Is it possible for us to create an app on our azure and can be shared with others to use?

Sakti Mohapatra 41

Hi All,

We are trying to integrate Onedrive with a WebApplication. Intent is to get the content from Onedrive into WebApplication on any event.

We are able to integrate and using the "APP Register" in Azure Active Directory and configuring with Graph API for delegation and then using the client id, client secret and tenant id from WebApplication.

Here, I would like to understand, Is it possible for us to create an app on our azure subscription and have a way for others (other companies/clients) to install it on their azure system using OAuth process in order to avoid any creation of app and sharing other details.

Please let me know if the query is clear or not. If not, I will explain more in detail.

Thanks
Sakti

VipulSparsh-MSFT 16,236 Reputation points Microsoft Employee

2020-10-19T05:44:52.627+00:00

@Sakti Mohapatra I wanted to follow up and know if the below response helped in answering your query, please do not forget to accept the response as Answer; if the response helped in answering your query.
Sakti Mohapatra 41 Reputation points

2020-10-19T16:09:24.993+00:00

Yes. It has answered and also I have accepted the answer.

Accepted answer

soumi-MSFT 11,716 Reputation points Microsoft Employee

2020-10-16T16:14:53.47+00:00
Hello @Sakti Mohapatra , thank you for reaching out and we apologize for the delay in our response. You can surely register an app in Azure AD and make it available for other organizations to be added in their Azure AD tenants and users of those Azure AD Tenants can use your app. For this you need an App type called Multi-Tenant Apps. For you current app, you can check if its a multi-tenant pr single tenant app from the following location:

This screenshot above shows that the app is a single tenant app but then you can turn it to a multi-tenant app by selecting the option "Accounts in any organizational directory (Any Azure AD directory - Multitenant)"

You can read more on the multi-tenant architecture here:

https://learn.microsoft.com/en-us/azure/active-directory/develop/single-and-multi-tenant-apps

https://learn.microsoft.com/en-us/azure/architecture/multitenant-identity/

Hope this helps.

Do let us know if this helps and if there are any more queries around this, please do let us know so that we can help you further. Also, please do not forget to accept the response as an Answer; if the above response helped in answering your query.
Please sign in to rate this answer.

1 person found this answer helpful.

0 comments No comments
Sign in to comment

1 additional answer

Sakti Mohapatra 41 Reputation points

2020-10-19T13:20:23.373+00:00

Hi @soumi-MSFT ,

Thanks for the response and sorry for the delay in reply.

We did create the "APP Register" in Azure Active Directory and configuring with Graph API for delegation (Plz refer the picture pasted below) .

We are using ClientID, ClientSecret and TenantID to connect to the Onedrive for the creation of Access Token and able to get the content from Onedrive to WebApplication using the RestEndpoint.

Can you please help or redirect more details where we can see what change is required in the APP (which was created in Azure Active Directory "APP Register") and the process involved (what change is required) so that Other tenants should be able to use the APP and get their Onedrive connect to the WebApplication using the Rest Endpoint so that their content are available?

To best of my understanding at present we are using the ClientID, ClientSecret and TenantID to generate the Access token to connect the OneDrive. If Other tenant use my tenant APP how to generate the Access token and how to integrate my APP in their tenant for the automation.

Thanks
Sakti Mohapatra
Please sign in to rate this answer.
soumi-MSFT 11,716 Reputation points Microsoft Employee

2020-10-19T13:31:02.937+00:00

Hello @Sakti Mohapatra , thank you for sharing the details. I do see that you have already updated the app registration as a Multi-Tenant App. Now the next things to get your application code to acts a multi-tenant app would be to set the authority parameter wherever it is like either in the web.config or in the applicationConfig variable to https://login.microsoftonline.com/common. Once you set this up, now your app would start going to the /common endpoint of AAD as earlier for single-tenant it used to go to the tenant specific endpoint.

soumi-MSFT 11,716 Reputation points Microsoft Employee

2020-10-19T13:31:08.647+00:00

Also, it would be good to know the type of application you are using, I mean, is it a Singlepage Javascript application or its an ASP .net WebApp or its been written in some other language.

Do let me know about the language used in this app and also the type of OAuth flow used and based on this I can redirect you to some samples that you can check to get an understanding on the type of config changes you need to make in your app to make it work as a multi-tenant app.

Sakti Mohapatra 41 Reputation points

2020-10-19T15:37:46.827+00:00

Hi @soumi-MSFT ,

Thanks for your response.

I did not get the point, what is "Authority parameter".

After creation of the APP in AzureActive directory, We copy the items ClientID, ClientSecret and TenantID.
In the WebAPP (let us call it a mywebapplication) , we have a page to set up to integration of One Drive, which has three inputs (ClientID, ClientSecret and TenantID).

We are using the https://login.microsoftonline.com/tenantID to get Refresh and Access token. (We are following the the steps mentioned at Code flow "https://learn.microsoft.com/en-us/onedrive/developer/rest-api/getting-started/msa-oauth?view=odsp-graph-online#code-flow").

The backend code is developed in Python. We care using TenantID instead of Common in the URL because we could not get the Refresh token consistently.

Thanks
Sakti

Sakti Mohapatra 41 Reputation points

2020-10-19T15:43:25.797+00:00

WebAPP is developed in Python and the input to to take the CLientID/Secret and TenantID is a page developed on JS.

The language used is Python for the Backend for OAuthFlow.

soumi-MSFT 11,716 Reputation points Microsoft Employee

2020-10-19T17:10:50.227+00:00

Hello @Sakti Mohapatra , that part where you are using https://login.microsoftonline.com/tenantID thats what is referred to as the Authority Parameter in some of the codes for WebApps or Single Page Apps. This has to be modified to https://login.microsoftonline.com/common

Sakti Mohapatra 41 Reputation points

2020-10-19T18:14:30.143+00:00

Hi @soumi-MSFT ,

Thanks.

Using "/common" in the URL "https://login.microsoftonline.com/common" is inconsistent in generating Refresh token consistently. But where as using "/tenantID" is consistent.

soumi-MSFT 11,716 Reputation points Microsoft Employee

2020-10-19T18:26:40.807+00:00

Hi @Sakti Mohapatra , I did not get what you mean by "Using "/common" in the URL "https://login.microsoftonline.com/common"; does not Refresh token consistently. But using "/tenantID" is consistent."

Fetching an Access-Token, ID-Token or Refresh-Token depends on the type of OAuth flow you are using in your code and not by the /common endpoint or /tenantID.

For eg: In case you are using Auth-Code Flow to request an access token from AAD, then in the scope parameter you need to send offline_access to fetch the refresh token along with the access_token.

To read more Auth-Code Grant Flow, please check here: https://learn.microsoft.com/en-us/azure/active-directory/develop/v2-oauth2-auth-code-flow
To use the refresh token to get another access-token you need to use the Refresh-Token Grant Flow of OAuth. You find more details on this flow here: https://www.oauth.com/oauth2-servers/access-tokens/refreshing-access-tokens/

soumi-MSFT 11,716 Reputation points Microsoft Employee

2020-10-19T18:28:09.25+00:00

In case you are using any AAD library in your application, like MSAL, it automatically fetches a new access-token using the refresh-token in the backend silently.

Sakti Mohapatra 41 Reputation points

2020-10-27T19:48:09.383+00:00

Hi @soumi-MSFT ,

Thanks for your response. Our APP is now working as expected and is truly multitenant.

Thanks for your input.

Thanks
Sakti Mohapatra
Sign in to comment