How to make Native Client Application single tenant in Azure Active Directory?

3
votes

I've created a native client application in the Azure Active Directory, Developed a Xamarin Android app and using ADAL Library i can log in myapp using any Microsoft email account... BUT i want to choose my own domain Only (i have office365 subscription).

  • the web application or web api have a checkbox choosing single or multi-tenant, but i cant find that in the native client application.

  • i've tried to download the MANIFEST

    • changing "availableToOtherTenants" to false
    • changing "knownClientApplications" to my clientId
    • using https and http in the redirect url
    • tried almost anything that makes sense or not

but nothing happens, I still can log in to my app using any Microsoft account.

Should I make the restriction in my app after getting the logged in email??... i think that's very bad.

More info...

I've managed to do the following:

  • changing MANIFEST "availableToOtherTenants" to "true"
  • changing MANIFEST "knownClientApplications" to my ClientId
  • calling the api with authority url: "https://login.windows.net/common" (not with my tenant id)

Result:

I can login with my domain only BUT any other Microsoft account throws an unhandled exception from the ADAL library (same as the unhandled exception if the user canceled logging in)

1
androidazurexamarinazure-active-directoryoffice365api

1 Answers

0
votes

All native clients in azure ad are automatically multi tenant. However you can initialize your AuthenticationContext with the authority of your own tenant (eg ) and only your own users will be able to get a token with it. On your web API you will have to check that users are coming only from that tenant, but that already happens automatically if you specify the tenant instead of common in the middleware initialization.