Microsoft Graph - Find service principal from app registration

I am logging onto an app registration using client credential flow:

var certificateBytes = Convert.FromBase64String(certificate);
X509Certificate2 adCertificate = new X509Certificate2(certificateBytes, certificatePassword);
IConfidentialClientApplication confidentialClientApp = ConfidentialClientApplicationBuilder.Create(_clientId)
    .WithAuthority(AzureCloudInstance.AzurePublic, _tenantId)
    .WithCertificate(adCertificate)
    .Build();
var storageProperties = new StorageCreationPropertiesBuilder("TokenCache.plaintext", tokenCacheDirectory)
    .WithUnprotectedFile()
    .Build();
var cacheHelper = MsalCacheHelper.CreateAsync(storageProperties).Result;
cacheHelper.RegisterCache(_confidentialClientApp.UserTokenCache);

var silentToken = await _confidentialClientApp.AcquireTokenForClient(new string[] { "https://graph.microsoft.com/.default" }).ExecuteAsync();
var graphServiceClient = new Microsoft.Graph.GraphServiceClient(new Microsoft.Graph.DelegateAuthenticationProvider(async (requestMessage) =>
{
    var authResult = await _confidentialClientApp.AcquireTokenForClient(new string[] { "https://graph.microsoft.com/.default" }).ExecuteAsync();
    requestMessage.Headers.Authorization = new System.Net.Http.Headers.AuthenticationHeaderValue("Bearer", authResult.AccessToken);
})
);

Then, having logged onto the app registration using the certificate I need to find out object id of the application and the id of the service principal I have just logged on as. Something like:

var applicationId = await graphServiceClient.GetMyAppRegistrationId();
var servicePrincipalId = await graphServiceClient.GetServicePrincipalIdOfAppRegistration();

GraphServiceClient has no method to get application id or service principal id directly.

If you have a token you can use some token decoder to get oid and appId from metadata.

iod claim should represent service principal id

appId claim represents application id

Example for C#

NuGet package System.IdentityModel.Tokens.Jwt has the class JwtSecurityTokenHandler which can be used for decoding access token.

var token = "eyJ0eXAiOiJK...";
var handler = new JwtSecurityTokenHandler();
var jwtSecurityToken = handler.ReadJwtToken(token);

var oidClaim = jwtSecurityToken.Claims.FirstOrDefault(x => x.Type == "oid");
string servicePrincipalId = null;
if (oidClaim != null)
{
    servicePrincipalId = oidClaim.Value;
}
else
{
    servicePrincipalId = jwtSecurityToken.Payload["oid"] as string;
}

var appIdClaim = jwtSecurityToken.Claims.FirstOrDefault(x => x.Type == "appid");
string appId = null;
if (appIdClaim != null)
{
    appId = appIdClaim.Value;
}
else
{
    appId = jwtSecurityToken.Payload["appid"] as string;
}

If you want to get application resource then you can use filter

GET https://graph.microsoft.com/v1.0/applications?$filter=appId eq '{app_id}' 

C#

await graphServiceClient.Applications
    .Request()
    .Filter("appId eq '{app_id}'")
    .GetAsync();

The code above requires permission Application.Read.All.