I want to access Azure Directories and Subscriptions using my web app hosted on my server but i do not want to register my app in active directory because
i do not have permissions to register my app in active directory
I want to authenticate users from out of my active directory too.
for example following sites let you authenticate any Azure AD user.
https://resources.azure.com/
https://azureiotsuite.com
Please help me to where to start. i have tried Azure AD authentication but it asks you to register your app in Azure AD Apps.
One option is to register your app at https://apps.dev.microsoft.com. (And use the v2 endpoints)
Documentation here: https://learn.microsoft.com/en-us/azure/active-directory/develop/active-directory-appmodel-v2-overview
What you want to make is known as a multi-tenant application. An application to which you can login from any Azure AD tenant.
The first link leads you to create a converged app which allows you to use Microsoft accounts as well as Azure AD accounts to sign in.
If you only want Azure AD accounts, you could just create an Azure AD and register the app there as a multi-tenant app. (And use the v1 endpoints)
Related
We have a static website in Storage account with BE in Function App.
We would like to use Azure AD for authentication.
When I register app, I can see 2 options:
Who can use this application or access this API?
Accounts in this organizational directory only (Single tenant)
Accounts in any organizational directory (Any Azure AD directory - Multitenant)
Issue is that Azure AD we would like to authenticate against is in different tenant.
So we want something in between Any Azure AD and THIS Azure AD.
Is there a way to achieve that?
Register the app in the different tenant directly with the Single tenant option.
The fact that the app is hosted in a subscription linked to another tenant does not matter.
You'll need someone who has a user account in the other tenant to register the app in that tenant or they need to give your user access there.
You can switch the tenant that you are looking at in Azure portal from the top-right.
Click your username -> Switch directory -> Select the tenant from the list.
I am currently using Azure AD app (Client Id and Client Secret) of one directory to get users details and Azure resources of the attached subscription though MS Graph and Azure Management API. Now i have added one more directory and subscription under my management group . I want to know if i created a multi tenant Azure AD app through App registration , can i access the users of other directory ? If yes what configurations are required ?
If you want to use a single Azure ad application to access different Azure AD directories, then you must configure the application as a multi-tenant application. Because changing the application to a multi-tenant application allows any tenant log in.
Next, you need to request the consent of the administrators of other Azure AD tenants. After the administrator consent, it will be added to other organization tenants as an enterprise application in. In addition, different tenants need to use different access tokens.
Can we configure SSO (Single Sign-On) in Azure without using the Azure Active Directory? Or using any Code.
If you need to log in with Azure AD users then SSO is required for Azure AD. If you have your own database of users to login and then you don't require Azure AD.
I understand the concept of AzureAD App Registrations and I'm using it in several projects. Now I need to generate a Web App that should be deployable as a component in any AAD. This Web App should use Azure APIs to discover components in the subscription it is deployed to which I don't know at develop time.
What is the preferred way to accomplish the app registration fully automated at deploy time? I need to register an app in AAD and then to store the informations (App Id, Tenant ID, ...) in my web.config somehow.
The problem is that you can't develop an app that has access to the Azure AD without it being registered first.
The Azure Portal and Powershell have access. Maybe you can use Powershell to script the permission grant in your scenario?
Otherwise, (I did this a while back for a solution) you can create a multi-tenant web app, that your customers' Azure AD tenant administrators can sign in to. With the tenant administrators granting access, the web app can then access their Azure AD graph API and create the required application definition for your application.
In my scenario the Azure AD client application ran on-premise. It required access to the Azure AD graph API and also needed certificate based authentication towards the Outlook 365 Exchange Web Service. So the web app could create the certificate, grant access to the required APIs, and let the user download the certificate, application ID etc. The on-prem app could then use the downloaded file as its configuration for accessing the Azure AD and other APIs.
I am working on application where authentication is done by Web service which further calls our organisation AD service to authenticate.
Now I want to move my application to Azure but problem is my web service is not exposed outside organisation. So I can't use web service on Azure to authticate.
Then I searched for Azure AD and found that Azure AD it self provides authenticate and store users data to their data center.
How can I integrate my organisation AD account to Azure AD ?
You are probably looking for Azure AD Connect. See
Integrate your on-premises directories with Azure Active Directory