I have to implement a hybrid model of application on Azure, where
a few (20%) of the clients will have dedicated instances
others (80%) will be based on Multi-tenant (shared) model.
What approach should I take in terms of
Azure AD (Different AAD Tenants?) - Should i have different sunbscription for each client? As i read that a single subscription can be linked to only 1 Azure AD Tenant.
VNETs
App Service
Logic Apps
-Service Bus?
Any help will be highly appreciated.
The moment you have to sign-in users from more than one tenant, you are advised to carefully study the multi-tenant app development guide to ensure that you understand the nuances of a multi-tenant app development fully.
You have to separate the app's authentication aspect (AAD) from the resource consumption aspect (Azure Subscription).
If you are hosting the app for your customers who do not have a subscription, your app will be most probably registered and deployed in your tenant as a multi-tenant app. You sign-in user's from these customer's tenants but pay for an azure subscription of your own. Then you'd have to figure out how to invoice your customer's to recover the cost of the subscription.
If your app can use a subscription provided by the customer, then your app can be registered and deployed in a customer's tenant and use their resources.
Related
We have an Office 365 tenant that we are using for our basic AD functions (joining desktop PC's, authentication, etc..) for our organization.
We're also building a stand-alone mobile and web application. We have an Azure subscription we've tied to our primary AAD tenant. And we're likely to have a separate dev/test subscription.
We're wanting to join our applications resources to an AAD for management purposes, but my question is should we join these to our regular AAD? I don't think that's wise. So what are the alternatives? Create another AAD? We plan to use Azure B2C for the web and mobile authentication.
Do we create another tenant? Partition our primary tenant off in some way (like traditional AD forests and trees)?
I'm trying to keep the application isolated for security purposes from our organizations usage.
FYI, we do not have any on-prem legacy AD.
This depends on what the purpose of your applications are. if you are selling your application and creating a multitenant application, etc. There may be a case for separate tenants (B2C).
But in general, try to avoid creating too many tenants, it can become a management nightmare.
Now to answer some of your specific questions. When you create azure b2c, it is actually a new AAD Tenant, with a different domain name.
In terms of the dev/test subscription, it should be a subscription tied to the same AAD tenant. You would not create a separate tenant for that. unless you absolutely need to test things with a totally separate Directory (eg, editing random Global Azure AD settings that you don't want to do in your primary tenant) but again, that means it becomes a management nightmare as 1: you don't want to create multiple users in different tenants for the same person. This means you'll need to use azure b2b, to federate users and setup separate permissions, etcetc.
In azure Ad you cannot create child domains, that concept is different from on-prem AD. its just not how it works.
Here's a good read on some of the rarer scenarios to create more tenants:
https://itconnect.uw.edu/wares/msinf/aad/new-aad-tenant/
If you plan to use B2C then the app registration should be done there. You can later federate with your primary AD tenant.
Could someone please tell me what the difference is between "enterprise application" and "app registration" in Azure.
Appreciate if you could give me an example & why some application cannot be registered under blade "Enterprise application" and vise versa.
An App Registration is a way of reserving your app and URL with Azure AD, allowing it to communicate with Azure AD, hooking up your reply urls, and enabling AAD services on it. When you have an application that you are developing and want to integrate with Azure, you need to register your application in App Registrations, where you will configure your reply URL, logout URL, and API access if needed. When you register your application, Azure AD assigns a unique Application ID to it and allows you to add certain capabilities such as credentials, permissions, and sign-ons. The default settings allow only users from the tenant under which your app is registered to sign into your application.
The Enterprise Applications blade might be confused with App Registrations because the Enterprise Application blade contains the list of your service principals. However, the term Enterprise App generally refers to applications published by other companies in the AAD gallery that can be used within your organization. For example, if you want to integrate Facebook and manage SSO within your organization, you can integrate it from the Enterprise Applications dropdown in the applications blade. Your own applications will also be represented in the Enterprise Applications blade as Service Principals, which are instantiations of your applications in the tenant.
App Registration: https://learn.microsoft.com/en-us/azure/active-directory/develop/quickstart-v1-add-azure-ad-app
Integrating an Enterprise application (G-Suite): https://learn.microsoft.com/en-us/azure/active-directory/saas-apps/google-apps-tutorial
This is, I agree, potentially confusing to a new-to-AAD developer or administrator. Nitin's answer does a good job of summarizing this but I wanted to add an answer with documentation references.
