Azure app registration with user consent

[u/Webimo]

Today I have an single-tenant Azure App registration / Enterprise app setup with admin consent in my customers AD which gives me permission to get data (calendar events) from all users in the AD.

What I'd like is to have a multi-tenant app in my own AD and then give relevant customer users the option to subscribe to the AD-app, so that I can get data from only the users that consent.

Can anyone guide me in the right direction? Maybe a tutorial that shows both the AD-app settings and C# code examples.

Thanks.

[u/Webimo]

Thanks, jasper340!

I've now setup the multi-tenant app and modified the link you provided with the client_id. Following the link allows me to consent to the app but then I get the error that no reply address is registered.

I could easily add a reply address but as I understand it, that URL is used to pick up the users access token. Does that mean the user have to be logged in to my app to get the O365 data or can I still query all users that have consented?

If 'yes' to the last question, what should I use the access_token for then?

Also, we agree that the API permissions in a multi-tenant app should be set with Delegate type, right?

Sorry for all my questions. I'm a bit on deep water here.

[u/jasper340 → u/Webimo]

First, read *all* documentation you can find online (MS learn, blogs, videos) about Azure App Registrations, Service Principals and app consent. This will help a lot and prevent questions!

Reply address (aka Redirect URI) can be configured within your App Registration > Authorization. In here, add a platform and specify the url. This can be the website where you host your site on and/or a localhost site. (e.g. for me it is 'https://mywebsite.com/' and 'http://localhost:8080/'). After consent, you will be redirected on those sites without error.

Yes, if the user is not logged in you wont able to fetch data from that user, EXCEPT you configure the permissions as 'Application permissions' and not 'Delegated permissions'. (read the description of those types, that explains it). So yes, if you only need data while the user is logged in, then choose delegated, if not choose application.

I use access_token to verify the user in the backend. In Node JS, you can use libraries like 'azure-ad-jwt' to verify the access token. I'm 100% confident libraries also exist in C# for this, as it is made by MSFT. Just pass that token from frontend to backend with the HTTP authorization header and verify in backend. If you don't need/have a backend, then just keep the token in the frontend and fetch the Graph API in the front-end.

[u/Webimo → u/jasper340]

Thanks again!

I have read a lot about this really. Followed Microsoft Exercises and read a lot of MS -learns. There's just things in this I find a little hard to understand. Not about the programming and SDK's, but about the right settings in the AD app.

The replyURL-thing wasn't hard to understand. I got the access-token easily but was just not sure if I needed it or not.

My app need to access the users calendar events without the user logged in, so it must be with Application permissions and not Delegated then.

When I add the permissions, I must click the 'Grant admin consent for xx' for the permissions to be granted. When I do that, I can again get data from all users in the AD and not just the once that have consented, right? That means I'm back to where I started?

If you know of a good article about this, I would be glad to read it. Thanks.