My demo app uses Azure AD B2C. Since it's a B2C, new users can create their own account. When a new user joins, I want:
to event grid to start a Logic app
the logic app will grab some of the data update the CosmosDb containers
send an email to the new user
deliver a message that any subscriber can read
I'm stuck in the beginning because I can't find anything that it's related to Azure Active Directory. I can't find a tutorial or any information related to tha.
My question is to know whether event grid can even be used to react to users being created in Azure AD?
Thanks for helping.
I don't think this trigger can implement your requirement. As we can see it requires us to choose Resource Type, Resource Name... But users do not belong to resources, resources refer to storage, VM, keyvault and so on.
So for your question about
whether event grid can even be used to react to users being created in Azure AD
I think it can't be used to react to users being created in Azure AD.
Related
TL;DR
How can I delegate my user permissions to a service principal in Azure Ad when the usual interactive way (e.g. web app with consent screen popup) is not feasible? This is because I cannot configure the MSI in the Azure Portal properly to work that way.
More detail
I want to grant an application permission to access the Graph API on behalf of a user. Usually, this is a well-documented scenario in which you create an app registration, acquire delegated user permissions by asking permission for the needed scopes, and then use these permissions in the app.
The app that needs Graph access is a background service that is to work on its own without user intervention/activity. For this use case, the common approach is to use application permissions. In my case this is not feasible, because application permissions require admin-consent and are all-or-nothing kind of permissions. There is no way this will be granted for me. Rightfully so, because its overkill.
But on the other hand that's really a pity. A pity, because I've found an example on how to assign Graph API application permissions directly to a Managed Service Identity rather than to a self-registered app. And my service (as an Azure Functions app) already has a MSI assigned to it. So this would be the perfect fit, b then again, there is no way I'll get those application permissions.
So what is the workaround? We have this one user principal which has all the required permissions we need for our background service. What I want to do is to delegate this user's permissions to the Function App/MSI. In order to do this, I used this SPA-template by the MSAL team to have something that will prompt me the permissions popup.
This however failed because the implicit oauth flow was not enabled. To remedy this, you usually need to update the app manifest in the portal. However, since this is a MANAGED service identity, and not a self-registered one, the MSI is not listed in the portal under app registrations. So I cannot set this property to true.
Doing the same via Azure CLI also failed because apparently the MSI is not identified as an app.
az ad app update --oauth2-allow-implicit-flow true --id <appId_of_MSI>
This yields the following error:
ResourceNotFoundError: Resource '<appId_of_MSI>' does not exist or one of its queried reference-property objects are not present.
It shows fine when doing this
az ad sp show --id <appId_of_MSI>
So in summary: I cannot complete the process of delegating that user's permissions interactively. Is there any other way? Maybe via CLI?
The fallback the solution is to create a separate unmanaged/self-registered app identity. But I want to really avoid this because then I would need to manage and rotate client (app) credentials again, which the MSI took care of for me.
Why o why can't I just assign fine-scoped application permissions 😒
Any help on this is greatly appreciated. Cheers.
In my experience Managed Identities don't support the scenario you are suggesting.
They do not have an app registration and in that way cannot authenticate users interactively.
I would go with your fallback solution; a normal app registration and use that to access Graph API on behalf of the user.
This is what we do in our projects at least.
App permissions -> Managed Identity if possible. Delegated permissions -> normal app registration + secret/certificate in Key Vault, retrieved with Managed Identity.
I am trying to set up an authenticated webhook call from an Azure Event Grid Domain subscription to a web app service in the same tenant. I am able to do everything up to a certain point which is that I am trying to tie the authentication to a specific app role in the subscribing app. Currently, the authentication works, but I cannot seem to figure out how to include a specific role in the token that gets sent to the subscribing endpoint. It may be that it's more of a generic question on setting up an enterprise app registration (which event grid uses) with a configurable role for app registrations. My issue is that I know how to do it when there's an app registration, but in this case I only have an enterprise app.
I have followed the documentation, and this article seems to try to do the same thing, but I don't want to do it in powershell as we have an Identity-responsible who is going to do the actual work as well as me wanting to understand what happens behind the scenes.
https://learn.microsoft.com/en-us/azure/event-grid/secure-webhook-delivery
Does anybody know how to set up the event grid webhook authentication so it includes a specific role (most probably an app role defined in the manifest of the subscribing app's app registration)?
You are following correct way of configuring event subscription.
