Configuring Multi-Tenant Authentication in Azure App Services (2024)

Understanding Azure Entra ID(former Active Directory/AD)

At the heart of this process lies Azure, a cloud-based identity and access management system. Key concepts to understand:

• Tenants: A tenant in Azure Entra ID represents an organization. Each organization usually has its own dedicated tenant.
• Users: Individual accounts reside within a tenant, representing employees, guests, etc.
• Applications: Software services like your web app need to be registered in Azure Entra ID for it to manage their access and authentication.
• Permissions: These define what actions your app can perform on behalf of a signed-in user (e.g., reading their profile, accessing files).

Multi-Tenant vs. Single-Tenant

• Single-Tenant: Apps designed for users within a single organization. Only users from the same Azure Entra ID tenant as the app can access it.
• Multi-Tenant: Apps accessible by users across multiple Azure Entra ID tenants, broadening your app’s potential user base.

Setting Up Your Multi-Tenant App

Prerequisites

• An existing Azure subscription.
• A basic understanding of Azure Active Directory (Azure AD).

Step 1: Registering Your Application in AzureAD

Every app interacting with Azure AD needs to be registered.

• Locate Azure Active Directory: Search for it in the Azure portal.
• App Registrations: Navigate to “App Registrations” under the “Manage” section.
• New Registration: Click “+ New registration”.

• Name and Tenant Type: Provide a memorable name for your app and select “Accounts in any organisational directory (Any Azure AD directory — Multitenant) and personal Microsoft accounts (e.g. Skype, Xbox)”.
• Register: Click the “Register” button.

Step 2: Capture Key Information

Once registered, you’ll need the following from your app’s overview page:

• Application (Client) ID: A unique identifier for your app.
• Directory (Tenant) ID: Identifies the Azure AD tenant where your app is registered.

Step 3: Create Your AppService

You’ll need an App Service Plan and an App Service Web App. The transcript nicely details this, but I’ll summarise the key points:

• Create App Service Plan: Choose your resource group, operating system (Windows or Linux), and region.
• Create App Service Web App: Give your app a name (this becomes part of the URL), select your App Service Plan, and configure the runtime stack.

Step 4: Enable Multi-Tenant Authentication

• Azure Portal: Navigate to your newly created App Service.
• Authentication (Under “Settings”): Locate the Authentication settings.

• Identity Provider: Select “Azure Active Directory”.
• App Registration: Choose “Pick an existing app registration in the directory” and select the app you registered in Step 1.
• Authentication Actions: Configure how your app should handle users who haven’t signed in. For most cases, “Restrict access” with the “Require authentication” option is ideal.

• Save: Click “Add” and then “Save” to apply your changes.

Step 5. Configure the RedirectURI

Azure AD needs to know where to send users after authentication:

• Back to Azure AD: Go to “App Registrations” and find your app.
• Authentication: Select “Authentication” under “Manage”.
• Add a Platform: Click “+ Add a platform” and choose “Web”.
• Redirect URI: Paste the base URL of your App Service Web App, followed by /.auth/login/aad/callback (Example: https://demo-app-multitenant.azurewebsites.net/.auth/login/aad/callback).
• Implicit Grant: Select “ID tokens” only.
• Configure: Click “Configure” to save the redirect URI.

Step 6: Understanding the Client Secret (Optional)

Azure automatically generates a secret for your app and it’s visible in two places:

• App Registrations -> Certificates & Secrets: View and manage the secret.
• App Service -> Configuration -> Application Settings: Automatically stored under the setting name “Microsoft_Provider_Authentication_Secret”.

It’s Time to Test!

1. Incognito/Private Window: Open a private browsing window in your browser.
2. App URL: Paste your app’s URL.
3. Login: You should be redirected to a Microsoft login page and prompted to sign in with an account from a different Azure AD tenant than the one where the app is registered.
4. Consent: Users might be prompted to consent to your app accessing their information.

Troubleshooting: “Reply URL does not match…”

If you get this error, double-check your redirect URI settings in Azure Entra ID. Ensure it’s exactly as described in Step 5.

Beyond the Basics

• Permissions: Explore API permissions in Azure Entra ID to fine-tune what your app can do on behalf of users.
• Custom Domains: For a more branded experience, you can add a custom domain name to your App Service.