I want to make a desktop application that has [Supported account types] registered in [Accounts in any organizational directory] for application registration available to users other than my own domain.
Where can I find instructions on how to publish the registered app to the outside world?
Per my understanding, you are looking for how multi-tenant app works in other tenants.
You can do the admin consent for other tenants using the admin consent endpoint (access the following url in a browser):
https://login.microsoftonline.com/{tenant-id of other tenants}/adminconsent?client_id={client-id of the multi-tenant app}
Sign in with the admin account from other tenants to do the admin consent. This will added an enterprise app to that tenant.
Then you can use it for the authentication in those tenants.
Related
Is it possible to allow all users in a specific AAD tenant to access an app?
Something like a tenant trust. Tenant 1 trusts Tenant 2 and I can add 'tenant2\AllUsers' to a permission.
I want to allow all users of a partner tenant (current and future) to be able to access a SharePoint site and a few other apps.
I've looked at B2B but it requires invitations which is hard to manage at scale.
Entitlement management looks nice but requires P2 licenses and has lots of capabilities we just don't need.
Does anyone have a simple way to do a 'tenant trust'? Am I missing something?
Firstly, you have a misunderstanding of "tenant trust".
When we say tenant trust, it means the tenant trusts an app and then the app can access the data of that tenant. There is not a way to make a tenant trust another tenant.
Anyway, using the official admin consent URL you can grant admin consent for a whole tenant to an app.
See Construct the URL for granting tenant-wide admin consent.
https://login.microsoftonline.com/{tenant-id of partner tenant}/adminconsent?client_id={client-id}
Sign in with an admin account from partner tenant and do the admin consent. Then all users from partner tenant can sign in to this app.
For SharePoint user case, you can take advantage of self-enroll service. Please refer to Use SharePoint as a business-to-business (B2B) extranet solution and Create a B2B extranet with managed guests.
I'm creating a MVC core app that uses Azure Active Directory (AAD) as user storage.
I can create users manually in the AAD Users dashboard screen and invite external users without problems. They can also login into the app without issues.
Uninvited external users can also login to the app when agreeing with the consent screen which is what i want.My question however is how can i keep track of those users in AAD? They are not listed in the Users dashboard as external users nor are they logged in the 'Sign-ins' log screen.
Is there some option that i need to enable?
Since you want to use external users in your application, I would suggest that you use the Azure AD B2C solution: https://learn.microsoft.com/en-us/azure/active-directory-b2c/technical-overview
This will create a new B2C tenant from which you can track users that have integrated and logged in your application.
Check the consumer accounts section to see if this matched your needs:
Consumer accounts
With a consumer account, users can sign in to the applications that you've secured with Azure AD B2C. Users with consumer accounts can't, however, access Azure resources, for example the Azure portal.
When registering a native application on the Azure AD 1.0 endpoint, and assigning Graph API permissions, it seems like consented permissions are 'cached' somewhere and can't be managed properly.
Example scenario:
Application registered and permission scopes (incl. ones requiring admin consent) assigned.
Administrator consents to the permission scopes
Simple user can use the app with consented permissions.
Permission scopes change (adding a new one for example)
Same admin doesn't get the consent form anymore
Simple user is stuck with "consent required, have an admin account?"
Another global admin must use the app for the first time to trigger the consent page.
Note that #7 doesn't always work; even if the other admin provides consent, simple users can't get through sometimes.
This is a multi-tenant application, yet when start using it in another tenant, I can not see its consented permissions in the AAD portal under enterprise applications.
Shouldn't permissions that have been consented to be listed in other tenants so that the admin can at least see what has been consented to?
Also, when I register an app on the V1.0 endpoint in my own tenant, I have an option to 'grant permissions' centrally, from the Azure AD portal for my tenant.
This option isn't available if I'm looking at an application that was registered in another tenant.
Am I overlooking something? Any help much appreciated.
When you change permissions, it does not automatically re-consent (for user or admin). You can find a detailed overview of this at Understanding user and admin consent.
You'll first need kick off the Admin Consent workflow. For a multi-tenant app this is done by adding prompt=admin_consent to your OAUTH URL and having an Admin authenticate.
Once that is done you can also force existing users to re-consent as well by adding prompt=consent to your Auth URL.
I am developing a multi-tenant Office 365 daemon that requires access to user calendars.
I have successfully registered in the company tenant (Tenant1) that has deployed this app using certificates and I am able to get access tokens.
Now I created a separate AAD tenant (Tenant 2) and logged in to daemon app using administrator account of Tenant 2, it prompted the Admin Consent screen and I provided consent. There was no errors returned.
