🪲 set-entraserviceprincipal does not allow to specify the loginurl when preferredsinglesignonMode is NotSupported

Thanks for reporting the bug. Please ensure you've gone through the following checklist before opening an issue:

• Make sure you can reproduce this issue using the latest released version of Microsoft.Entra or Microsoft.Entra.Beta.
• Please search the existing issues to see if there has been a similar issue filed.

Describe the bug

In Entra, an Enterprise app can have a single sign on mode of "linked", and once set, you can specify a url, which acts as a bookmark. In the Entra.applications powershell module, this type of app entry seems to be denoted as "PreferredSingleSignOnMode = notsupported" in the service principal, however there's no parameters/no way to specify the loginURL, only the logouturl, which is odd.

You can't completely add a linked Entra app without being able to set the login url. Also, ideally, the "preferredsinglesignonmode" for these types of apps should be called "linked" to have parity with the web portal.

If I use get-entraapplication to look at an existing app set up in linked mode, the loginurl attribute shows the login URL specified under the single sign on tab of the portal.

To Reproduce

Steps to reproduce the behavior:

1. Create a new app using new-entraapplication -displayname 'ABC App'
2. Set the App to Linked by using set-entraserviceprincipal -serviceprincipalid -PreferredSingleSignOnMode 'notsupported'
3. Try to set the login url, however there's no parameter or way to do so. There are parameters like "-logoutURL" and "-homepage", but none of them worked (produced errors).

Expected behavior

There should be a -loginurl parameter on set-entraserviceprincipal

Debug Output

This is trying to use the -homepage parameter which copilot suggested is the right parameter to use:

PS C:\Windows\System32> Set-EntraServicePrincipal -ServicePrincipalId $flsp.id -homepage 'https://www.123.com' -debug
DEBUG: ============================ TRANSFORMATIONS ============================
DEBUG: Body : System.Collections.Hashtable
DEBUG: Method : PATCH
DEBUG: Uri : /v1.0/servicePrincipals/fc6face4-7a57-430d-b145-f3c1e92326e3
DEBUG: =========================================================================

DEBUG: PATCH /v1.0/servicePrincipals/fc6face4-7a57-430d-b145-f3c1e92326e3 HTTP/1.1
HTTP: graph.microsoft.com
User-Agent: PowerShell/7.5.4 EntraPowershell/1.2.0 Set-EntraServicePrincipal
Content-Length: 34
Content-Type: application/json

{"homePage":"https://www.123.com"}
DEBUG: PATCH https://graph.microsoft.com/v1.0/servicePrincipals/fc6face4-7a57-430d-b145-f3c1e92326e3
HTTP/2.0 400 Bad Request
Date: Tue, 03 Feb 2026 21:06:51 GMT
Cache-Control: no-cache
Vary: Accept-Encoding
Strict-Transport-Security: max-age=31536000
request-id: 275a4f22-9f97-4159-8807-3ba78cd5e881
client-request-id: e642a352-b377-485e-8dfa-04404429c1a8
x-ms-ags-diagnostic: {"ServerInfo":{"DataCenter":"East US 2","Slice":"E","Ring":"5","ScaleUnit":"005","RoleInstance":"BN2PEPF00004405"}}
x-ms-resource-unit: 1
X-Cache: CONFIG_NOCACHE
Content-Type: application/json

{"error":{"code":"Request_BadRequest","message":"Property homepage on the service principal does not match the application object.","innerError":{"date":"2026-02-03T21:06:51","request-id":"275a4f22-9f97-4159-8807-3ba78cd5e881","client-request-id":"e642a352-b377-485e-8dfa-04404429c1a8"}}}
Invoke-MgGraphRequest: PATCH https://graph.microsoft.com/v1.0/servicePrincipals/fc6face4-7a57-430d-b145-f3c1e92326e3 HTTP/2.0 400 Bad Request
Date: Tue, 03 Feb 2026 21:06:51 GMT Cache-Control: no-cache Vary: Accept-Encoding Strict-Transport-Security:
max-age=31536000 request-id: 275a4f22-9f97-4159-8807-3ba78cd5e881 client-request-id:
e642a352-b377-485e-8dfa-04404429c1a8 x-ms-ags-diagnostic: {"ServerInfo":{"DataCenter":"East US
2","Slice":"E","Ring":"5","ScaleUnit":"005","RoleInstance":"BN2PEPF00004405"}} x-ms-resource-unit: 1 X-Cache:
CONFIG_NOCACHE Content-Type: application/json {"error":{"code":"Request_BadRequest","message":"Property homepage on
the service principal does not match the application
object.","innerError":{"date":"2026-02-03T21:06:51","request-id":"275a4f22-9f97-4159-8807-3ba78cd5e881","client-request-
id":"e642a352-b377-485e-8dfa-04404429c1a8"}}}

Debug Output

Module Version

1.2.0

Environment Data

Name Value

---

PSVersion 7.5.4
PSEdition Core
GitCommitId 7.5.4
OS Microsoft Windows 10.0.26100
Platform Win32NT
PSCompatibleVersions {1.0, 2.0, 3.0, 4.0…}
PSRemotingProtocolVersion 2.3
SerializationVersion 1.1.0.1
WSManStackVersion 3.0

Screenshots

Additional context

Start at the Set-EntraServicePrincipal entry point and inspect its service-principal parameter definitions and request construction. Reproduce the linked-mode scenario, then verify that a login URL can be supplied without using the homepage field and that the resulting Graph PATCH matches the requested value.