Lock Microsoft Graph access to only one domain

user_6706769 0
Viewed 223

I have searched far and wide to find out how I can change the settings of my Microsoft Graph app so I only allow login from my own domain.

Since the login from Graph takes all Microsoft accounts i've been looking into different solutions, all from finding custom token endpoints to changing the application manifest.

In my manifest I can find this "signInAudience": "AzureADandPersonalMicrosoftAccount" - but I can't find in the documentation what other options there are.

also on this Microsoft page I can find this information

The overall solution comprises the following components:

  1. Azure AD – If the Restrict-Access-To-Tenants: <permitted tenant list> is present, Azure AD only issues security tokens for the permitted tenants.

Is there any good guides online or anyone who knows how i can restrict access to people signing in either with @xxxxx.comonly or xxxxx.onmicrosoft.com accounts?

microsoft-graph-api azure-active-directory
1 Answers

I think you're misunderstanding how Microsoft Graph works. It connects to the tenant/domain of the user authenticating. So if I authenticate with user@contoso.com, the application will only have access to the contoso.com tenant.

In terms of the authentication process itself, this is handled by Azure AD. Microsoft Graph simply accepts the token AAD returns. You can limit this process to users from a given tenant by changing the /Authorization and /Token URLs your app is using.

In most cases, apps use the /common tenant. When a user authenticates against /common, AAD handles discovering the user's actual tenant/domain and routes the request to that AAD instance for processing. These URLs look like this:

  • https://login.microsoftonline.com/common/oauth2/v2.0/authorize
  • https://login.microsoftonline.com/common/oauth2/v2.0/token

If you want to limit authentication to a single tenant, you can skip the discovery process and force AAD/OAuth to authenticate against a single AAD tenant. Only users that exist in that tenant will be able to authenticate. This is done by swapping /common with tenant's id:

  • https://login.microsoftonline.com/xxxxx.onmicrosoft.com/oauth2/v2.0/authorize
  • https://login.microsoftonline.com/xxxxx.onmicrosoft.com/oauth2/v2.0/token
user_1055180
Related