The role which you wants to add in application can be done as below -
Azure Portal>>All Services>>Subscription>>Select Subscription>>IAM Role>>Add Role assignment>>1.Select the role which he need 2. Assign access to Azure AD user or Service Principal 3. Select the application >> Save.
or
If need to assign some customise role you can create the custom role as below -
https://learn.microsoft.com/bs-cyrl-ba/azure/role-based-access-control/custom-roles?toc=%2Fazure%2Fvirtual-network%2Ftoc.json
Azure Active Directory to secure the connection between your Event Subscription and your webhook endpoint.
https://github.com/MicrosoftDocs/azure-docs/blob/master/articles/event-grid/secure-webhook-delivery.md
I'm currently trying to configure Azure Ad for user provisioning in a Salesforce Sandbox. I'm using a personal dev org and a trial Azure account to make this work.
I've been able to map attributes and it works for most of them, except one. ManagerID.
I'm trying to replicate the Azure AD manager information into Salesforce's managerID field using an attribute reference. However it doesn't seem to work.
Has anyone here been completing this kind of setup previously and would be able to point me to the correct Attribute expression to be mapped/referenced on the Azure AD side?
The default mapping is from Salesforce->ManagerId to AAD->Manager, where AAD-> Manager is a reference to User.
The field in Salesforce used for matching is the FederationIdentifier, which corresponds to AAD-> User.userPrincipalName
The logic would be that if I'm doing a reference to the AAD User, I would expect AAD to fetch that manager's UPN in AAD and pass it back to the SCIM interface to be able to match it on the Salesforce side (since it's mapped to the FederationIdentifier).
I'm also trying to force the reference of "Manager" on the AAD side to pick the User.UserPrincipalName but it seems to always bring it back to User.
Anyhow, I'm a bit fishing here and wondering if there is someone with whom I can share the settings in such way that I can compare how it's been done in a successful implementation.
I'm building a service where each user has a calendar, I want to sync users 365 calendar events into their calendar, the tricky part seems to be, that this should be done repeatable by background job on the server, to keep them in sync.
I feel like I've read a bible of documentation from Microsoft, but still gotten nowhere. I eventually stumbled upon this article https://learn.microsoft.com/en-us/azure/active-directory/develop/active-directory-v2-protocols-oauth-client-creds which allows a server to query the graph api, on behalf of users. This is exactly what I want.
Having created a Azure account, and Active Directory service, I found that only users within the tenant can use this, which makes it rather useless, requiring to add users manually from azure panel.
AADSTS50020: User account 'm#****.com' from identity provider 'live.com' does not exist in tenant 'Default Directory' and cannot access the application 'c0193dea-5145-430a-9c90-325f1229a1fc' in that tenant. The account needs to be added as an external user in the tenant first. Sign out and sign in again with a different Azure Active Directory user account.
So I'm back at square one, how can I achieve what I described?
I'm not looking for a code implementation, merely a description of how to navigate the monstrosity of Microsoft.
Thank you
Update: Accordingly to Marc link. I tried to flick the multi tenant option, and change the endpoint to use common instead of tenant id. Sadly i'm still getting the same error.
You cannot sign-in to AAD with a non-AAD account using the v1 Endpoint. If you want to use a consumer Microsoft Account (#outlook.com, #hotmail.com, #live.com) then you need to use the Converged Auth model provided by the v2 Endpoint.
I have a walkthrough for the v2 Endpoint that you might find helpful: Microsoft v2 Endpoint Primer. It is similar to the v1 Endpoint but you'll need to register via https://apps.dev.microsoft.com rather than the Azure Portal. Also, v2 apps use Scopes instead of Resources and are multi-tenant out of the box.
This is a broad a question for Stack Overflow. That said, you're incorrect about Azure AD. It is absolutely not limited to a single-tenant. You do however need to register it as a multi-tenant application:
How to sign in any Azure Active Directory (AD) user using the multi-tenant application pattern
I'm using passport-azure-ad library to authenticate people into our app. We are using v2.0 endpoint. I have created multiple applications in Microsoft app registration portal. And have a lot of redirect url's because we have a lot of different environment apps. It was registered under my Microsoft employee account. Now I need to transfer ownership to another developer. How can I do it? Do I need to recreate all this apps in another account? I assume that this will create a new app id's and thus will ask for permissions for all users again. Is there a way to transfer ownership and not recreate all apps again?
Assuming you created your applications using your Azure Active Directory account (like your Microsoft Employee Account) you will have access to an "Owners" field where you can add new owners to the application which are in the same tenant as you.
If you are trying to transfer an application to a user from a different Tenant or using an MSA account, that is not currently supported, but something that is being considered for the future.
If you need to create a new application id, you will not be able to transfer the consent that you had from the first app over to this second one. That is just not really possible nor something we would look to support due to the security implications.