Walkthrough: Register an app with Azure Active Directory

This walkthrough describes how to register an application with Azure Active Directory, which enables a user with PowerApps user account to connect to their Common Data Service environment from external client applications using OAuth authentication.

Important

PowerApps also provides you with Server-to-Server (S2S) authentication option to connect to Common Data Service environment from external applications and services using the special application user account. S2S authentication is the common way that apps registered on Microsoft AppSource use to access the data of their subscribers. More information: Build web applications using Server-to-Server (S2S) authentication.

App registration in Azure Active Directory is typically done by ISVs who want to develop external client applications to read and write data in Common Data Service. Registering an app in Azure Active Directory provides you with Application ID and Redirect URI values that ISVs can use in their client application's authentication code. When end users use the ISV's application for the first time to connect to their Common Data Service environment by providing their Common Data Service credentials, a consent form is presented to the end user. After consenting to use their Common Data Service account with the ISV's application, end users can connect to Common Data Service environment from external application. The consent form is not displayed again to other users after the first user who has already consented to use the ISV's app. Apps registered in Azure Active Directory are multi-tenant, which implies that other Common Data Service users from other tenant can connect to their environment using the ISV's app.

App registration can also be done by an application developer or individual user who is building a client application to connect to and read/write data in Common Data Service. Use the Application ID and Redirect URI values from your registered app in your client application's authentication code to be able to connect to Common Data Service environment from your client application, and perform the required operations. Note that if the app is registered in the same tenant as your Common Data Service environment, you won't be presented with a consent form when connecting from your client application to your Common Data Service environment.

Prerequisites

  • The user who is registering the application must have a user account with System Administrator security role and the global administrator role for the Office 365 subscription.

  • An Azure subscription for application registration. A trial account will also work.

Create an application registration

  1. Sign in to the Azure management portal by using an account with administrator permission. You must use an account in the same Office 365 subscription (tenant) as you intend to register the app with.

    You can also access the Azure management portal through the Office 365 Admin center by expanding the Admin centers item in the left navigation pane, and selecting Azure AD.

    Note

    If you don’t have an Azure tenant (account) or you do have one but your Office 365 subscription with Common Data Service is not available in your Azure subscription, following the instructions in the topic Set up Azure Active Directory access for your Developer Site to associate the two accounts.

    If you don’t have an account, you can sign up for one by using a credit card. However, the account is free for application registration and your credit card won’t be charged if you only follow the procedures called out in this topic to register one or more apps. More information: Active Directory Pricing Details

  2. In the Azure management portal, follow the steps as described in the Adding an application section in the Azure Active Directory developers guide to create an app.

  3. On creating an app in Azure Active Directory, a unique Application ID (previously called Client ID) is generated for your application, and the newly registered app appears on the registered apps page. Click the app to open the app information page.

  4. On the app information page, hover over Application ID (previously called Client ID) value, and select the Click to copy icon to copy the value as you’ll need to specify this in your application’s authentication code or app.config file where appropriate.

    Copy application ID

  5. Select Settings in the app info page, and use the Redirect URIs option on the Settings page to copy the redirect URI value for your app. You can also change and add additional URIs if required. For an app of Web app / API application type, you will see Reply URLs option instead of the Redirect URIs option.

Apply Permissions

  1. On the Settings page, select Required permissions > Add to add permissions for the registered app.

    Add app permission

  2. On the Add API access page:

    • Select Select an API > Common Data Service, and then click Select.

      Add app permission

    • Select Select permissions > Common Data Service, and then click Select.

      Add delegated permission

    • Select Done to add the delegated permission to the registered app.

This completes the registration of your application in Azure Active Directory.

Additional configuration options

If your application will be a Single Page Application (SPA) that depends on CORS you must configure the app registration to support the implicit flow. More information: Walkthrough: Registering and configuring a SPA application with adal.js

If your application will support server-to-server connections, see Use Multi-Tenant Server-to-server authentication

See also

Application registration in Azure Active Directory
Authenticate Users with Common Data Service Web Services