How to allow Azure Ad App to access information only for certain users?

Dev Anand 1

Say, I have 100 users in my AD. I registered for an App like- https://learn.microsoft.com/en-us/graph/auth-register-app-v2?context=graph%2Fapi%2F1.0&view=graph-rest-1.0.

But I want this app to access events for only 10 users not all 100. How can this restriction be applied on this app?

Admin Admin 1 Reputation point

2021-07-20T12:03:48.307+00:00

Is there a way to attach a dynamic group instead of a security group to an application? How can we scope a dynamic group of users to a registered app?

1 answer

Krish G 2,326 Reputation points

2020-10-12T22:28:52.123+00:00
You might have one of the below scenario. Follow the one which fits in your situation.

1. User Sign-in scenario
If your users sign-in using the AAD app, you can restrict that by leveraging "User Assignment" feature of Azure AD 'Enterprise Application' blade to restrict application to a set of users (or groups). For details, refer How to: Restrict your Azure AD app to a set of users in an Azure AD tenant.

You need global admin role

Enterprise Applications -> Your Application's Overview page -> Properties -> User assignment required? and set it to Yes

Users and groups in app menu -> Add Assignment -> Select users/groups -> Assign

However you should keep in mind some limitation.

This feature is available for web app/web API and enterprise applications only. Apps that are registered as native cannot be restricted to a set of users or security groups in the tenant.

The option to restrict an app to a specific set of users or security groups in a tenant works with the following types of applications:

Applications configured for federated single sign-on with SAML-based authentication

Application proxy applications that use Azure AD pre-authentication

Applications built directly on the Azure AD application platform that use OAuth 2.0/OpenID Connect authentication after a user or admin has consented to that application.

OR

2. Application identity scenario
If you are using app identity (client credential flow) to authenticate, you can restrict the app for only specific users by leveraging ApplicationAccessPolicy. For details, refer Scoping application permissions to specific Exchange Online mailboxes

Connect to Exchange Online PowerShell. For details, see Connect to Exchange Online PowerShell. NOTE: Be aware of the prerequisites as it is supported in Windows only and Linux support is in preview whereas Mac is not supported yet.

Identify the app’s client ID and a mail-enabled security group to restrict the app’s access to.

Identify the app’s application (client) ID in the Azure app registration portal.

Create a new mail-enabled security group (if not already created) or use an existing one and identify the email address for the group. NOTE: "mail-enabled security group" is not a regular AAD group. You can create it using Office365 Portal. Exchange ECP, or PowerShell. Refer Manage mail-enabled security groups
Run the following command New-DistributionGroup -Name "{name of the group}" -Alias "{alias}*" -Type security *Alias = This is the portion of the email address that appears to the left of the at (@) symbol.

Once your group is created, you can add/remove users to the group using Offce365 portal, Exchange ECP, Powershell or Graph API

Create an application access policy.
Run the following command, replacing the AppId, PolicyScopeGroupId, and Description arguments. New-ApplicationAccessPolicy -AppId e7e4dbfc-046f-4074-9b3b-2ae8f144f59b -PolicyScopeGroupId EvenUsers@contoso.com -AccessRight RestrictAccess -Description "Restrict this app to members of distribution group EvenUsers."

Test the newly created application access policy.
Run the following command, replacing the AppId and Identity arguments. Test-ApplicationAccessPolicy -Identity user1@contoso.com -AppId e7e4dbfc-046-4074-9b3b-2ae8f144f59b The output of this command will indicate whether the app has access to User1’s mailbox.

Note: Changes to application access policies can take up to 30 minutes to take effect in Microsoft Graph REST API calls.
Please sign in to rate this answer.

1 person found this answer helpful.
Dev Anand 1 Reputation point

2020-10-14T05:52:01.173+00:00

Thanks for the Quick Response.

We tried the above steps but it did n't work. We assigned single user under 'Users and Groups' but the API is able to fetch the event details of other user as well.

Krish G 2,326 Reputation points

2020-10-14T05:55:49.587+00:00

You made sure to make "User assignment required" to "yes", right? Also when you say "API is able to fetch the event details of other user as well", what do you mean by API here? Graph API calendar events or something else?

Restricting AAD app to user/group means, only those users would able to OIDC+OAuth2 flow using that app. If your API requires further authorization in your API backend to filter backend data, that's your backend API logic.

Dev Anand 1 Reputation point

2020-10-14T06:47:32.227+00:00

Yes i have checked the "user assignment required" to true. I am trying to sync events from one system to another using the Graph API.

In the AD Enterprise application, if i check the "User assignment required" to true and don't add any user, i am still able to create an event for any AD user using Graph API.

Can you help me?

Krish G 2,326 Reputation points

2020-10-14T07:51:58.033+00:00

How are you authenticating for graph api call? Is it application client credential or on behalf of a user (like admin)? For application identity scenario, updated my answer above to add second section "Application identity scenario"

Dev Anand 1 Reputation point

2020-10-14T08:41:55.07+00:00

Yes, i am using the application Client credential (Client ID, Client Secret and Tenant ID) to authenticate and generate token and using token to make the next actions like create, or update or delete events.