At https://learn.microsoft.com/en-us/azure/active-directory/develop/app-objects-and-service-principals it says:
The application object is the global representation of your
application for use across all tenants, and the service principal is
the local representation for use in a specific tenant.
Then, at https://learn.microsoft.com/en-us/azure/active-directory/develop/active-directory-how-applications-are-added, it says:
You can manage application objects in the Azure portal through the
App Registrations experience.
Application objects describe the application
to Azure AD and can be considered the definition of the application,
allowing the service to know how to issue tokens to the application
based on its settings.
and
You can manage service principals in the Azure portal through the
Enterprise Applications experience. Service principals are what govern
an application connecting to Azure AD and can be considered the
instance of the application in your directory. For any given
application, it can have at most one application object (which is
registered in a "home" directory) and one or more service principal
objects representing instances of the application in every directory
in which it acts.
So, for third-party apps, you'll only have a service principal in Enterprise applications. For first-party apps that are internal, you'll have something in both places - one to define the app (App registrations) and one to allow the app to actually sign in to Azure AD (Enterprise applications). When you define the first-party app in the App registrations, you'll also automatically create an entry in Enterprise apps. If you look at the two entries, you'll see that the Application ID links the two together.
Shorter way to understand is...
App Registration are basically the apps local to the tenant/organization in which they have been registered to generate unique application id.
Enterprise apps blade shows global apps (belonging to other tenants) which can be configured and used within your tenant/organization.
The workflow is you create the App Registration (Application) in your tenant, which also creates the Enterprise Application (Service principal) in your tenant. Then when another tenant user wants to login to your app, they grant your app the permissions it requires and the Enterprise Application (Service Principal) is created in their tenant. This effectively mirrors your application in their tenant.
Additionally, within Application registration you can configure OpenId-Connect (OpenID/OAuth) based authentication. Within Enterprise Apps you can configure SAML based auth
Simple put:
Application Registration create an global application object which will allow the app to delegate to user identity for resource access, whereas the Enterprise application is the application identity(a service principle) in each AD tenant
Well, there're some good answers here but they are too verbose so I feel the simplest thing is show three pictures and one statement:
In the App Registration, we have "Application Objects":
To understand what you're seeing in the Enterprise Applications blade are "Service Principals":
And this is the relationship between the two in a multi-tenant example:
Adatum - The tenant used by the company that developed the HR app
Contoso - The tenant used by the Contoso organization, which is a consumer of the HR app
Fabrikam - The tenant used by the Fabrikam organization, which also consumes the HR app
And with that out of the way, we can understand this statement:
Similar to a class in object-oriented programming, the application
object has some static properties that are applied to all the created
service principals (or application instances).
The application object is the global representation of your
application for use across all tenants, and the service principal is
the local representation for use in a specific tenant. The application
object serves as the template from which common and default properties
are derived for use in creating corresponding service principal
objects.
Also said in a different way:
Application objects - Although there are exceptions, application
objects can be considered the definition of an application.
Service principals - Can be considered an instance of an application. Service
principals generally reference an application object, and one
application object can be referenced by multiple service principals
across directories.
Reference: https://learn.microsoft.com/en-us/azure/active-directory/develop/app-objects-and-service-principals
I have created a native application in an Azure AD in Azure General region. The application has been granted appropriate permissions (Sign in on user's behalf, execute Service Management API requests etc.). Using this application, I am able to connect to any Azure Subscription in Azure General region using this application.
However when I try to connect to an Azure Subscription in Azure China, after successful login, I am getting the following error:
AADSTS70001: Application with identifier '01234567-890a-bcde-ffff-fcc63fc150ea' was not
found in the directory 'xxx.yyy.onmschina.cn'.
So my questions are:
Is it possible to connect to an Azure Subscription in Azure China (or for that matter to any Azure Subscription in Azure Sovereign Cloud like Germany etc.) using an application created in Azure General region?
Or do I need to create a separate application for each Azure Sovereign region in an Azure AD in that region?
