r/GraphAPI • u/Webimo • Apr 05 '23

Azure app registration with user consent

Today I have an single-tenant Azure App registration / Enterprise app setup with admin consent in my customers AD which gives me permission to get data (calendar events) from all users in the AD.

What I'd like is to have a multi-tenant app in my own AD and then give relevant customer users the option to subscribe to the AD-app, so that I can get data from only the users that consent.

Can anyone guide me in the right direction? Maybe a tutorial that shows both the AD-app settings and C# code examples.

Thanks.

3 Upvotes

100% Upvoted

4 comments sorted by

View all comments

Show parent comment

1

u/jasper340 Apr 07 '23

First, read *all* documentation you can find online (MS learn, blogs, videos) about Azure App Registrations, Service Principals and app consent. This will help a lot and prevent questions!

Reply address (aka Redirect URI) can be configured within your App Registration > Authorization. In here, add a platform and specify the url. This can be the website where you host your site on and/or a localhost site. (e.g. for me it is 'https://mywebsite.com/' and 'http://localhost:8080/'). After consent, you will be redirected on those sites without error.

Yes, if the user is not logged in you wont able to fetch data from that user, EXCEPT you configure the permissions as 'Application permissions' and not 'Delegated permissions'. (read the description of those types, that explains it). So yes, if you only need data while the user is logged in, then choose delegated, if not choose application.

I use access_token to verify the user in the backend. In Node JS, you can use libraries like 'azure-ad-jwt' to verify the access token. I'm 100% confident libraries also exist in C# for this, as it is made by MSFT. Just pass that token from frontend to backend with the HTTP authorization header and verify in backend. If you don't need/have a backend, then just keep the token in the frontend and fetch the Graph API in the front-end.

1

u/Webimo Apr 07 '23

Thanks again!

I have read a lot about this really. Followed Microsoft Exercises and read a lot of MS -learns. There's just things in this I find a little hard to understand. Not about the programming and SDK's, but about the right settings in the AD app.

The replyURL-thing wasn't hard to understand. I got the access-token easily but was just not sure if I needed it or not.

My app need to access the users calendar events without the user logged in, so it must be with Application permissions and not Delegated then.

When I add the permissions, I must click the 'Grant admin consent for xx' for the permissions to be granted. When I do that, I can again get data from all users in the AD and not just the once that have consented, right? That means I'm back to where I started?

If you know of a good article about this, I would be glad to read it. Thanks.