Krish G 2,326 Reputation points

2020-10-14T08:52:35.71+00:00

Thanks. Please check the second section "Application identity scenario" in my answer.

Dev Anand 1 Reputation point

2020-10-15T05:10:47.26+00:00

Thanks Krishnendu for guiding. I have couple of more doubts:
I have installed the PowerShell, can you guide how can i link powershell to my office account.

Is it possible to join for quick call and help me on this configuration?

Krish G 2,326 Reputation points

2020-10-15T05:22:58.627+00:00

As provided in my answer above, please follow this guide Connect to Exchange Online PowerShell. Let me know if you come across any issue.

Dev Anand 1 Reputation point

2020-10-15T06:11:41.957+00:00

@krishnendu ,
Please find the screenshot for the error i am facing.

I have followed your blogs on my mac:

Installed Powershell using direct download

Downloaded the Powershell V2 module

Install the module

Import the module

Enter the credentials for my admin office account

Connect to Exchange online using below command, but it failed.

Connect-ExchangeOnline -Credential $UserCredential -ShowProgress $true

Can you help or guide?

Krish G 2,326 Reputation points

2020-10-15T06:24:07.36+00:00

Unfortunately Mac support for EXO V2 module is not yet available as mentioned here https://learn.microsoft.com/powershell/exchange/exchange-online-powershell-v2?view=exchange-ps#prerequisites-for-the-exo-v2-module. And, EXO V2 in powershell 7 (core) support is in preview but Mac is not supported yet as mentioned here https://learn.microsoft.com/powershell/exchange/exchange-online-powershell-v2?view=exchange-ps#powershell-core-support-in-the-exo-v2-module

I would suggest to create a Windows VM (if you do not have access to any Windows machine) to execute this and turn off the VM once done so that you don't get charged after that.

Dev Anand 1 Reputation point

2020-10-15T06:34:14.043+00:00

@KrishnenduGhosh-MSFT
Can you confirm which module of EXO and which version of Powershell i can install and test the functionality?

Dev Anand 1 Reputation point

2020-10-15T06:37:03.827+00:00

@KrishnenduGhosh-MSFT
Can you confirm which module of EXO and which version of Powershell i can install and test the functionality on Mac?

Krish G 2,326 Reputation points

2020-10-15T06:44:25.85+00:00

As I mentioned in my last reply Mac is not supported.

Unfortunately Mac support for EXO V2 module is not yet available as mentioned here https://learn.microsoft.com/powershell/exchange/exchange-online-powershell-v2?view=exchange-ps#prerequisites-for-the-exo-v2-module. And, EXO V2 in powershell 7 (core) support is in preview but Mac is not supported yet as mentioned here https://learn.microsoft.com/powershell/exchange/exchange-online-powershell-v2?view=exchange-ps#powershell-core-support-in-the-exo-v2-module

I would suggest to create a Windows VM (if you do not have access to any Windows machine) to execute this and turn off the VM once done so that you don't get charged after that.

Dev Anand 1 Reputation point

2020-10-15T09:11:06.957+00:00

@KrishnenduGhosh-MSFT ,

as per your guidance, i am able to setup in windows machine.

Step 1: Connection to Exchange Online PowerShell -- Done
Step 2: Identify the app’s client ID --- Done
Step 3: Identify mail-enabled security group to restrict the app’s access --

Q1. Is "mail-enabled security group" a normal AD group? or does it have any specific permission?
Q2. Do we need to add the identified group under the below path? Please confirm

AD > Enterprise Application > App (registered) > Users and groups > Add Group / user

I am receiving this error as per attached screenshot

Krish G 2,326 Reputation points

2020-10-15T09:21:28.977+00:00

Q1: "mail-enabled security group" is not normal AD group. You can create it using Office365 Portal. Exchange ECP, or PowerShell. Refer Manage mail-enabled security groups
Q2: For ApplicationAccessPolicy, you don't need to assign that group to the application. That was for the user login scenario.

Dev Anand 1 Reputation point

2020-10-15T10:04:11.403+00:00

@KrishnenduGhosh-MSFT

I have created the group as you have guided, but it is still showing me below error:

Error: "The identity of the policy scope is not a security principal"

I have checked my policyGroup whether it is a "Security Principal or not" using below command, but this command returns the result as "false".

PS> Get-Recipient -Identity <<email>> | Select-Object IsValidSecurityPrincipal

Can i share you my screen and show you the whole setup? It's very urgent for us.

Krish G 2,326 Reputation points

2020-10-15T10:17:16.817+00:00

Can you try creating the group in powershell

New-DistributionGroup -Name "{name of the group}" -Alias "{alias}*" -Type security

*Alias = This is the portion of the email address that appears to the left of the at (@) symbol.

After your group is created, you can add users to the group using Offce365 portal, Exchange ECP, Powershell or Graph API

Dev Anand 1 Reputation point

2020-10-17T08:39:17.387+00:00

Thanks Krishnendu for your guidance. I am able to perform all the steps and it is working as expected.
Sign in to comment