Application roles multi tenant Saas application in Azure

0
votes

For a new project we are trying out the Azure features. For a poc I have created an application that uses openidconnect en Azure active directory for authentication. The application is multi-tenant.

For now, I was able to configure the open authentication. I also added 3 application roles in the application manifest.

Now I login in with a tenant in Azure active directory. And I was able to assign these application roles to myself and when I check the application, it can also list the new assigned roles of my user from another tenant.

Now I want to create tenant specific roles (via portal and if possible via code? (OpenGraph?, ADClient?)) How can I do this?

How can add application roles and custom created roles per tenant to a user using code?

1
.netazureactive-directory

1 Answers

1
votes

The Azure AD application roles & roles claims are based on application. We can only create the roles for the application and all the tenants using this application will use the roles defined in the app’s manifest. It is not able to create the tenant specific roles.

Based on the scenario, you may consider authorize the application using the group claims since groups are based on the tenant. You can refer the code samples about Azure AD groups for authorization here.

And we can use the Azure Graph API to manage the group and users, more detail you can refer here.

Note

To create group and update the group members, the app require the permission Group.ReadWrite.All, User.ReadBasic or User.Read.All. So the apps requires administrator consent to the Group.ReadWrite.All permission.