setCertificateData('******');
$result = $graphServiceClient->identity()->identityProviders()->post($requestBody)->wait();
For details about how to add the SDK to your project and create an authProvider instance, see the SDK documentation.
Import-Module Microsoft.Graph.Identity.SignIns
$params = @{
"@odata.type" = "microsoft.graph.appleManagedIdentityProvider"
displayName = "Sign in with Apple"
developerId = "UBF8T346G9"
serviceId = "com.microsoft.rts.b2c.test.client"
keyId = "99P6D879C4"
certificateData = "******"
}
New-MgIdentityProvider -BodyParameter $params
For details about how to add the SDK to your project and create an authProvider instance, see the SDK documentation.
# Code snippets are only available for the latest version. Current version is 1.x
from msgraph import GraphServiceClient
from msgraph.generated.models.apple_managed_identity_provider import AppleManagedIdentityProvider
# To initialize your graph_client, see https://learn.microsoft.com/en-us/graph/sdks/create-client?from=snippets&tabs=python
request_body = AppleManagedIdentityProvider(
odata_type = "microsoft.graph.appleManagedIdentityProvider",
display_name = "Sign in with Apple",
developer_id = "UBF8T346G9",
service_id = "com.microsoft.rts.b2c.test.client",
key_id = "99P6D879C4",
certificate_data = "******",
)
result = await graph_client.identity.identity_providers.post(request_body)
For details about how to add the SDK to your project and create an authProvider instance, see the SDK documentation.
Response
The following example shows the response.
Note: The response object shown here might be shortened for readability.
HTTP/1.1 201 Created
Content-type: application/json
{
"@odata.type": "microsoft.graph.appleManagedIdentityProvider",
"id": "Apple-Managed-OIDC",
"displayName": "Sign in with Apple",
"developerId": "UBF8T346G9",
"serviceId": "com.microsoft.rts.b2c.test.client",
"keyId": "99P6D879C4",
"certificateData": "******"
}