If I indeed need to create a separate application (i.e. answer is yes to above question), is it possible to create an Azure AD tenant in these Sovereign regions without having an Azure Subscription there?
I believe the answer to the last question is yes considering Azure AD and Azure Subscription are two different things, yet I would very much like to get a confirmation on the same.
No,
it is NOT possible to connect Azure "General" with any sovereign clouds - these are Azure US Government, Azure China, Azure Germany. All these clouds are completely separate deployments with their own Azure AD. You cannot use B2B inter clouds, you cannot use your multi-tenant applications across clouds.
For that case you have to have a subscription in every cloud you would like to support and separate application registration, and separate instructions for your users. Check for example how Azure CLI is handling this. You are always only connected to one cloud with cloud's specific account.
In Azure Germany you can create an Azure AD tenant - just create a free trial subscription and you will also get a tenant. For China and US Gov will be hard - they both have very strict requirements who can create subscriptions there.
This is a licensing related question for Azure Active Directory.
We would like to use Azure AD as a SAML identity provider for our own applications, using the available method in the Azure AD Premium subscription, i.e. by creating a new custom application in the 'enterprise applications' list. Now do I need to assign a Premium license to every user that is going to login to this application via SAML? Or does it suffice to assign this license to the users that are administering the application?
The former case seems more plausible to me, however it would be way too expensive for us, and during testing the custom applications seems to work also for users which do not have the license.
https://azure.microsoft.com/en-us/pricing/details/active-directory/
I am not a licesing expert, that said, Azure AD licenses are per user. Read the doc above. If the app is pre-integrated in the gallery, Azure AD users with the free tier can connect to 10 apps at no cost. If the app is on-premises, that requires Azure Application Proxy which would require Azure AD Basic.
If it's a custom application not in the gallery AD Premium is required. Keep in mind AD premium has a ton more functionality. Conditional Access is a Game Changer. Very powerful. Multifactor Authentication, self service password reset, MIM, SCCM CALs, are all included.
Being able to simplify identity for users and link All applications they use to their AD account is important. Ems gives you the ability to monitor identity with Advanced Threat Analytics etc. It's actually a very useful suite of services and not drastically different in price than stand alone AD premium.
There is an interesting point on license page too
Blockquote
With Azure AD Free and Azure AD Basic, end users who have been assigned access to SaaS apps can get SSO access to up to 10 apps. Admins can configure SSO and change user access to different SaaS apps, but SSO access is only allowed for 10 apps per user at a time. All Office 365 apps are counted as one app.
will setting "Application is Multitenat" make my application work with other tenants which are not registered in my azure subscription. which are not part of my active directory. will setting this option work with any #######.onmicrosoft.com. the image you see is from azure active directory web app page. i have register my web application to consume the office 365 api as describe in page https://github.com/OfficeDev/O365-WebApp-MultiTenant
In context of Azure AD:
A single tenant application is only available to users of Azure Active Directory (Azure AD) where this is created.
A multi tenant application is not only available to users of Azure AD where it is created but it also available in other Azure ADs. Users in other Azure ADs have to explicitly grant consent to the application in their Azure AD. When an application is added to another Azure AD, that application essentially becomes a user in that Azure AD as a Service Principal.
A single tenant application means application is hosted specific for a single client. Reasons may be specific business needs OR regulatory compliance OR they can be n numbers of real scenarios you can imagine.
In multi tenant application is available to group of clients. Reasons here can be common business needs, no regulatory compulsion, less cost in supporting maintenance & usage as same application is used for multiple clients.
Practical Example is below (Directly taken as it is from MSDN):
One of the first architectural decisions that the team at Tailspin had to make about how the Surveys application could best support multiple subscribers was whether it should be a single-tenant or multi-tenant application. Figure 1 shows the difference between these approaches at a high-level. The single-tenant model has a separate physical instance of the application for each subscriber, while the multi-tenant model has a single physical instance of the application shared by many subscribers.
It’s important to note that the multi-tenant model still offers separate views of the application’s data to its users. In the Surveys application, Client B must not be able to see or modify Client A’s surveys or data. Tailspin, as the owner of the application, will have full access to all the data stored in the application.
For more details : refer Hosting a Multi-Tenant Application on Windows Azure