When I tried to get an app token however, I am able to get a token but with blank permissions. If I call the Office 365 API using this token, I get a 401.
I was of the view that service principal objects should be created. Also I am unable to see this app in Tenant 2 app registrations.
Do all my consumers have to register this app manually in their AD tenant and modify application manifest file to add certificate details?
I am not sure about the benefit of multi tenancy if that's the case.
I found the follow in the Azure Active Directory documentation:
The following diagram illustrates the relationship between an application's application object and corresponding service principal objects, in the context of a sample multi-tenant application called HR app. There are three Azure AD tenants in this scenario:
Adatum - the tenant used by the company that developed the HR app
Contoso - the tenant used by the Contoso organization, which is a consumer of the HR app
Fabrikam - the tenant used by the Fabrikam organization, which also consumes the HR app
You do not need to have each tenant register your application. In fact, you shouldn't since having dozens (or hundreds) of unique App IDs floating around would only create headaches for you.
Each tenant does however need to execute the Admin Consent workflow. This will authorize the App ID you've registered on your end to access the scopes you've requested.
Generally, I recommend using the v2 Endpoint and the apps.dev.microsoft.com portal for registering your app. While you can also register your app in your own Active Directory, the portal makes it a lot easier to manage.
The general process is:
Register you application in the Registration Portal
Populate the "Application Permissions" in the Microsoft Graph Permissions section.
Launch the Admin Consent workload using https://login.microsoftonline.com/common/adminconsent?client_id=[APPLICATION ID]&redirect_uri=[REDIRECT URI]
Get a beer
A couple of tips:
The Registration Portal only supports MSA (i.e. personal) accounts at the moment. I'd suggest creating a new Outlook.com account for this purpose so you can easily share the credentials with folks who need them internally.
If you create a shared Outlook.com account, you should also set up forwarding rules for all of the interested parties internally. This is in case something should every go wrong or change down the road and you need to recover the account.
I wrote a v2 Endpoint and Admin Consent primer that you might find helpful. They assume you're using the Authorization Code flow but the concepts remain the same for Client Credentials.
For v1 app registered in portal, you can 'Grant Permissions' to consent to an application's delegated permissions on behalf of all the users in your tenant. For an app registered in v2 endpoint, can only see it in the 'Enterprise Applications' tab and there is no option for 'grant permissions' in the permissions tab. How to get to the same goal that I do not want individually consent each user?
Edit: after make the adminconsent call,
This worked, (with only graph scope)
https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=myappid&response_type=code&response_mode=query&scope=openid profile email offline_access https%3A%2F%2Fgraph.microsoft.com%2FCalendars.ReadWrite%20https%3A%2F%2Fgraph.microsoft.com%2FContacts.ReadWrite%20https%3A%2F%2Fgraph.microsoft.com%2FMail.ReadWrite%20https%3A%2F%2Fgraph.microsoft.com%2FUser.Read&state=12345&redirect_uri=redirecturl
This still give me a AADSTS90094 error and ask for admin consent, (with openid scopes)
https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=myappid&response_type=code&response_mode=query&scope=openid profile email offline_access https%3A%2F%2Fgraph.microsoft.com%2FCalendars.ReadWrite%20https%3A%2F%2Fgraph.microsoft.com%2FContacts.ReadWrite%20https%3A%2F%2Fgraph.microsoft.com%2FMail.ReadWrite%20https%3A%2F%2Fgraph.microsoft.com%2FUser.Read&state=12345&redirect_uri=redirecturl
Edit:
This issue happens only when I turn on 'User Assignment Required' flag
in azure portal, if that flag is disabled, users will be able to individually consent and login, no issues, however we need this flag since we do not want all our users in AD be able to use the app.
To request consent for all users in a tenant in Azure AD V2.0, your app can use the admin consent endpoint:
GET https://login.microsoftonline.com/{tenant}/adminconsent?
client_id=6731de76-14a6-49ae-97bc-6eba6914391e
&state=12345
&redirect_uri=http://localhost/myapp/permissions
Please refer to docunment : Using the admin consent endpoint
The listings in the enterprise apps tab are all service principals rather than app registrations. These are apps that your tenant has signed into & consented thus provisioning the service principal into the tenant.
v2 apps are created and managed through the App Registration Portal; however, there is no equivalent functionality to Grant Permissions at this time. In order to perform admin consent in v2, you have to construct a request to Azure AD.
Just go to your browser and drop the following request (populated with your regisered apps Client/App ID & Redirect URI:
https://login.microsoftonline.com/{tenant}/adminconsent?client_id=<Client/App ID>&redirect_uri=<App's Redirect URI>&state=111