I have set up a Azure Active Directory App so that I can access the Microsoft Graph API with MSAL. However, I want to perform API calls without a user (https://learn.microsoft.com/en-us/graph/auth-v2-service) and as such I have added a few permissions that require "Admin consent" to my app. However, I cannot find a way to grant my app these permissions.
I've tried looking around the Azure portal for a way to grant these permissions but without success. I have also tried using the https://login.microsoftonline.com/{tenant}/adminconsent&... link to grant permissions, but unsucessfully so.
The response I received was
AADSTS500201: We are unable to issue tokens from this API version for
a Microsoft account. Please contact the application vendor as they
need to use version 2.0 of the protocol to support this.
I do not have an Azure subscription (not even the free one), but seeing as I was able to add apps to Azure AD as well as get access tokens and then make API calls on behalf of the authorized users I assumed I might not need a subscription.
I just made another app and now I have the grant consent button when I open the API Permissions view.
Related
So I'm using Power Automate to connect the API for Azure Cost Management Usage Specifically this guy:
https://learn.microsoft.com/en-us/rest/api/consumption/usage-details/list?tabs=HTTP
However, Powerautoamte, though it has an ADAuth with Oauth2 option, requires something called an "Audience?" and really I have no idea what to put here.
I have indeed registered an app, gave it the user-impresonation permission, approved it for my domain, and generated a client/secret for that app. All I need is the "Audience"
The Audience is the API which your AAD app has permissions on.
To find this URL, try to navigate to Azure AD and App Registration, then select your Application, and click on API Permissions.
Select API / Permissions name which should popup the permission details along with the used API.
For example my AAD app has Microsoft Graph permissions
If I select Microsoft Graph row or click on one of the permissions the popup shows details
The URL https://graph.microsoft.com/ represents the Audience in my case.
You are probably using Azure Service Management, so in your case the Audience will be https://management.azure.com/
I created an application named MyApp in my Tenant A with multitenant access. Also, I didn't add any API permissions to it in Azure Portal. I also removed default User.Read permission.
After that, I implement a backend project with using msal4j library. In backend code, I sent harcoded scope Directory.ReadWrite.All.
After that, I run the backend project. The project showed Microsoft sign in pop up in the browser. I provided the credentials of admin of another tenant named B(Tenant B have 16 users). After the successful sign in, the Permission Requested pop-up showed, It was written a description about the Directory.ReadWrite.All. This was normal since I was add Directory.ReadWrite.All as a scope in my backend code.
After approving that requested permission as an admin of Tenant B. I can list the 16 users of the Tenant B with GET /users endpoint of the Microsoft Graph API. So, the MyApp which was created in Tenant A could access the users of Tenant B.
However, how it was possible? Because I didn't add any API permission to my MyApp in the Azure Portal. You can see above screnshot that is empty. I expected to get an error like "Insufficient privilege" when accessing the GET /users endpoint. But I didn't. I can successfully access the all 16 users although I didn't add the Directory.ReadWrite.All API permission in the Azure Portal into MyApp.
If sending Directory.ReadWrite.All as scope from backend project is enough to access to GET /users endpoint. Why we want to use API permissions in the Azure Portal?
The Azure portal permissions are what we call static permissions.
You use them with the ".default" special scope, e.g. https://graph.microsoft.com/.default.
When you specify a scope in the authentication request, that is a dynamic permission.
It is a feature of the newer v2 endpoint that allows you to request the needed permissions at runtime instead of ahead of time.
It's pretty nice for multi-tenant apps since updating permissions can be done more easily, and you can implement optional features better (that require additional permissions).
Docs: https://learn.microsoft.com/en-us/azure/active-directory/develop/v2-permissions-and-consent and https://learn.microsoft.com/en-us/azure/active-directory/develop/consent-framework
I have registered a multi-tenant app in my Azure subscription. using this App, I want to create an OAuth flow for my client to be able to give me permissions to create an app in his active directory.
We are using OpenID connect flow to access the Azure AD graph API.
In spite of making our app multi-tenanted via the console, we are getting the following error when the client (xyz#outlook.com) tries to sign in:
User account 'xyz#outlook.com' from identity provider 'live.com' does not exist in tenant 'Default Directory' and cannot access the application 'bf5ca806-xxxx-xxxx-xxx-xxxx' in that tenant. The account needs to be added as an external user in the tenant first. Sign out and sign in again with a different Azure Active Directory user account
I used the following endpoint to get an access token:
https://login.microsoftonline.com/common/oauth2/authorize?
client_id=xxxxxxxx-xxxx-xxxxx-xxxx-xxxxx
&response_mode=form_post
&response_type=code+id_token
&redirect_uri=http://localhost:8080
&prompt=admin_consent
&nonce=1234
&resource=https://graph.windows.net
Please help me to resolve this error
Unfortunately, you cannot use a guest user to login Azure AD Graph Explorer for now.
I came across the same issue as yours long time ago and I understand it's very important for customers. So, you can post your idea in this User Voice Page and the Azure Team will see it. I will also upvote for it.
But there are other solutions if you don't mind:
Solution 1: Try to use an internal account of that directory which upn ends with .onmicrosoft.com
Solution 2: Try to use other tools to get access token with a guest user(this account also need to be an admin of that directory), such as postman. Then you can use Postman to call Azure AD Graph API. You can refer to this blog to use Azure AD Graph API with Postman.
Hope this helps!
Let's say there is a web application in some other Azure AD directory configured for multi-tenant access.
When I try to use it, after authenticating it will present a consent page asking if app can access by profile data etc. After I accept, application spn's get provisioned in my Azure AD directory.
My question is, can this consent flow be completed/accepted using graph api's programatically instead without needing interactive process?
As far as I know, there is no such API we can grant the consent for the permission. However it is able to grant the consent for the all organization using the parameter prompt=admint_consent.
Refer here about more detail about this paramter.
my question is similar to question Multi-Tenant app - OneDrive Business API
but i want my application to access the one drive from tenants of other different azure subscription, is it possible? i understood that if i register my application and mark it as multi-tenant, it will allow me access the tenant in my azure subscription, but if i want to access the tenant using the same application but in different azure subscription whats the way.
What’s kind of authentication flow are you using? Normally, we use the Authorization Code Grant Flow that the user delegates access to a web application. In this scenario, to enables the users on other tenants to login the website and access their Office 365 resource, we only need to enable the multiple-tenant app on the Azure portal.
but if i want to access the tenant using the same application but in different azure subscription whats the way.
It depends on which REST you were using. It is same as we are call the REST API for the single tenant app if we are using the Microsoft Graph to query the OneDrive for business. The endpoint of the list children of a driveItem is still like below no matter which tenant the user login:
GET https://graph.microsoft.com/v1.0/me/drive/root/children
GET https://graph.microsoft.com/v1.0/me/drive/items/{item-id}/children
GET https://graph.microsoft.com/v1.0/me/drive/root:/{item-path}:/children
If you were using the Office 365 REST API, we need to discover the service endpoint. You can refer to here for more detail about Office 365 Discovery Service REST API.
Depending on the permissions that you need normally the tenant admin of the other tenant has to add the application to their own Azure AD. With the newer app model v2 this is quite a lot easier as the admin can simply give consent once in the normal consent screen for the entire tenant. See here for a mor elaborate explanation of how this would work.